add eslint rule to prevent node.attributes

dequelabs · Mar 21, 2019 · efca43b · efca43b
1 parent a6f0d76
commit efca43b
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 2 deletions.
diff --git a/.eslintrc b/.eslintrc
@@ -70,6 +70,12 @@
       {
         "selector": "MemberExpression[property.name=tagName]",
         "message": "Don't use node.tagName, use node.nodeName instead."
+      },
+      {
+        // node.attributes can be clobbered so is unsafe to use
+        // @see https://github.com/dequelabs/axe-core/pull/1432
+        "selector": "MemberExpression[object.name=node][property.name=attributes]",
+        "message": "Don't use node.attributes, use node.hasAttributes() or axe.utils.getNodeAttributes(node) instead."
       }
     ]
   }

diff --git a/lib/core/utils/get-node-attributes.js b/lib/core/utils/get-node-attributes.js
@@ -8,7 +8,9 @@
  * @returns {NamedNodeMap}
  */
 axe.utils.getNodeAttributes = function getNodeAttributes(node) {
+	// eslint-disable-next-line no-restricted-syntax
 	if (node.attributes instanceof NamedNodeMap) {
+		// eslint-disable-next-line no-restricted-syntax
 		return node.attributes;
 	}
 

diff --git a/lib/core/utils/get-selector.js b/lib/core/utils/get-selector.js
@@ -119,7 +119,7 @@ axe.utils.getSelectorData = function(domTree) {
 			}
 
 			// count all the filtered attributes
-			if (node.attributes) {
+			if (node.hasAttributes()) {
 				Array.from(axe.utils.getNodeAttributes(node))
 					.filter(filterAttributes)
 					.forEach(at => {
@@ -238,7 +238,7 @@ function uncommonAttributes(node, selectorData) {
 	let attData = selectorData.attributes;
 	let tagData = selectorData.tags;
 
-	if (node.attributes) {
+	if (node.hasAttributes()) {
 		Array.from(axe.utils.getNodeAttributes(node))
 			.filter(filterAttributes)
 			.forEach(at => {

diff --git a/test/core/utils/get-node-attributes.js b/test/core/utils/get-node-attributes.js
@@ -15,6 +15,7 @@ describe('axe.utils.getNodeAttributes', function() {
 		node.setAttribute('id', '123');
 		node.innerHTML = '<select name="attributes"></select>';
 
+		// eslint-disable-next-line no-restricted-syntax
 		assert.isFalse(node.attributes instanceof NamedNodeMap);
 
 		var actual = axe.utils.getNodeAttributes(node);