@surea11y/core 1.3.0 → 1.4.1

package/src/checks/automatic/label-in-name.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'label-in-name';
@@ -50,6 +52,56 @@ function runInPage(ctx) {
     return v.replace(/\s+/g, ' ').trim().toLowerCase();
   }
 
+  // WCAG 2.5.3's label-in-name comparison is over words, not characters: drop
+  // parenthesised text, case-fold and NFKD-normalise, then reduce every
+  // non-letter/digit to a space. `hyphensJoin` deletes hyphens instead of
+  // splitting on them, which distinguishes a real mismatch from one that is
+  // only a hyphenation difference.
+  function tokenize(s, hyphensJoin) {
+    let v = (s == null ? '' : String(s)).replace(/\([^)]*\)/g, ' ').toLowerCase();
+    try {
+      v = v.normalize('NFKD');
+    } catch {
+      // Realm without String#normalize: the word comparison below still holds.
+    }
+    if (hyphensJoin) v = v.replace(/[-‐-―−]/g, '');
+    return v
+      .replace(/[^\p{L}\p{N}]+/gu, ' ')
+      .split(' ')
+      .filter(Boolean);
+  }
+
+  // The label's words must appear adjacent and in order inside the name, so a
+  // scattered subsequence does not count. Words in `prefixable` may match a
+  // longer name word they start.
+  function containsWordRun(needle, hay, prefixable) {
+    if (!needle.length) return true;
+    for (let i = 0; i + needle.length <= hay.length; i++) {
+      let ok = true;
+      for (let j = 0; j < needle.length; j++) {
+        const want = needle[j];
+        const got = hay[i + j];
+        if (got === want) continue;
+        if (prefixable && prefixable.has(want) && got.indexOf(want) === 0) continue;
+        ok = false;
+        break;
+      }
+      if (ok) return true;
+    }
+    return false;
+  }
+
+  // A trailing period marks a word the author may have shortened ("Ave." for
+  // "Avenue"). Tokenizing removes the period, so collect these beforehand.
+  function abbreviatedWords(s) {
+    const out = new Set();
+    for (const w of (s == null ? '' : String(s)).split(/\s+/)) {
+      const m = /^([\p{L}\p{N}]+)\.$/u.exec(w);
+      if (m) out.add(m[1].toLowerCase());
+    }
+    return out;
+  }
+
   function getElementDescriptor(el) {
     const tag = el && el.tagName ? String(el.tagName).toLowerCase() : 'element';
     let role;
@@ -90,20 +142,13 @@ function runInPage(ctx) {
   }
 
   // Unlike isDomVisible above, this also excludes aria-hidden subtrees.
-  // Needed specifically for collectVisibleTextUnder's per-text-node check
-  // below: an aria-hidden icon-font glyph (e.g. Material Icons' ligature
-  // pattern, <mat-icon aria-hidden="true">format_color_fill</mat-icon>) is
-  // technically DOM-visible pixels, but is never perceived by a sighted or
-  // voice-control user as literal readable words the way real visible text
-  // is — a widely-used reference engine's own label-content-name-mismatch check reaches the same
-  // practical outcome via a canvas-based ligature-detection heuristic
-  // (measuring rendered glyph shapes), not replicable here since this rule
-  // runs against static markup with no real canvas/font rendering
-  // available; excluding aria-hidden content is a cheaper, static-markup
-  // signal that gets the common case (decorative icon fonts) right without
-  // needing one. Confirmed via a live-DOM cross-engine run 2026-07-21
-  // (Angular Material's theme-picker button, aria-label="Select a theme",
-  // aria-hidden icon rendering literally as "format_color_fill").
+  // Needed for collectVisibleTextUnder's per-text-node check below: an
+  // aria-hidden icon-font glyph (e.g. an <i aria-hidden="true"> ligature
+  // rendering as "format_color_fill") is DOM-visible pixels but is never
+  // perceived as literal readable words the way real visible text is.
+  // Excluding aria-hidden content is a cheap static-markup signal that gets
+  // the common case (decorative icon fonts) right — an icon-only button
+  // named via aria-label shouldn't have its glyph name counted as text.
   function isAccEligible(el) {
     if (!el) return false;
     const fn =
@@ -122,11 +167,12 @@ function runInPage(ctx) {
   // than referencing the global NodeFilter object directly: runInPage must
   // have zero free vars (see docs/RULE_AUTHORING.md's free-var footgun) and
   // NodeFilter is not itself present in the execution realm this function
-  // actually runs in, unlike window/document. Confirmed 2026-07-21 — this
-  // silently made createTreeWalker throw on every call, falling back to
-  // raw container.textContent (which respects none of isNonRenderedTag/
-  // isDomVisible/isAccEligible below, since that whole per-node loop is
-  // skipped in the fallback path). Same pattern already used correctly in
+  // actually runs in, unlike window/document. Referencing the global
+  // directly would silently make createTreeWalker throw on every call,
+  // falling back to raw container.textContent (which respects none of
+  // isNonRenderedTag/isDomVisible/isAccEligible below, since that whole
+  // per-node loop is skipped in the fallback path). Same pattern already
+  // used correctly in
   // region-manual.js's own createTreeWalker call.
   const SHOW_TEXT = 4;
 
