@surea11y/core 1.4.0 → 1.4.1

package/src/checks/automatic/label-in-name.js

@@ -52,6 +52,56 @@ function runInPage(ctx) {
     return v.replace(/\s+/g, ' ').trim().toLowerCase();
   }
 
+  // WCAG 2.5.3's label-in-name comparison is over words, not characters: drop
+  // parenthesised text, case-fold and NFKD-normalise, then reduce every
+  // non-letter/digit to a space. `hyphensJoin` deletes hyphens instead of
+  // splitting on them, which distinguishes a real mismatch from one that is
+  // only a hyphenation difference.
+  function tokenize(s, hyphensJoin) {
+    let v = (s == null ? '' : String(s)).replace(/\([^)]*\)/g, ' ').toLowerCase();
+    try {
+      v = v.normalize('NFKD');
+    } catch {
+      // Realm without String#normalize: the word comparison below still holds.
+    }
+    if (hyphensJoin) v = v.replace(/[-‐-―−]/g, '');
+    return v
+      .replace(/[^\p{L}\p{N}]+/gu, ' ')
+      .split(' ')
+      .filter(Boolean);
+  }
+
+  // The label's words must appear adjacent and in order inside the name, so a
+  // scattered subsequence does not count. Words in `prefixable` may match a
+  // longer name word they start.
+  function containsWordRun(needle, hay, prefixable) {
+    if (!needle.length) return true;
+    for (let i = 0; i + needle.length <= hay.length; i++) {
+      let ok = true;
+      for (let j = 0; j < needle.length; j++) {
+        const want = needle[j];
+        const got = hay[i + j];
+        if (got === want) continue;
+        if (prefixable && prefixable.has(want) && got.indexOf(want) === 0) continue;
+        ok = false;
+        break;
+      }
+      if (ok) return true;
+    }
+    return false;
+  }
+
+  // A trailing period marks a word the author may have shortened ("Ave." for
+  // "Avenue"). Tokenizing removes the period, so collect these beforehand.
+  function abbreviatedWords(s) {
+    const out = new Set();
+    for (const w of (s == null ? '' : String(s)).split(/\s+/)) {
+      const m = /^([\p{L}\p{N}]+)\.$/u.exec(w);
+      if (m) out.add(m[1].toLowerCase());
+    }
+    return out;
+  }
+
   function getElementDescriptor(el) {
     const tag = el && el.tagName ? String(el.tagName).toLowerCase() : 'element';
     let role;
@@ -297,7 +347,23 @@ function runInPage(ctx) {
     const accName = acc && acc.value != null ? String(acc.value) : '';
     const accNorm = norm(accName);
 
-    const contains = !!(accNorm && visibleNorm && accNorm.indexOf(visibleNorm) !== -1);
+    const labelTokens = tokenize(visibleLabel, false);
+    const nameTokens = tokenize(accName, false);
+    const contains = containsWordRun(labelTokens, nameTokens, null);
+
+    // An abbreviation, or a word hyphenated differently in the two places, is
+    // not something markup settles: the author may have meant either. Report
+    // without asserting a defect instead of failing or staying silent.
+    let uncertainty = '';
+    if (!contains) {
+      if (containsWordRun(tokenize(visibleLabel, true), tokenize(accName, true), null)) {
+        uncertainty = 'HYPHENATION_DIFFERS';
+      } else {
+        const abbreviated = abbreviatedWords(visibleLabel);
+        if (abbreviated.size && containsWordRun(labelTokens, nameTokens, abbreviated))
+          uncertainty = 'POSSIBLE_ABBREVIATION';
+      }
+    }
 
