@surea11y/core 1.6.0 → 1.7.0

package/src/checks/manual/form-control-label-quality-manual.js

@@ -206,29 +206,63 @@ function runInPage(ctx) {
     return out;
   }
 
+  // Index of `<label for="...">` elements by their `for` value, built once
+  // (not the native `el.labels`, deliberately -- see getNativeLabels).
+  const labelsByForId = new Map();
+  try {
+    for (const label of document.querySelectorAll('label[for]')) {
+      const forVal = normalizeWs(label.getAttribute('for'));
+      if (!forVal) continue;
+      const bucket = labelsByForId.get(forVal);
+      if (bucket) bucket.push(label);
+      else labelsByForId.set(forVal, [label]);
+    }
+  } catch {
+    // labelsByForId stays empty; getNativeLabels still has the wrapping-label check
+  }
+
+  // Per HTML's label-control algorithm, a wrapping <label> with no `for`
+  // attribute is associated with its own FIRST labelable descendant only --
+  // these are exactly the tags that count (input excluding type=hidden,
+  // which FIELD_SELECTOR already excludes from `el` itself, but a wrapping
+  // label could still wrap a hidden input ahead of the real field).
+  const LABELABLE_SELECTOR =
+    'input:not([type="hidden"]), select, textarea, button, meter, output, progress';
+
+  // The native `el.labels` accessor is spec-correct but, in this engine's
+  // supported Node/jsdom runtime (see tests/node-runtime-parity.test.js),
+  // jsdom implements it as a live query that walks the WHOLE document on
+  // every access, and for every `<label for>` it passes, calls `.control`
+  // -- itself another whole-document walk to resolve that id (jsdom's
+  // form-controls.js getLabelsForLabelable / HTMLLabelElement-impl.js
+  // `get control`). Called once per field, that's the O(fields * document
+  // size) cost that used to dominate this rule under jsdom (a real browser
+  // maintains an internal id index, so this cost is jsdom-specific, but
+  // jsdom is a real, tested runtime for this engine, not just a benchmark
+  // artifact). A `for`-attribute index built once above, plus a bounded
+  // `closest('label')` walk, answers the same question in O(1) amortized
+  // per field instead.
   function getNativeLabels(el) {
     const labels = [];
-    try {
-      if (el.labels && el.labels.length) {
-        for (const label of el.labels) labels.push(label);
-        return labels;
-      }
-    } catch {
-      // fall through to the manual lookup
-    }
     const idVal = normalizeWs(el.getAttribute && el.getAttribute('id'));
     if (idVal) {
-      try {
-        for (const label of document.querySelectorAll('label[for]')) {
-          if (normalizeWs(label.getAttribute('for')) === idVal) labels.push(label);
-        }
-      } catch {
-        // ignore
+      const forLabels = labelsByForId.get(idVal);
+      if (forLabels) {
+        for (const label of forLabels) labels.push(label);
       }
     }
     try {
       const wrapping = el.closest ? el.closest('label') : null;
-      if (wrapping && labels.indexOf(wrapping) === -1) labels.push(wrapping);
+      const hasForAttr = !!(wrapping && wrapping.hasAttribute && wrapping.hasAttribute('for'));
+      if (wrapping && !hasForAttr && labels.indexOf(wrapping) === -1) {
+        let firstControl = null;
+        try {
+          firstControl = wrapping.querySelector ? wrapping.querySelector(LABELABLE_SELECTOR) : null;
+        } catch {
+          firstControl = null;
+        }
+        if (firstControl === el) labels.push(wrapping);
+      }
     } catch {
       // ignore
     }
@@ -269,15 +303,17 @@ function runInPage(ctx) {
     }
   }
 
+  // Nearest preceding *visible* heading text, per field. Precomputed below
+  // (once `fields` is built) via a single document-order sweep rather than
+  // scanning the full `headings` array backward for every field: `headings`
+  // and `fields` are each already in document order (both come from
+  // querySelectorAll/queryAllSmart), so a two-pointer merge answers every
+  // field in one O(fields + headings) pass instead of the O(fields *
+  // headings) pairwise compareDocumentPosition/isVisible calls a per-field
+  // backward scan requires -- the dominant cost on heading/form-heavy pages.