@@ -301,7 +347,23 @@ function runInPage(ctx) {
     const accName = acc && acc.value != null ? String(acc.value) : '';
     const accNorm = norm(accName);
 
-    const contains = !!(accNorm && visibleNorm && accNorm.indexOf(visibleNorm) !== -1);
+    const labelTokens = tokenize(visibleLabel, false);
+    const nameTokens = tokenize(accName, false);
+    const contains = containsWordRun(labelTokens, nameTokens, null);
+
+    // An abbreviation, or a word hyphenated differently in the two places, is
+    // not something markup settles: the author may have meant either. Report
+    // without asserting a defect instead of failing or staying silent.
+    let uncertainty = '';
+    if (!contains) {
+      if (containsWordRun(tokenize(visibleLabel, true), tokenize(accName, true), null)) {
+        uncertainty = 'HYPHENATION_DIFFERS';
+      } else {
+        const abbreviated = abbreviatedWords(visibleLabel);
+        if (abbreviated.size && containsWordRun(labelTokens, nameTokens, abbreviated))
+          uncertainty = 'POSSIBLE_ABBREVIATION';
+      }
+    }
 
     if (!contains) {
       const selectorOut = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
@@ -312,11 +374,16 @@ function runInPage(ctx) {
       occurrences.push({
         selector: selectorOut,
         html,
-        summary: 'Accessible name does not contain the visible label text.',
-        hint: 'Ensure the accessible name includes the visible text label (e.g., update aria-label/aria-labelledby to include the visible wording).',
+        ...(uncertainty ? { outcome: 'cantTell' } : null),
+        summary: uncertainty
+          ? 'Accessible name may not contain the visible label text.'
+          : 'Accessible name does not contain the visible label text.',
+        hint: uncertainty
+          ? 'Check by hand: the two differ only by an abbreviation or by hyphenation, which markup cannot settle.'
+          : 'Ensure the accessible name includes the visible text label (e.g., update aria-label/aria-labelledby to include the visible wording).',
         i18n: {
-          summaryKey: 'labelInName_summary_fail',
-          hintKey: 'labelInName_hint_fail',
+          summaryKey: uncertainty ? 'labelInName_summary_cantTell' : 'labelInName_summary_fail',
+          hintKey: uncertainty ? 'labelInName_hint_cantTell' : 'labelInName_hint_fail',
           params: {
             element: getElementDescriptor(el),
             visibleLabel: clipForSummary(visibleLabel),
@@ -326,10 +393,11 @@ function runInPage(ctx) {
         },
         data: {
           details: {
-            reasonCode: 'VISIBLE_LABEL_NOT_IN_ACCESSIBLE_NAME',
+            reasonCode: uncertainty || 'VISIBLE_LABEL_NOT_IN_ACCESSIBLE_NAME',
             visibleLabel,
             accessibleName: accName,
             normalized: { visibleLabel: visibleNorm, accessibleName: accNorm },
+            tokenized: { visibleLabel: labelTokens, accessibleName: nameTokens },
             labelSource: labelInfo && labelInfo.source ? labelInfo.source : 'none',
             nameMechanism: acc && acc.mechanism ? acc.mechanism : 'none'
           }
@@ -340,13 +408,15 @@ function runInPage(ctx) {
 
   if (applicableCount === 0)
     return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
-  if (occurrences.length)
+  if (occurrences.length) {
+    const anyFail = occurrences.some((o) => o.outcome !== 'cantTell');
     return {
       ruleId: rule.ruleId,
-      outcome: 'fail',
+      outcome: anyFail ? 'fail' : 'cantTell',
       severity: rule.defaultSeverity || 'minor',
       occurrences
     };
+  }
   return { ruleId: rule.ruleId, outcome: 'pass', severity: 'minor', occurrences: [] };
 }
 

package/src/checks/automatic/language-page-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -142,7 +144,11 @@ function runInPage(ctx) {
   }
 
