fix: do not allow postMessage with axe version of x.y.z

dequelabs · May 5, 2021 · e93f394 · e93f394
1 parent dee205b
commit e93f394
Show file tree

Hide file tree

Showing 12 changed files with 84 additions and 104 deletions.
diff --git a/lib/core/utils/respondable.js b/lib/core/utils/respondable.js
@@ -45,10 +45,7 @@
 			var messageSource = _getSource();
 			return (
 				// Check the version matches
-				postedMessage._source === messageSource ||
-				// Allow free communication with axe test
-				postedMessage._source === 'axeAPI.x.y.z' ||
-				messageSource === 'axeAPI.x.y.z'
+				postedMessage._source === messageSource
 			);
 		}
 		return false;
@@ -152,7 +149,7 @@
 		var topic = data.topic;
 		var subscriber = subscribers[topic];
 
-		if (subscriber) {
+		if (subscriber && source === window.parent) {
 			var responder = createResponder(source, null, data.uuid);
 			subscriber(data.message, keepalive, responder);
 		}

diff --git a/test/core/base/audit.js b/test/core/base/audit.js
@@ -1,6 +1,7 @@
 /*global Audit, Rule */
 describe('Audit', function() {
 	'use strict';
+	var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
 
 	var a, getFlattenedTree;
 	var isNotCalled = function(err) {
@@ -117,7 +118,7 @@ describe('Audit', function() {
 			audit._constructHelpUrls();
 			assert.deepEqual(audit.data.rules.target, {
 				helpUrl:
-					'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
+					'https://dequeuniversity.com/rules/axe/' + ver + '/target?application=axeAPI'
 			});
 		});
 		it('should use changed branding', function() {
@@ -133,7 +134,7 @@ describe('Audit', function() {
 			audit._constructHelpUrls();
 			assert.deepEqual(audit.data.rules.target, {
 				helpUrl:
-					'https://dequeuniversity.com/rules/thing/x.y/target?application=axeAPI'
+					'https://dequeuniversity.com/rules/thing/' + ver + '/target?application=axeAPI'
 			});
 		});
 		it('should use changed application', function() {
@@ -149,7 +150,7 @@ describe('Audit', function() {
 			audit._constructHelpUrls();
 			assert.deepEqual(audit.data.rules.target, {
 				helpUrl:
-					'https://dequeuniversity.com/rules/axe/x.y/target?application=thing'
+					'https://dequeuniversity.com/rules/axe/' + ver + '/target?application=thing'
 			});
 		});
 
@@ -161,7 +162,7 @@ describe('Audit', function() {
 				selector: 'bob',
 				metadata: {
 					helpUrl:
-						'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
+						'https://dequeuniversity.com/rules/myproject/' + ver + '/target1?application=axeAPI'
 				}
 			});
 			audit.addRule({
@@ -172,7 +173,7 @@ describe('Audit', function() {
 
 			assert.equal(
 				audit.data.rules.target1.helpUrl,
-				'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
+				'https://dequeuniversity.com/rules/myproject/' + ver + '/target1?application=axeAPI'
 			);
 			assert.isUndefined(audit.data.rules.target2);
 