     if (!contains) {
       const selectorOut = helpers.buildSelector ? helpers.buildSelector(el) : 'html';
@@ -308,11 +374,16 @@ function runInPage(ctx) {
       occurrences.push({
         selector: selectorOut,
         html,
-        summary: 'Accessible name does not contain the visible label text.',
-        hint: 'Ensure the accessible name includes the visible text label (e.g., update aria-label/aria-labelledby to include the visible wording).',
+        ...(uncertainty ? { outcome: 'cantTell' } : null),
+        summary: uncertainty
+          ? 'Accessible name may not contain the visible label text.'
+          : 'Accessible name does not contain the visible label text.',
+        hint: uncertainty
+          ? 'Check by hand: the two differ only by an abbreviation or by hyphenation, which markup cannot settle.'
+          : 'Ensure the accessible name includes the visible text label (e.g., update aria-label/aria-labelledby to include the visible wording).',
         i18n: {
-          summaryKey: 'labelInName_summary_fail',
-          hintKey: 'labelInName_hint_fail',
+          summaryKey: uncertainty ? 'labelInName_summary_cantTell' : 'labelInName_summary_fail',
+          hintKey: uncertainty ? 'labelInName_hint_cantTell' : 'labelInName_hint_fail',
           params: {
             element: getElementDescriptor(el),
             visibleLabel: clipForSummary(visibleLabel),
@@ -322,10 +393,11 @@ function runInPage(ctx) {
         },
         data: {
           details: {
-            reasonCode: 'VISIBLE_LABEL_NOT_IN_ACCESSIBLE_NAME',
+            reasonCode: uncertainty || 'VISIBLE_LABEL_NOT_IN_ACCESSIBLE_NAME',
             visibleLabel,
             accessibleName: accName,
             normalized: { visibleLabel: visibleNorm, accessibleName: accNorm },
+            tokenized: { visibleLabel: labelTokens, accessibleName: nameTokens },
             labelSource: labelInfo && labelInfo.source ? labelInfo.source : 'none',
             nameMechanism: acc && acc.mechanism ? acc.mechanism : 'none'
           }
@@ -336,13 +408,15 @@ function runInPage(ctx) {
 
   if (applicableCount === 0)
     return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
-  if (occurrences.length)
+  if (occurrences.length) {
+    const anyFail = occurrences.some((o) => o.outcome !== 'cantTell');
     return {
       ruleId: rule.ruleId,
-      outcome: 'fail',
+      outcome: anyFail ? 'fail' : 'cantTell',
       severity: rule.defaultSeverity || 'minor',
       occurrences
     };
+  }
   return { ruleId: rule.ruleId, outcome: 'pass', severity: 'minor', occurrences: [] };
 }
 

package/src/checks/automatic/language-page-present.js

@@ -144,7 +144,11 @@ function runInPage(ctx) {
   }
 
   // Minimal BCP47 primary subtag check
-  if (!/^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/.test(lang)) {
+  const isValidTag =
+    helpers && typeof helpers.isValidLanguageTag === 'function'
+      ? helpers.isValidLanguageTag
+      : (v) => /^[a-zA-Z]{2,3}(-[a-zA-Z0-9]{2,8})*$/.test(String(v || ''));
+  if (!isValidTag(lang)) {
     return {
       ruleId: rule.ruleId,
       outcome: 'fail',

package/src/checks/automatic/link-name-present.js

@@ -59,7 +59,14 @@ function runInPage(ctx) {
 
   for (const el of nodes) {
     // isAccTreeEligible returns { eligible, reasons }, not a boolean.
-    const eligResult = helpers.isAccTreeEligible ? helpers.isAccTreeEligible(el, ctx) : true;
+    // Naming rules apply only to elements included in the accessibility tree
+    // (ACT c487ae), which excludes focusable aria-hidden content;
+    // aria-hidden-focus (ACT 6cfa84) covers that markup instead.
+    const eligResult = helpers.isIncludedInAccessibilityTree
+      ? helpers.isIncludedInAccessibilityTree(el, ctx)
+      : helpers.isAccTreeEligible
+        ? helpers.isAccTreeEligible(el, ctx)
+        : true;
     const eligible =
       typeof eligResult === 'boolean' ? eligResult : !!(eligResult && eligResult.eligible);
     if (!eligible) continue;
@@ -69,33 +76,59 @@ function runInPage(ctx) {
     const nameInfo = helpers.getAccessibleNameInfo ? helpers.getAccessibleNameInfo(el, ctx) : null;
     const programmaticName = nameInfo && typeof nameInfo.value === 'string' ? nameInfo.value : '';
 