   // Minimal BCP47 primary subtag check
-  if (!/^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/.test(lang)) {
+  const isValidTag =
+    helpers && typeof helpers.isValidLanguageTag === 'function'
+      ? helpers.isValidLanguageTag
+      : (v) => /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/.test(String(v || ''));
+  if (!isValidTag(lang)) {
     return {
       ruleId: rule.ruleId,
       outcome: 'fail',

package/src/checks/automatic/link-in-text-block.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**

package/src/checks/automatic/link-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'link-name-present';
@@ -57,7 +59,14 @@ function runInPage(ctx) {
 
   for (const el of nodes) {
     // isAccTreeEligible returns { eligible, reasons }, not a boolean.
-    const eligResult = helpers.isAccTreeEligible ? helpers.isAccTreeEligible(el, ctx) : true;
+    // Naming rules apply only to elements included in the accessibility tree
+    // (ACT c487ae), which excludes focusable aria-hidden content;
+    // aria-hidden-focus (ACT 6cfa84) covers that markup instead.
+    const eligResult = helpers.isIncludedInAccessibilityTree
+      ? helpers.isIncludedInAccessibilityTree(el, ctx)
+      : helpers.isAccTreeEligible
+        ? helpers.isAccTreeEligible(el, ctx)
+        : true;
     const eligible =
       typeof eligResult === 'boolean' ? eligResult : !!(eligResult && eligResult.eligible);
     if (!eligible) continue;
@@ -67,33 +76,59 @@ function runInPage(ctx) {
     const nameInfo = helpers.getAccessibleNameInfo ? helpers.getAccessibleNameInfo(el, ctx) : null;
     const programmaticName = nameInfo && typeof nameInfo.value === 'string' ? nameInfo.value : '';
 
-    // A native <a href>/<area href> (or [role="link"]) whose role has been
-    // overridden to one of these roles is no longer semantically a link —
-    // per the WAI-ARIA Accessible Name and Description Computation spec
-    // these roles are name-from-author-only, and their rendered content
-    // represents a VALUE, not a NAME (see button-name-present.js's identical
-    // fix for a real-world example — <button role="combobox">List</button> —
-    // of the same class of bug on a different host tag).
     const role = el.getAttribute ? el.getAttribute('role') : null;
     const roleNorm = String(role || '')
       .replace(/\s+/g, ' ')
       .trim()
       .toLowerCase();
-    const VALUE_ROLES = [
-      'textbox',
-      'progressbar',
-      'scrollbar',
-      'slider',
-      'spinbutton',
-      'combobox',
-      'listbox'
+    // ARIA 1.2 "Name From: author, contents". Every other known role is
+    // name-from-author-only. An unknown role falls back to the implicit role.
+    // <generated:aria-name-from-content>
+    const NAME_FROM_CONTENT_ROLES = [
+      'button',
+      'cell',
+      'checkbox',
+      'columnheader',
+      'doc-backlink',
+      'doc-biblioref',
+      'doc-glossref',
+      'doc-noteref',
+      'graphics-object',
+      'gridcell',
+      'heading',
+      'link',
+      'menuitem',
+      'menuitemcheckbox',
+      'menuitemradio',
+      'option',
+      'radio',
+      'row',
+      'rowgroup',
+      'rowheader',
+      'switch',
+      'tab',
+      'tooltip',
+      'treeitem'
     ];
-    const isContentNameCandidate = !VALUE_ROLES.includes(roleNorm);
+    // </generated:aria-name-from-content>
+    const isKnownRoleToken =
+      helpers && helpers.aria && typeof helpers.aria.isKnownRole === 'function'
+        ? (() => {
+            try {
+              return !!helpers.aria.isKnownRole(roleNorm);
+            } catch {
+              return false;
+            }
+          })()
+        : false;
+    const isContentNameCandidate =
+      !roleNorm || !isKnownRoleToken || NAME_FROM_CONTENT_ROLES.includes(roleNorm);
 