+  const nearestVisibleHeadingByField = new Map();
   function nearestVisibleHeadingText(el) {
-    for (let i = headings.length - 1; i >= 0; i--) {
-      const heading = headings[i];
-      if (!precedes(heading, el)) continue;
-      if (!isVisible(heading)) continue;
-      const text = normalizeWs(heading.textContent);
-      if (text) return text;
-    }
-    return '';
+    return nearestVisibleHeadingByField.get(el) || '';
   }
 
   function fieldsetLegendText(el) {
@@ -309,6 +345,9 @@ function runInPage(ctx) {
 
   // A table row or list item carries its own context (the product name a
   // repeated "Quantity" field belongs to), so it takes part in the key.
+  // `row.textContent` serializes the whole row subtree, so it's memoized per
+  // row element -- several fields (one per column) commonly share a row.
+  const rowTextCache = new Map();
   function rowContextText(el, labelText) {
     let row;
     try {
@@ -317,7 +356,11 @@ function runInPage(ctx) {
       row = null;
     }
     if (!row || !isVisible(row)) return '';
-    const text = normalizeWs(row.textContent);
+    let text = rowTextCache.get(row);
+    if (text === undefined) {
+      text = normalizeWs(row.textContent);
+      rowTextCache.set(row, text);
+    }
     if (!text) return '';
     return normalizeWs(text.split(labelText).join(' '));
   }
@@ -348,6 +391,73 @@ function runInPage(ctx) {
     });
   }
 
+  // Populate nearestVisibleHeadingByField (declared above nearestVisibleHeadingText)
+  // via a single two-pointer sweep instead of, per field, scanning the full
+  // `headings` array backward and calling compareDocumentPosition/isVisible
+  // against every one of them -- the O(fields * headings) cost that used to
+  // dominate this rule (and the whole engine) on heading/form-heavy pages.
+  //
+  // Two correctness precautions this needs, since a two-pointer merge only
+  // works over sequences that are BOTH already in real document order:
+  //
+  // 1. A field inside a shadow root has no document-order relationship to
+  //    any heading at all: per the DOM spec, compareDocumentPosition
+  //    between nodes in different trees returns an implementation-specific
+  //    (not document-order-derived) PRECEDING/FOLLOWING bit. Merging it in
+  //    would be meaningless and could even desync the sweep for later
+  //    fields, so it's filtered out up front and always answered '' --
+  //    matching the "no light-DOM heading can be this field's visible
+  //    context" reading rather than trusting that arbitrary bit.
+  // 2. `fields` (from queryAllSmart) is NOT guaranteed to be globally
+  //    document-order: it's built root by root (see resolveContextRoots),
+  //    and a multi-region `engineOptions.contextSelector` array is resolved
+  //    in the CALLER's array order, not sorted by document position. A
+  //    fresh copy is sorted by real position before the sweep so the merge
+  //    is correct regardless of contextSelector's region order (this is a
+  //    cheap O(k log k) sort, not the O(n*m) cost being fixed).
+  {
+    const orderedFields = [];
+    for (const field of fields) {
+      let sameRoot;
+      try {
+        sameRoot =
+          typeof field.el.getRootNode !== 'function' || field.el.getRootNode() === document;
+      } catch {
+        sameRoot = true;
+      }
+
+      if (!sameRoot) {
+        nearestVisibleHeadingByField.set(field.el, '');
+        continue;
+      }
+      orderedFields.push(field);
+    }
+
+    orderedFields.sort((a, b) => {
+      try {
+        const bits = a.el.compareDocumentPosition(b.el);
+        if (bits & 4) return -1; // b follows a
+        if (bits & 2) return 1; // b precedes a
+      } catch {
+        /* ignore -- treat as equal/unordered */
+      }
+      return 0;
+    });
+
+    let hIdx = 0;
+    let current = '';
+    for (const field of orderedFields) {
+      while (hIdx < headings.length && precedes(headings[hIdx], field.el)) {
+        const heading = headings[hIdx];
+        hIdx += 1;
+        if (!isVisible(heading)) continue;
+        const text = normalizeWs(heading.textContent);
+        if (text) current = text;
+      }
+      nearestVisibleHeadingByField.set(field.el, current);
+    }
+  }
+
   if (!fields.length) {
     return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
   }

package/src/checks/manual/landmark-complementary-is-top-level-manual.js

@@ -0,0 +1,231 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
+'use strict';
+
+/**
+ * @check landmark-complementary-is-top-level
+ * @atomic true
+ * @summary The complementary landmark must not be nested inside another landmark
+ * @standard Best Practices (no formal WCAG Success Criterion)
+ * @applicability
+ *   Applies whenever the page contains at least one element carrying the
+ *   complementary role: explicit role="complementary", or an <aside> that
+ *   keeps its implicit role (see implementation notes on when it does not).