-    // A native <a href>/<area href> (or [role="link"]) whose role has been
-    // overridden to one of these roles is no longer semantically a link —
-    // per the WAI-ARIA Accessible Name and Description Computation spec
-    // these roles are name-from-author-only, and their rendered content
-    // represents a VALUE, not a NAME (see button-name-present.js's identical
-    // fix for a real-world example — <button role="combobox">List</button> —
-    // of the same class of bug on a different host tag).
     const role = el.getAttribute ? el.getAttribute('role') : null;
     const roleNorm = String(role || '')
       .replace(/\s+/g, ' ')
       .trim()
       .toLowerCase();
-    const VALUE_ROLES = [
-      'textbox',
-      'progressbar',
-      'scrollbar',
-      'slider',
-      'spinbutton',
-      'combobox',
-      'listbox'
+    // ARIA 1.2 "Name From: author, contents". Every other known role is
+    // name-from-author-only. An unknown role falls back to the implicit role.
+    // <generated:aria-name-from-content>
+    const NAME_FROM_CONTENT_ROLES = [
+      'button',
+      'cell',
+      'checkbox',
+      'columnheader',
+      'doc-backlink',
+      'doc-biblioref',
+      'doc-glossref',
+      'doc-noteref',
+      'graphics-object',
+      'gridcell',
+      'heading',
+      'link',
+      'menuitem',
+      'menuitemcheckbox',
+      'menuitemradio',
+      'option',
+      'radio',
+      'row',
+      'rowgroup',
+      'rowheader',
+      'switch',
+      'tab',
+      'tooltip',
+      'treeitem'
     ];
-    const isContentNameCandidate = !VALUE_ROLES.includes(roleNorm);
+    // </generated:aria-name-from-content>
+    const isKnownRoleToken =
+      helpers && helpers.aria && typeof helpers.aria.isKnownRole === 'function'
+        ? (() => {
+            try {
+              return !!helpers.aria.isKnownRole(roleNorm);
+            } catch {
+              return false;
+            }
+          })()
+        : false;
+    const isContentNameCandidate =
+      !roleNorm || !isKnownRoleToken || NAME_FROM_CONTENT_ROLES.includes(roleNorm);
 
     const contentName =
       programmaticName.trim().length === 0 && isContentNameCandidate
         ? getConservativeSubtreeText(el)
         : '';
+
     const finalName = (programmaticName.trim().length ? programmaticName : contentName).trim();
 
     if (finalName.length === 0) {

package/src/checks/automatic/listbox-name-present.js

@@ -109,9 +109,16 @@ function runInPage(ctx) {
     return '';
   }
 
+  // Naming rules apply only to elements included in the accessibility tree
+  // (ACT c487ae and siblings), which excludes focusable aria-hidden content.
+  // aria-hidden-focus (ACT 6cfa84) covers that markup instead.
   function isEligibleAcc(helpers, el, ctx) {
     const fn =
-      helpers && typeof helpers.isAccTreeEligible === 'function' ? helpers.isAccTreeEligible : null;
+      helpers && typeof helpers.isIncludedInAccessibilityTree === 'function'
+        ? helpers.isIncludedInAccessibilityTree
+        : helpers && typeof helpers.isAccTreeEligible === 'function'
+          ? helpers.isAccTreeEligible
+          : null;
     if (!fn) return true;
     try {
       const r = fn(el, ctx);

package/src/checks/automatic/menuitem-name-present.js

@@ -84,9 +84,16 @@ function runInPage(ctx) {
     return '';
   }
 
+  // Naming rules apply only to elements included in the accessibility tree
+  // (ACT c487ae and siblings), which excludes focusable aria-hidden content.
+  // aria-hidden-focus (ACT 6cfa84) covers that markup instead.
   function isEligibleAcc(helpers, el, ctx) {
     const fn =
-      helpers && typeof helpers.isAccTreeEligible === 'function' ? helpers.isAccTreeEligible : null;
+      helpers && typeof helpers.isIncludedInAccessibilityTree === 'function'
+        ? helpers.isIncludedInAccessibilityTree
+        : helpers && typeof helpers.isAccTreeEligible === 'function'
+          ? helpers.isAccTreeEligible
+          : null;
     if (!fn) return true;
     try {
       const r = fn(el, ctx);