     const contentName =
       programmaticName.trim().length === 0 && isContentNameCandidate
         ? getConservativeSubtreeText(el)
         : '';
+
     const finalName = (programmaticName.trim().length ? programmaticName : contentName).trim();
 
     if (finalName.length === 0) {

package/src/checks/automatic/list-children-valid.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -24,28 +26,17 @@
  *   inverse relationship: does a given <li> have a valid parent).
  * - Direct children that are not exposed to the accessibility tree (e.g.
  *   display:none, [hidden], aria-hidden="true") are excluded from
- *   consideration entirely — matching a widely-used reference engine's own
- *   `only-listitems` check, which likewise skips non-AT-visible children. Confirmed against
- *   two real sites: Spotify's newsroom has a stray `<input type="hidden">`
- *   as a direct <ul> child (UA-stylesheet display:none by spec for
- *   input[type=hidden]), and Stanford's main nav interleaves `<li>` with
- *   `<span style="display:none">` hydration markers. Neither is reachable
- *   by assistive technology, so neither breaks the list semantics a screen
- *   reader actually announces.
- * - The explicit-role-overrides-tag behavior above was added after reading
- *   a widely-used reference engine's ACTUAL `only-listitems` evaluate function
- *   directly (`invalidChildrenEvaluate`/`getInvalidSelector` — note this is a
- *   DIFFERENT function from the similarly-named, unused `onlyListitemsEvaluate`
- *   elsewhere in that engine's source; don't confuse the two when re-verifying). Its
- *   exact rule: if a child has an explicit role, only `validRoles` (here,
- *   `['listitem']`) is consulted — the tag name is never checked. Only
- *   without an explicit role does the tag name (`validNodeNames`) matter.
- *   Found via two real sites: Notion's footer nav lists include a
- *   `<li role="none">` used purely to host the list's own visually-hidden
- *   label (referenced by the `<ul>`'s `aria-labelledby`), and LinkedIn has
- *   both an all-`<li role="menuitem">` menu list and a footer list mixing
- *   real `<li>`s with one `<li role="presentation">` — that reference engine
- *   correctly flags all of these, surea11y's tag-only check missed them entirely.
+ *   consideration entirely — an element not reachable by assistive
+ *   technology can't break the list semantics a screen reader announces.
+ *   Common cases: a stray `<input type="hidden">` as a direct <ul> child
+ *   (UA-stylesheet display:none by spec), or `<span style="display:none">`
+ *   hydration markers interleaved with real `<li>`s.
+ * - Explicit-role-overrides-tag: if a child has an explicit role, only
+ *   `['listitem']` is consulted — the tag name is never checked. Only
+ *   without an explicit role does the tag name matter. Catches cases a
+ *   tag-only check misses: `<li role="none">` hosting a list's own
+ *   visually-hidden label, `<li role="menuitem">` menu items, or a real
+ *   `<li>` mixed with an `<li role="presentation">`.
  */
 
 const id = 'list-children-valid';
@@ -120,8 +111,7 @@ function runInPage(ctx) {
       const roleAttr = child.getAttribute ? String(child.getAttribute('role') || '').trim() : '';
       const explicitRole = roleAttr ? (roleAttr.split(/\s+/)[0] || '').toLowerCase() : '';
 
-      // An explicit role always wins over the tag — see the header
-      // comment's Notion/LinkedIn examples.
+      // An explicit role always wins over the tag — see header comment.
       const valid = explicitRole ? explicitRole === 'listitem' : ALLOWED_CHILD_TAGS.has(tag);
 
       if (!valid) invalidTags.push(tag);

package/src/checks/automatic/listbox-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'listbox-name-present';
@@ -107,9 +109,16 @@ function runInPage(ctx) {
     return '';
   }
 