+ * @expectation
+ *   No complementary candidate has an ancestor that is itself a landmark
+ *   region. Complementary content supports the main content of the page and
+ *   sits beside it; nested inside another landmark it is a section of that
+ *   landmark instead, which is not what landmark navigation announces.
+ * @implementation-notes
+ * - Not WCAG-normative, authored as an advisory, cantTell-capped
+ *   `type: 'manual'` rule, matching its three siblings
+ *   (`landmark-banner-is-top-level`, `landmark-contentinfo-is-top-level`,
+ *   `landmark-main-is-top-level`). Landmark detection and the
+ *   ancestor walk are identical to theirs; only the role being looked for
+ *   differs.
+ * - An unnamed <aside> inside sectioning content has no complementary role
+ *   per HTML-AAM, so it is not a candidate at all: reporting it would name a
+ *   landmark that does not exist. A *named* one keeps the role wherever it
+ *   sits, which is exactly the case worth review -- an <aside aria-label>
+ *   inside <main> really is a complementary landmark nested in another
+ *   landmark. `landmark-unique` and the sibling top-level rules already
+ *   resolve <aside> this way, through the same shared helper.
+ */
+
+const id = 'landmark-complementary-is-top-level';
+
+const meta = {
+  title: 'Complementary landmark must be top-level',
+  description:
+    'Checks that the complementary landmark (role="complementary" or an <aside> that keeps its implicit role) is not nested inside another landmark region.',
+  i18n: {
+    titleKey: 'landmarkComplementaryIsTopLevel_title',
+    descriptionKey: 'landmarkComplementaryIsTopLevel_description'
+  },
+  helpUrl: null,
+  tags: ['best-practice', 'landmarks', 'structure', 'atomic', 'manual'],
+  wcagSc: [],
+  normativeMappings: [],
+  defaultSeverity: 'minor',
+  category: 'operable',
+  type: 'manual',
+  defaultConfidence: 'medium',
+  coverage: {}
+};
+
+function runInPage(ctx) {
+  const { document, root, helpers, rule } = ctx;
+
+  // Declared inside runInPage; see scripts/build-core.js header
+  // ("runInPage MUST be self-contained").
+  function normalizeWs(s) {
+    return String(s || '')
+      .replace(/\s+/g, ' ')
+      .trim();
+  }
+
+  // Delegates to the shared helpers.getLandmarkNameInfo (aria-label -> aria-labelledby, via the
+  // target's own accessible name, not raw textContent -> title attribute fallback) rather than a
+  // local copy -- see that function's header comment in src/core/dom-helpers.js. Sharing it keeps
+  // the title-attribute fallback consistent across the landmark rules.
+  function getAccessibleLandmarkName(el) {
+    try {
+      if (helpers && typeof helpers.getLandmarkNameInfo === 'function') {
+        const info = helpers.getLandmarkNameInfo(el, ctx);
+        if (info && info.present && info.value) return normalizeWs(info.value);
+      }
+    } catch {}
+    return '';
+  }
+
+  function getExplicitRoleToken(el) {
+    const raw = normalizeWs(el.getAttribute && el.getAttribute('role'));
+    if (!raw) return '';
+    return raw.split(/\s+/)[0].toLowerCase();
+  }
+
+  // Delegates to the shared helpers.hasLandmarkScopingAncestor for the
+  // question "does this element sit inside a sectioning-content/<main>
+  // ancestor that suppresses its conditional implicit role": role-aware
+  // (an ancestor's bare TAG only counts when it carries no role attribute
+  // at all; an explicit role="dialog"-style override no longer suppresses)
+  // rather than a local tag-only copy. See that function's header comment
+  // in src/core/aria-helpers.js for the full algorithm.