@@ -182,11 +183,11 @@ describe('Audit', function() {
 
 			assert.equal(
 				audit.data.rules.target1.helpUrl,
-				'https://dequeuniversity.com/rules/myproject/x.y/target1?application=axeAPI'
+				'https://dequeuniversity.com/rules/myproject/' + ver + '/target1?application=axeAPI'
 			);
 			assert.equal(
 				audit.data.rules.target2.helpUrl,
-				'https://dequeuniversity.com/rules/thing/x.y/target2?application=axeAPI'
+				'https://dequeuniversity.com/rules/thing/' + ver + '/target2?application=axeAPI'
 			);
 		});
 		it('understands prerelease type version numbers', function() {
@@ -207,24 +208,6 @@ describe('Audit', function() {
 				'https://dequeuniversity.com/rules/axe/3.2/target?application=axeAPI'
 			);
 		});
-		it('sets x.y as version for invalid versions', function() {
-			var tempVersion = axe.version;
-			var audit = new Audit();
-			audit.addRule({
-				id: 'target',
-				matches: 'function () {return "hello";}',
-				selector: 'bob'
-			});
-
-			axe.version = 'in-3.0-valid';
-			audit._constructHelpUrls();
-
-			axe.version = tempVersion;
-			assert.equal(
-				audit.data.rules.target.helpUrl,
-				'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
-			);
-		});
 		it('matches major release versions', function() {
 			var tempVersion = axe.version;
 			var audit = new Audit();
@@ -280,7 +263,7 @@ describe('Audit', function() {
 			});
 			assert.deepEqual(audit.data.rules.target, {
 				helpUrl:
-					'https://dequeuniversity.com/rules/axe/x.y/target?application=thing'
+					'https://dequeuniversity.com/rules/axe/' + ver + '/target?application=thing'
 			});
 		});
 		it('should call _constructHelpUrls even when nothing changed', function() {
@@ -295,7 +278,7 @@ describe('Audit', function() {
 			audit.setBranding(undefined);
 			assert.deepEqual(audit.data.rules.target, {
 				helpUrl:
-					'https://dequeuniversity.com/rules/axe/x.y/target?application=axeAPI'
+					'https://dequeuniversity.com/rules/axe/' + ver + '/target?application=axeAPI'
 			});
 		});
 		it('should not replace custom set branding', function() {
@@ -306,7 +289,7 @@ describe('Audit', function() {
 				selector: 'bob',
 				metadata: {
 					helpUrl:
-						'https://dequeuniversity.com/rules/customer-x/x.y/target?application=axeAPI'
+						'https://dequeuniversity.com/rules/customer-x/' + ver + '/target?application=axeAPI'
 				}
 			});
 			audit.setBranding({
@@ -315,7 +298,7 @@ describe('Audit', function() {
 			});
 			assert.equal(
 				audit.data.rules.target.helpUrl,
-				'https://dequeuniversity.com/rules/customer-x/x.y/target?application=axeAPI'
+				'https://dequeuniversity.com/rules/customer-x/' + ver + '/target?application=axeAPI'
 			);
 		});
 	});

diff --git a/test/core/export.js b/test/core/export.js
@@ -5,6 +5,6 @@ describe('export', function() {
 		assert.isDefined(window.axe);
 	});
 	it('should define version', function() {
-		assert.equal(axe.version, 'x.y.z');
+		assert.isNotNull(axe.version);
 	});
 });
diff --git a/test/core/public/configure.js b/test/core/public/configure.js
@@ -2,6 +2,7 @@
 describe('axe.configure', function() {
 	'use strict';
 	var fixture = document.getElementById('fixture');
+	var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
 
 	afterEach(function() {
 		fixture.innerHTML = '';
@@ -68,7 +69,7 @@ describe('axe.configure', function() {
 		assert.lengthOf(axe._audit.rules, 1);
 		assert.equal(
 			axe._audit.data.rules.bob.helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/bob?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/bob?application=axeAPI'
 		);
 		axe.configure({
 			branding: {
@@ -78,7 +79,7 @@ describe('axe.configure', function() {
 		});
 		assert.equal(
 			axe._audit.data.rules.bob.helpUrl,
-			'https://dequeuniversity.com/rules/thung/x.y/bob?application=thing'
+			'https://dequeuniversity.com/rules/thung/' + ver + '/bob?application=thing'
 		);
 	});
 
@@ -101,7 +102,7 @@ describe('axe.configure', function() {
 
 		assert.equal(
 			axe._audit.data.rules.bob.helpUrl,
-			'https://dequeuniversity.com/rules/thung/x.y/bob?application=thing'
+			'https://dequeuniversity.com/rules/thung/' + ver + '/bob?application=thing'
 		);
 	});
 

diff --git a/test/core/public/get-rules.js b/test/core/public/get-rules.js
@@ -1,5 +1,6 @@
 describe('axe.getRules', function() {
 	'use strict';
+	var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
 
 	beforeEach(function() {
 		axe._load({
@@ -46,7 +47,7 @@ describe('axe.getRules', function() {
 		assert.equal(retValue[0].help, 'halp');
 		assert.equal(
 			retValue[0].helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/awesomeRule1?application=axeAPI'
 		);
 		assert.deepEqual(retValue[0].tags, ['tag1']);
 