package/src/checks/automatic/meta-refresh-no-exceptions.js

@@ -87,6 +87,34 @@ function runInPage(ctx) {
     : [];
 
   const occurrences = [];
+  // HTML's shared declarative refresh steps. Returns the delay in seconds, or
+  // null when the value is not a valid refresh directive, in which case the
+  // browser never refreshes and there is nothing to report. Rejects a leading
+  // sign ("+72001"), a non-numeric time ("foo"), and a separator other than
+  // "," or ";" ("0:1").
+  function parseRefreshDelay(input) {
+    const s = String(input == null ? '' : input);
+    const isSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\f' || c === '\r';
+    let i = 0;
+    while (i < s.length && isSpace(s[i])) i++;
+    let digits = '';
+    while (i < s.length && s[i] >= '0' && s[i] <= '9') digits += s[i++];
+    if (!digits) return null;
+    if (s[i] === '.') {
+      i++;
+      while (i < s.length && s[i] >= '0' && s[i] <= '9') i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    let sawSpace = false;
+    while (i < s.length && isSpace(s[i])) {
+      sawSpace = true;
+      i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    if (s[i] === ';' || s[i] === ',' || sawSpace) return parseInt(digits, 10);
+    return null;
+  }
+
   let applicableCount = 0;
 
   for (const el of nodes) {
@@ -94,6 +122,7 @@ function runInPage(ctx) {
     if (el.closest && el.closest('noscript')) continue; // never applies with scripting enabled
     const raw = String(el.getAttribute('content') || '').trim();
     if (!raw) continue;
+    if (parseRefreshDelay(raw) === null) continue;
 
     applicableCount += 1;
 

package/src/checks/automatic/meta-refresh-timing-absent.js

@@ -79,16 +79,42 @@ function runInPage(ctx) {
   const occurrences = [];
   let applicableCount = 0;
 
+  // HTML's shared declarative refresh steps. Returns the delay in seconds, or
+  // null when the value is not a valid refresh directive, in which case the
+  // browser never refreshes and there is nothing to report. Rejects a leading
+  // sign ("+72001"), a non-numeric time ("foo"), and a separator other than
+  // "," or ";" ("0:1").
+  function parseRefreshDelay(input) {
+    const s = String(input == null ? '' : input);
+    const isSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\f' || c === '\r';
+    let i = 0;
+    while (i < s.length && isSpace(s[i])) i++;
+    let digits = '';
+    while (i < s.length && s[i] >= '0' && s[i] <= '9') digits += s[i++];
+    if (!digits) return null;
+    if (s[i] === '.') {
+      i++;
+      while (i < s.length && s[i] >= '0' && s[i] <= '9') i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    let sawSpace = false;
+    while (i < s.length && isSpace(s[i])) {
+      sawSpace = true;
+      i++;
+    }
+    if (i >= s.length) return parseInt(digits, 10);
+    if (s[i] === ';' || s[i] === ',' || sawSpace) return parseInt(digits, 10);
+    return null;
+  }
+
   for (const el of nodes) {
     if (!el || !el.getAttribute) continue;
     if (el.closest && el.closest('noscript')) continue; // never applies with scripting enabled — see meta-refresh-no-exceptions.js's header comment
     const raw = String(el.getAttribute('content') || '').trim();
     if (!raw) continue;
 
-    const match = raw.match(/^([0-9]*\.?[0-9]+)/);
-    if (!match) continue;
-    const delay = parseFloat(match[1]);
-    if (Number.isNaN(delay)) continue;
+    const delay = parseRefreshDelay(raw);
+    if (delay === null) continue;
 
     applicableCount += 1;
 