+  function hasSectioningAncestor(el, includeMain) {
+    return helpers && typeof helpers.hasLandmarkScopingAncestor === 'function'
+      ? helpers.hasLandmarkScopingAncestor(el, { includeMain })
+      : false;
+  }
+
+  function getImplicitLandmarkRole(el) {
+    const tag = el.tagName ? el.tagName.toLowerCase() : '';
+    if (tag === 'header') return hasSectioningAncestor(el, true) ? '' : 'banner';
+    if (tag === 'footer') return hasSectioningAncestor(el, true) ? '' : 'contentinfo';
+    if (tag === 'main') return 'main';
+    if (tag === 'nav') return 'navigation';
+    if (tag === 'aside') {
+      // A named <aside> is never suppressed, even when nested. It keeps
+      // "complementary" when it has an accessible name, even inside
+      // sectioning content. Matches landmark-unique's precedent.
+      if (!hasSectioningAncestor(el, false)) return 'complementary';
+      return getAccessibleLandmarkName(el) ? 'complementary' : '';
+    }
+    if (tag === 'section') return getAccessibleLandmarkName(el) ? 'region' : '';
+    if (tag === 'form') return getAccessibleLandmarkName(el) ? 'form' : '';
+    return '';
+  }
+
+  const LANDMARK_ROLES = new Set([
+    'banner',
+    'contentinfo',
+    'main',
+    'navigation',
+    'complementary',
+    'region',
+    'form',
+    'search'
+  ]);
+
+  function getLandmarkRole(el) {
+    if (!el || !el.getAttribute) return '';
+    const explicit = getExplicitRoleToken(el);
+    if (explicit) return LANDMARK_ROLES.has(explicit) ? explicit : '';
+    return getImplicitLandmarkRole(el);
+  }
+
+  // A candidate must actually carry the complementary role. An <aside> that
+  // HTML-AAM strips the role from is not a complementary landmark at all, so
+  // flagging it would report a landmark that does not exist.
+  function isComplementaryCandidate(el) {
+    return getLandmarkRole(el) === 'complementary';
+  }
+
+  function hasLandmarkAncestor(el) {
+    const scopeRoots = Array.isArray(root) ? root : root ? [root] : [];
+    let p = el.parentElement;
+    while (p) {
+      if (getLandmarkRole(p)) return true;
+      // Don't climb past the scanned scope -- see aria-helpers.js's
+      // hasLandmarkScopingAncestor for the same fix and rationale.
+      if (scopeRoots.includes(p)) break;
+      p = p.parentElement;
+    }
+    return false;
+  }
+
+  // queryAllSmart (shadow-DOM-aware) instead of plain document.querySelectorAll -- see
+  // landmark-unique-manual.js's header comment. A third-party shadow-DOM-hosted
+  // widget's own landmark is invisible to a light-DOM-only query.
+  let nodes;
+  try {
+    nodes =
+      helpers && typeof helpers.queryAllSmart === 'function'
+        ? helpers.queryAllSmart('header, footer, main, nav, aside, section, form, [role]')
+        : document.querySelectorAll('header, footer, main, nav, aside, section, form, [role]');
+  } catch {
+    nodes = [];
+  }
+
+  const complementaries = [];
+  const seen = new Set();
+  for (const el of nodes) {
+    if (!el || seen.has(el)) continue;
+    seen.add(el);
+    if (!isComplementaryCandidate(el)) continue;
+
+    // An aria-hidden candidate is removed from the accessibility tree
+    // entirely, so it is not part of the landmark structure assistive
+    // technology users navigate and there is no real landmark to call
+    // nested. queryAllSmart's default hidden-content policy only excludes
+    // "hard" CSS-based hiding (display:none, etc.), not the softer
+    // aria-hidden exclusion, so this needs its own check.