+  // Naming rules apply only to elements included in the accessibility tree
+  // (ACT c487ae and siblings), which excludes focusable aria-hidden content.
+  // aria-hidden-focus (ACT 6cfa84) covers that markup instead.
   function isEligibleAcc(helpers, el, ctx) {
     const fn =
-      helpers && typeof helpers.isAccTreeEligible === 'function' ? helpers.isAccTreeEligible : null;
+      helpers && typeof helpers.isIncludedInAccessibilityTree === 'function'
+        ? helpers.isIncludedInAccessibilityTree
+        : helpers && typeof helpers.isAccTreeEligible === 'function'
+          ? helpers.isAccTreeEligible
+          : null;
     if (!fn) return true;
     try {
       const r = fn(el, ctx);

package/src/checks/automatic/listitem-parent-valid.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -25,12 +27,19 @@
  *   native role is fully replaced by the explicit one — the same "any
  *   explicit role overrides the element's native role" ARIA principle
  *   applied elsewhere in this engine), so an <li> inside it is invalid
- *   despite the <ul> tag — found on a real site, Nike's desktop nav
- *   dropdown (`<ul class="desktop-category" role="menu"><li>...`).
- *   Conversely role="presentation"/"none" on the parent is still a valid
- *   (list-semantics-suppressing) parent, matching a widely-used reference
- *   engine's own `listitem` check (`['presentation', 'none', 'list'].includes(parentRole)`,
- *   confirmed by reading its source directly).
+ *   despite the <ul> tag (e.g. `<ul role="menu"><li>...`). Conversely
+ *   role="presentation"/"none" on the parent is still a valid
+ *   (list-semantics-suppressing) parent — the accepted parent roles are
+ *   presentation, none, and list.
+ * - The SAME "explicit role wins" principle applies to the <li> ELEMENT
+ *   ITSELF: an <li role="tab">/role="menuitem">/role="presentation"> etc.
+ *   is exposed to AT with that role, never "listitem" — the whole point
+ *   of this check (list items need a valid list-container parent) doesn't
+ *   apply when the element isn't claiming listitem semantics in the first
+ *   place. Any `<li>` with an explicit `role` attribute is excluded from
+ *   candidacy. `role="listitem"` itself is a no-op restatement (not an
+ *   override), so it still falls through to the normal parent-validity
+ *   check below.
  */
 
 const id = 'listitem-parent-valid';
@@ -75,6 +84,20 @@ function runInPage(ctx) {
     const parent = el.parentElement;
     if (!parent) continue;
 
+    // An explicit role on the <li> ITSELF overrides its native "listitem"
+    // role entirely, the same "any explicit role wins over the tag's
+    // native role" principle this check already applies to the PARENT
+    // (see the header comment). An <li role="tab">/
+    // role="menuitem">/role="presentation"> etc. is exposed to AT with
+    // THAT role, never "listitem" -- so the "list item needs a valid list
+    // container parent" concern this rule exists for doesn't apply to it
+    // at all; there's no listitem semantics being claimed to validate.
+    // role="listitem" itself is a no-op restatement, not an override, so
+    // it still falls through to the normal parent check below.
+    const ownRoleAttr = el.getAttribute ? String(el.getAttribute('role') || '').trim() : '';
+    const ownExplicitRole = ownRoleAttr ? (ownRoleAttr.split(/\s+/)[0] || '').toLowerCase() : '';
+    if (ownExplicitRole && ownExplicitRole !== 'listitem') continue;
+
     applicableCount += 1;
 
     const parentTag = parent.tagName ? parent.tagName.toLowerCase() : '';
@@ -85,7 +108,7 @@ function runInPage(ctx) {
     let valid;
     if (explicitRole) {
       // An explicit role always wins over the tag's native role, in either
-      // direction — see the header comment's Nike example.
+      // direction — see the header comment.
       valid = explicitRole === 'list' || explicitRole === 'presentation' || explicitRole === 'none';
     } else {
       valid = parentTag === 'ul' || parentTag === 'ol';

package/src/checks/automatic/menuitem-name-present.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 const id = 'menuitem-name-present';
@@ -82,9 +84,16 @@ function runInPage(ctx) {
     return '';
   }
 
+  // Naming rules apply only to elements included in the accessibility tree
+  // (ACT c487ae and siblings), which excludes focusable aria-hidden content.
+  // aria-hidden-focus (ACT 6cfa84) covers that markup instead.
   function isEligibleAcc(helpers, el, ctx) {
     const fn =
-      helpers && typeof helpers.isAccTreeEligible === 'function' ? helpers.isAccTreeEligible : null;
+      helpers && typeof helpers.isIncludedInAccessibilityTree === 'function'
+        ? helpers.isIncludedInAccessibilityTree
+        : helpers && typeof helpers.isAccTreeEligible === 'function'
+          ? helpers.isAccTreeEligible
+          : null;
     if (!fn) return true;
     try {
       const r = fn(el, ctx);

