Announcement capture trusts a page global the page can define or replace
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 52/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- playwright, typescript
- Domain
- accessibility, testing-qa
Research direction
Start by locating the announcement capture and checkPage adoption code, then read how the toast ancestor walk accesses attributes over CDP. Trace how the CLI init script exposes window.__usablDrain and how the path helper is guarded. Add tests for a page that predefines the drain and one that replaces it after load; each should produce a gap or failure, never a pass.
Written by the indexing model from the issue text.
Description
What happens
Flow requirements read announcements through window.__usablDrain, a function in the page's own JavaScript world.
- On an adopted page (
checkPage), the capture is installed only if__usablDrainis not already defined. A page that defines its own before adoption keeps it. - On a CLI page, the init script defines it first, but page script can replace it afterwards.
Either way, page code can hand usabl announcements no screen reader spoke.
Why it matters
A flow requirement's expectedAnnouncement can pass on text the page supplied directly. That is a false green, and page text is supposed to be untrusted data.
Fix direction
Run the capture in an isolated world, the way the toast ancestor walk now reads attributes over CDP, or bind the drain to a value page script cannot reach. Add tests for a page that predefines the drain and for a page that replaces it after load. Both must give a gap or a failure, never a pass. The path helper has the same kind of guard and should be checked at the same time.
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- Avg merge
- 2h 48m
- Merged PRs (30d)
- 8
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from usabl-dev/usabl
-
area: engine bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Stop hook allows a stop on an unknown verdict, and the self-check prints IDLE for a null verdictOpenarea: assistants bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
area: engine bug security
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Overlay: browser context failures are counted per plugin, not per browser, and close is not sharedOpenarea: overlay bug
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
area: engine enhancement performance
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
Automattic/data-liberation-agent#953 ·
Maintainers usually reply within 1 day
-
documentation
Difficulty 1/5 Under an hour Newbie friendliness 90/100
funmary-app/funmary#399 ·
Maintainers usually reply within 1 day
-
area:curator enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
CassioDalla/Scrinalia#150 ·
Maintainers usually reply within 1 day
-
status: needs-triage v1-bug-bash
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
a2ui-project/a2ui#3533 ·
Maintainers usually reply within 1 day
-
backend enhancement priority:P3
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
geolens-io/geolens#3310 ·
Maintainers usually reply within 1 day