+    if (helpers && typeof helpers.isAccTreeEligible === 'function') {
+      const elig = (() => {
+        try {
+          return helpers.isAccTreeEligible(el, ctx);
+        } catch {
+          return { eligible: true, reasons: [] };
+        }
+      })();
+      if (elig && elig.eligible === false) continue;
+    }
+
+    complementaries.push(el);
+  }
+
+  if (complementaries.length === 0) {
+    return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
+  }
+
+  const occurrences = [];
+  for (const el of complementaries) {
+    if (!hasLandmarkAncestor(el)) continue;
+
+    occurrences.push(
+      helpers.reportOccurrence(el, {
+        summary: 'This complementary landmark is nested inside another landmark region.',
+        hint: 'Move the complementary landmark (<aside>/role="complementary") so it is not contained by another landmark; complementary content belongs beside the main content, not inside another region.',
+        i18n: {
+          summaryKey: 'landmarkComplementaryIsTopLevel_summary_cantTell',
+          hintKey: 'landmarkComplementaryIsTopLevel_hint_cantTell',
+          params: {}
+        },
+        data: {
+          details: { reasonCode: 'LANDMARK_COMPLEMENTARY_NOT_TOP_LEVEL' }
+        }
+      })
+    );
+  }
+
+  if (occurrences.length) {
+    return {
+      ruleId: rule.ruleId,
+      outcome: 'cantTell',
+      severity: rule.defaultSeverity || 'minor',
+      occurrences
+    };
+  }
+  return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
+}
+
+module.exports = { id, meta, runInPage };

package/src/checks/manual/password-paste-enabled-manual.js

@@ -0,0 +1,255 @@
+/* SPDX-License-Identifier: MPL-2.0 */
+
+'use strict';
+
+/**
+ * @check password-paste-enabled
+ * @atomic true
+ * @summary An authentication field must not block pasting into it
+ * @standard WCAG 2.2
+ * @sc 3.3.8
+ * @applicability
+ *   Applies to any control whose autocomplete token is current-password,
+ *   new-password or one-time-code, and to <input type="password"> unless its
+ *   autocomplete names another purpose. A disabled or readonly field takes no
+ *   input to block, and one outside the accessibility tree is not being asked
+ *   for, so neither is in scope.
+ * @expectation
+ *   A reviewer confirms the field can still be pasted into. Remembering a
+ *   password is a cognitive function test, and 3.3.8 asks for a mechanism
+ *   that helps the user through one; a password manager, or the clipboard
+ *   for a one-time code, is that mechanism.
+ * @implementation-notes
+ * - Advisory and capped at cantTell. Whether a handler really stops the user
+ *   depends on script the markup does not carry, so no reading of it is safe
+ *   enough to fail on: a split one-time-code field cancels the default paste
+ *   and then spreads the digits across its boxes. The two cases are reported
+ *   apart -- a handler that only cancels, and one that goes on to do more --
+ *   so a reviewer knows which to look at first. `return true` allows the
+ *   paste and reports nothing.
+ * - type="password" masks rather than authenticates, and a card security code
+ *   is masked the same way, so an autocomplete naming another purpose puts the
+ *   field out of scope. A masked field with no autocomplete cannot be told
+ *   apart, which is the one case left.
+ * - `autocomplete="off"` is not reported. Browsers override it for password
+ *   fields so password managers keep working, and the mechanism survives.
+ * - A handler attached with addEventListener leaves nothing to read, the
+ *   limit every static scan shares.
+ * - 3.3.8 also excuses the test where the process offers another
+ *   authentication method. A sibling button proves nothing about whether it
+ *   works or replaces this step, so it is not inferred; the facet is recorded
+ *   as partial for that reason.