@@ -55,7 +56,7 @@ describe('axe.getRules', function() {
 		assert.equal(retValue[1].help, 'halp me!');
 		assert.equal(
 			retValue[1].helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/awesomeRule2?application=axeAPI'
 		);
 		assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
 
@@ -67,7 +68,7 @@ describe('axe.getRules', function() {
 		assert.equal(retValue[0].help, 'halp me!');
 		assert.equal(
 			retValue[0].helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/awesomeRule2?application=axeAPI'
 		);
 		assert.deepEqual(retValue[0].tags, ['tag1', 'tag2']);
 	});
@@ -85,7 +86,7 @@ describe('axe.getRules', function() {
 		assert.equal(retValue[0].help, 'halp');
 		assert.equal(
 			retValue[0].helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/awesomeRule1?application=axeAPI'
 		);
 		assert.deepEqual(retValue[0].tags, ['tag1']);
 
@@ -94,7 +95,7 @@ describe('axe.getRules', function() {
 		assert.equal(retValue[1].help, 'halp me!');
 		assert.equal(
 			retValue[1].helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/awesomeRule2?application=axeAPI'
 		);
 		assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
 	});
@@ -106,7 +107,7 @@ describe('axe.getRules', function() {
 		assert.equal(retValue[0].help, 'halp');
 		assert.equal(
 			retValue[0].helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/awesomeRule1?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/awesomeRule1?application=axeAPI'
 		);
 		assert.deepEqual(retValue[0].tags, ['tag1']);
 
@@ -115,7 +116,7 @@ describe('axe.getRules', function() {
 		assert.equal(retValue[1].help, 'halp me!');
 		assert.equal(
 			retValue[1].helpUrl,
-			'https://dequeuniversity.com/rules/axe/x.y/awesomeRule2?application=axeAPI'
+			'https://dequeuniversity.com/rules/axe/' + ver + '/awesomeRule2?application=axeAPI'
 		);
 		assert.deepEqual(retValue[1].tags, ['tag1', 'tag2']);
 	});

diff --git a/test/core/public/run-rules.js b/test/core/public/run-rules.js
@@ -1,6 +1,7 @@
 /*global runRules */
 describe('runRules', function() {
 	'use strict';
+	var ver = axe.version.substring(0, axe.version.lastIndexOf('.'));
 
 	function iframeReady(src, context, id, cb) {
 		var i = document.createElement('iframe');
@@ -198,7 +199,7 @@ describe('runRules', function() {
 							{
 								id: 'div#target',
 								helpUrl:
-									'https://dequeuniversity.com/rules/axe/x.y/div#target?application=axeAPI',
+									'https://dequeuniversity.com/rules/axe/' + ver +'/div#target?application=axeAPI',
 								pageLevel: false,
 								impact: null,
 								inapplicable: [],
@@ -233,7 +234,7 @@ describe('runRules', function() {
 							{
 								id: 'first-div',
 								helpUrl:
-									'https://dequeuniversity.com/rules/axe/x.y/first-div?application=axeAPI',
+									'https://dequeuniversity.com/rules/axe/' + ver +'/first-div?application=axeAPI',
 								pageLevel: false,
 								impact: null,
 								inapplicable: [],
@@ -485,7 +486,7 @@ describe('runRules', function() {
 					{
 						id: 'div#target',
 						helpUrl:
-							'https://dequeuniversity.com/rules/axe/x.y/div#target?application=axeAPI',
+							'https://dequeuniversity.com/rules/axe/' + ver +'/div#target?application=axeAPI',
 						pageLevel: false,
 						foo: 'bar',
 						stuff: 'blah',
@@ -522,7 +523,7 @@ describe('runRules', function() {
 					{
 						id: 'first-div',
 						helpUrl:
-							'https://dequeuniversity.com/rules/axe/x.y/first-div?application=axeAPI',
+							'https://dequeuniversity.com/rules/axe/' + ver +'/first-div?application=axeAPI',
 						pageLevel: false,
 						bar: 'foo',
 						stuff: 'no',