package/src/checks/automatic/meta-viewport-zoom-enabled.js

@@ -9,17 +9,19 @@
  * @standard WCAG 2.2
  * @sc 1.4.4
  * @applicability
- *   Applies to <meta name="viewport"> elements that carry a non-empty
- *   content attribute.
+ *   Applies to <meta name="viewport"> elements whose content attribute sets
+ *   maximum-scale or user-scalable. Content setting neither cannot restrict
+ *   zoom.
  * @expectation
- *   The content attribute does not set user-scalable to "no"/"0", and does
- *   not set maximum-scale below 2 (200%). Either disables the user's
- *   ability to zoom text to at least 200%, which WCAG 1.4.4 (Resize Text)
- *   requires be possible.
+ *   user-scalable is absent, yes, device-width, device-height, or a number
+ *   outside the range -1 to 1; and maximum-scale is absent, device-width,
+ *   device-height, negative, or 2 or more. Anything else stops the user
+ *   zooming text to 200%, which WCAG 1.4.4 (Resize Text) requires.
  * @implementation-notes
- * - Malformed/unparseable maximum-scale values are ignored (not flagged) —
- *   this rule only reports a clearly-detected zoom restriction, matching
- *   this engine's no-false-positives policy.
+ * - An unparseable value counts as a restriction, because CSS Device
+ *   Adaptation translates it to 0: maximum-scale=yes disables zoom exactly
+ *   as maximum-scale=0 does. A negative maximum-scale is out of range and
+ *   dropped by the browser, so it restricts nothing and passes.
  */
 
 const id = 'meta-viewport-zoom-enabled';
@@ -89,20 +91,40 @@ function runInPage(ctx) {
     const raw = String(el.getAttribute('content') || '').trim();
     if (!raw) continue;
 
-    applicableCount += 1;
-
     const parsed = parseContent(raw);
+
+    // ACT b4f0c3 applies only when content carries maximum-scale or
+    // user-scalable; content that sets neither cannot restrict zoom.
+    if (parsed['user-scalable'] === undefined && parsed['maximum-scale'] === undefined) continue;
+
+    applicableCount += 1;
     const reasons = [];
 
+    // CSS Device Adaptation translates an unparseable value to 0, so
+    // user-scalable=invalid and maximum-scale=yes disable zoom just as
+    // user-scalable=no does. A negative maximum-scale is out of range and
+    // dropped instead, which is why it does not restrict anything.
     const userScalable = parsed['user-scalable'];
-    if (userScalable === 'no' || userScalable === '0') {
-      reasons.push('user-scalable=' + userScalable);
+    if (
+      userScalable !== undefined &&
+      userScalable !== 'yes' &&
+      userScalable !== 'device-width' &&
+      userScalable !== 'device-height'
+    ) {
+      const scale = parseFloat(userScalable);
+      if (Number.isNaN(scale) || (scale > -1 && scale < 1)) {
+        reasons.push('user-scalable=' + userScalable);
+      }
     }
 
     const maxScaleRaw = parsed['maximum-scale'];
-    if (maxScaleRaw !== undefined) {
+    if (
+      maxScaleRaw !== undefined &&
+      maxScaleRaw !== 'device-width' &&
+      maxScaleRaw !== 'device-height'
+    ) {
       const maxScale = parseFloat(maxScaleRaw);
-      if (!Number.isNaN(maxScale) && maxScale < 2) {
+      if (Number.isNaN(maxScale) || (maxScale >= 0 && maxScale < 2)) {
         reasons.push('maximum-scale=' + maxScaleRaw);
       }
     }

package/src/checks/automatic/meter-name-present.js

@@ -67,9 +67,16 @@ function runInPage(ctx) {
     return '';
   }
 
+  // Naming rules apply only to elements included in the accessibility tree
+  // (ACT c487ae and siblings), which excludes focusable aria-hidden content.
+  // aria-hidden-focus (ACT 6cfa84) covers that markup instead.
   function isEligibleAcc(helpers, el, ctx) {
     const fn =
-      helpers && typeof helpers.isAccTreeEligible === 'function' ? helpers.isAccTreeEligible : null;
+      helpers && typeof helpers.isIncludedInAccessibilityTree === 'function'
+        ? helpers.isIncludedInAccessibilityTree
+        : helpers && typeof helpers.isAccTreeEligible === 'function'
+          ? helpers.isAccTreeEligible
+          : null;
     if (!fn) return true;
     try {
       const r = fn(el, ctx);