package/src/checks/automatic/meta-refresh-no-exceptions.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -24,10 +26,8 @@
  * - A <meta> nested inside <noscript> is excluded: it only ever takes
  *   effect when scripting is disabled, which is never the case for any
  *   context capable of running accessibility tooling in the first place
- *   (confirmed 2026-07-21 via a real-world false positive: Slack's
- *   homepage has a <noscript><meta http-equiv="refresh" content="0;
- *   URL=/?nojsmode=1"></noscript> JS-disabled fallback — a widely-used
- *   reference engine's own same-named check correctly doesn't flag it either).
+ *   (e.g. a <noscript><meta http-equiv="refresh" content="0; URL=/?nojs=1">
+ *   </noscript> JS-disabled fallback).
  */
 
 const id = 'meta-refresh-no-exceptions';
@@ -87,6 +87,34 @@ function runInPage(ctx) {
     : [];
 
   const occurrences = [];
+  // HTML's shared declarative refresh steps. Returns the delay in seconds, or
+  // null when the value is not a valid refresh directive, in which case the
+  // browser never refreshes and there is nothing to report. Rejects a leading
+  // sign ("+72001"), a non-numeric time ("foo"), and a separator other than
+  // "," or ";" ("0:1").
+  function parseRefreshDelay(input) {
+    const s = String(input == null ? '' : input);
+    const isSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\f' || c === '\r';
+    let i = 0;
+    while (i < s.length && isSpace(s[i])) i++;
+    let digits = '';
+    while (i < s.length && s[i] >= '0' && s[i] <= '9') digits += s[i++];
+    if (!digits) return null;
+    if (s[i] === '.') {
+      i++;
+      while (i < s.length && s[i] >= '0' && s[i] <= '9') i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    let sawSpace = false;
+    while (i < s.length && isSpace(s[i])) {
+      sawSpace = true;
+      i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    if (s[i] === ';' || s[i] === ',' || sawSpace) return parseInt(digits, 10);
+    return null;
+  }
+
   let applicableCount = 0;
 
   for (const el of nodes) {
@@ -94,6 +122,7 @@ function runInPage(ctx) {
     if (el.closest && el.closest('noscript')) continue; // never applies with scripting enabled
     const raw = String(el.getAttribute('content') || '').trim();
     if (!raw) continue;
+    if (parseRefreshDelay(raw) === null) continue;
 
     applicableCount += 1;
 

package/src/checks/automatic/meta-refresh-timing-absent.js

@@ -1,3 +1,5 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
 'use strict';
 
 /**
@@ -77,16 +79,42 @@ function runInPage(ctx) {
   const occurrences = [];
   let applicableCount = 0;
 
+  // HTML's shared declarative refresh steps. Returns the delay in seconds, or
+  // null when the value is not a valid refresh directive, in which case the
+  // browser never refreshes and there is nothing to report. Rejects a leading
+  // sign ("+72001"), a non-numeric time ("foo"), and a separator other than
+  // "," or ";" ("0:1").
+  function parseRefreshDelay(input) {
+    const s = String(input == null ? '' : input);
+    const isSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\f' || c === '\r';
+    let i = 0;
+    while (i < s.length && isSpace(s[i])) i++;
+    let digits = '';
+    while (i < s.length && s[i] >= '0' && s[i] <= '9') digits += s[i++];
+    if (!digits) return null;
+    if (s[i] === '.') {
+      i++;
+      while (i < s.length && s[i] >= '0' && s[i] <= '9') i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    let sawSpace = false;
+    while (i < s.length && isSpace(s[i])) {
+      sawSpace = true;
+      i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    if (s[i] === ';' || s[i] === ',' || sawSpace) return parseInt(digits, 10);
+    return null;
+  }
+
   for (const el of nodes) {
     if (!el || !el.getAttribute) continue;
     if (el.closest && el.closest('noscript')) continue; // never applies with scripting enabled — see meta-refresh-no-exceptions.js's header comment
     const raw = String(el.getAttribute('content') || '').trim();
     if (!raw) continue;
 
-    const match = raw.match(/^([0-9]*\.?[0-9]+)/);
-    if (!match) continue;
-    const delay = parseFloat(match[1]);
-    if (Number.isNaN(delay)) continue;
+    const delay = parseRefreshDelay(raw);
+    if (delay === null) continue;
 
     applicableCount += 1;