+ */
+
+const id = 'password-paste-enabled';
+
+const meta = {
+  title: 'Authentication fields must not block pasting',
+  description:
+    'Checks that a password or one-time-code field carries no inline paste handler that cancels the paste, which would remove the password manager or clipboard that WCAG 3.3.8 relies on as the assisting mechanism.',
+  i18n: {
+    titleKey: 'passwordPasteEnabled_title',
+    descriptionKey: 'passwordPasteEnabled_description'
+  },
+  helpUrl: null,
+  tags: ['wcag22aa', 'wcag338', 'forms', 'authentication', 'atomic', 'manual', 'acc'],
+  wcagSc: ['3.3.8'],
+  normativeMappings: [
+    {
+      standard: 'WCAG',
+      version: '2.2',
+      requirement: '3.3.8',
+      title: 'Accessible Authentication (Minimum)',
+      conformanceLevel: 'AA'
+    }
+  ],
+  defaultSeverity: 'serious',
+  category: 'understandable',
+  type: 'manual',
+  defaultConfidence: 'medium',
+  coverage: { facetsBySc: { '3.3.8': ['authentication-paste-not-blocked'] } }
+};
+
+function runInPage(ctx) {
+  const { helpers, rule } = ctx;
+
+  // Declared inside runInPage; see scripts/build-core.js header
+  // ("runInPage MUST be self-contained").
+  const AUTH_AUTOCOMPLETE_TOKENS = ['current-password', 'new-password', 'one-time-code'];
+
+  function normalizeWs(s) {
+    return String(s || '')
+      .replace(/\s+/g, ' ')
+      .trim();
+  }
+
+  function autocompleteTokens(el) {
+    return normalizeWs(el.getAttribute && el.getAttribute('autocomplete'))
+      .toLowerCase()
+      .split(' ')
+      .filter(Boolean);
+  }
+
+  // A field an authentication step reads: a password input, or any control
+  // whose autocomplete token names an authentication secret. The autocomplete
+  // route matters for one-time codes, which are ordinary text inputs.
+  //
+  // type="password" is a masking control, not only an authentication one: a
+  // card security code is routinely masked the same way. An explicit
+  // autocomplete purpose that is not an authentication one says so, and takes
+  // the field back out of scope.
+  function isAuthField(el) {
+    const tag = el.tagName ? el.tagName.toLowerCase() : '';
+    if (tag !== 'input' && tag !== 'textarea') return false;
+
+    const tokens = autocompleteTokens(el);
+    if (AUTH_AUTOCOMPLETE_TOKENS.some((t) => tokens.includes(t))) return true;
+
+    const type = normalizeWs(el.getAttribute && el.getAttribute('type')).toLowerCase();
+    if (tag !== 'input' || type !== 'password') return false;
+
+    const declaresOtherPurpose = tokens.some(
+      (t) => t !== 'on' && t !== 'off' && !AUTH_AUTOCOMPLETE_TOKENS.includes(t)
+    );
+    return !declaresOtherPurpose;
+  }
+
+  // A field that takes no input at all cannot be pasted into either, so a
+  // paste handler on it blocks nothing.
+  function acceptsInput(el) {
+    if (el.hasAttribute && (el.hasAttribute('disabled') || el.hasAttribute('readonly'))) {
+      return false;
+    }
+    return true;
+  }
+
+  // Classifies an inline handler as 'cancelOnly', 'opaque' or 'none'.
+  //
+  // Cancelling is not the same as blocking. Replacing the default paste is
+  // how a split one-time-code field distributes the digits across its boxes,
+  // and how a password field strips stray whitespace from what was pasted --
+  // both call preventDefault and then insert the text themselves, which
+  // helps the user rather than stopping them. So a handler counts as
+  // blocking only when cancelling is the whole of what it does. Anything
+  // further -- a call, an assignment, a condition -- may well be putting the
+  // text back, and the markup does not say, so it reports cantTell.
+  function classifyHandler(source) {
+    const src = String(source || '').trim();
+    if (!src) return 'none';
+
+    const CANCEL = [
+      /\breturn\s+false\b/gi,
+      /\breturn\s*!1\b/gi,
+      /\bpreventDefault\s*\(\s*\)/gi,
+      /\breturnValue\s*=\s*(?:false|!1)\b/gi
+    ];
+    // Says "yes, paste" outright, so it blocks nothing.
+    const ALLOW = [/\breturn\s+true\b/gi, /\breturn\s*!0\b/gi];
+    // Neither cancels nor re-inserts.
+    const NEUTRAL = [/\bstop(?:Immediate)?Propagation\s*\(\s*\)/gi, /\breturn\b/gi];
+    // What is left of an object reference once its method call is removed.
+    const REFS = /\b(?:window|document|this|event|evt|ev|e|arguments\[0\])\b/gi;
+    const ONLY_PUNCTUATION = /^[\s;.,()[\]{}]*$/;
+
+    let rest = src;
+    let sawCancel = false;
+    for (const re of CANCEL) {
+      const next = rest.replace(re, ' ');
+      if (next !== rest) sawCancel = true;
+      rest = next;
+    }
+
+    if (!sawCancel) {
+      for (const re of ALLOW) rest = rest.replace(re, ' ');
+      for (const re of NEUTRAL) rest = rest.replace(re, ' ');
+      rest = rest.replace(REFS, ' ');
+      return ONLY_PUNCTUATION.test(rest) ? 'none' : 'opaque';
+    }
+
+    for (const re of NEUTRAL) rest = rest.replace(re, ' ');
+    rest = rest.replace(REFS, ' ');
+    // Anything left beyond punctuation is the handler doing more than cancel.
+    return ONLY_PUNCTUATION.test(rest) ? 'cancelOnly' : 'opaque';
+  }
+
+  const nodes = helpers.queryAllSmart
+    ? helpers.queryAllSmart('input, textarea')
+    : helpers.queryAll('input, textarea');
+
+  const cancelling = [];
+  const undetermined = [];
+
+  for (const el of nodes) {
+    if (!el || !el.getAttribute) continue;
+    if (!isAuthField(el)) continue;
+
+    if (!acceptsInput(el)) continue;
+
+    const eligResult = helpers.isAccTreeEligible ? helpers.isAccTreeEligible(el, ctx) : true;
+    const eligible =
+      typeof eligResult === 'boolean' ? eligResult : !!(eligResult && eligResult.eligible);
+    if (!eligible) continue;
+
+    const handler = el.getAttribute('onpaste');
+    if (handler === null) continue;
+
+    const verdict = classifyHandler(handler);
+    if (verdict === 'none') continue;
+
+    const eligInfo = helpers.getEligibilityInfo
+      ? helpers.getEligibilityInfo(el, ctx, { targetSet: 'acc' })
+      : { targetSet: 'acc', accEligible: null, reasons: [] };
+
+    if (verdict === 'cancelOnly') {
+      cancelling.push(
+        helpers.reportOccurrence(el, {
+          summary:
+            'This authentication field has a paste handler whose only effect is to cancel the paste.',
+          hint: 'Confirm by hand whether pasting still works. If it is blocked, remove the handler so a password manager, or the clipboard for a one-time code, can fill the field.',
+          i18n: {
+            summaryKey: 'passwordPasteEnabled_summary_fail',
+            hintKey: 'passwordPasteEnabled_hint_fail',
+            params: {}
+          },
+          data: {
+            visibilityFilter: eligInfo,
+            details: { reasonCode: 'PASTE_CANCELLED', handler: normalizeWs(handler) }
+          }
+        })
+      );
+      continue;
+    }
+
+    // An inline handler that delegates: whether it cancels lives in code the
+    // markup does not carry.
+    undetermined.push(
+      helpers.reportOccurrence(el, {
+        summary:
+          'This authentication field has a paste handler, and whether it cancels pasting could not be determined.',
+        hint: 'Check by hand that pasting into the field still works, so a password manager or the clipboard can fill it.',
+        i18n: {
+          summaryKey: 'passwordPasteEnabled_summary_cantTell',
+          hintKey: 'passwordPasteEnabled_hint_cantTell',
+          params: {}
+        },
+        data: {
+          visibilityFilter: eligInfo,
+          details: { reasonCode: 'PASTE_HANDLER_OPAQUE', handler: normalizeWs(handler) }
+        }
+      })
+    );
+  }
+
+  const occurrences = cancelling.concat(undetermined);
+  if (!occurrences.length) {
+    return { ruleId: rule.ruleId, outcome: 'notApplicable', severity: 'minor', occurrences: [] };
+  }
+  return {
+    ruleId: rule.ruleId,
+    outcome: 'cantTell',
+    severity: rule.defaultSeverity || 'serious',
+    occurrences
+  };
+}
+
+module.exports = { id, meta, runInPage };