Bug in DPUB allowed roles alborithm

dequelabs / axe-core

Accessibility engine for automated Web UI testing

https://www.deque.com/axe/

Mozilla Public License 2.0

5.75k stars 746 forks source link

Bug in DPUB allowed roles alborithm #4434

Open WilcoFiers opened 2 months ago

WilcoFiers commented 2 months ago

This line is wrong:

https://github.com/dequelabs/axe-core/blob/5c5ede0c02ab6e0a62a0e13a4ff5d1e27c3db353/lib/commons/aria/get-element-unallowed-roles.js#L78

Didn't look too closely, but getRoleType doesn't return an implicit role. This cannot be correct.

danielweck commented 1 month ago

I think this may be the reason why we are now seeing false negatives in DAISY Ace (I am in the process of integrating the latest version of Deque Axe, 4.9.1 as of today). Though I suspect we will need to migrate to 4.10.0 as soon as available due to landmark-unique bugs. I will report any of my findings here. Thanks for your hard work team Axe!

WilcoFiers commented 2 weeks ago

@danielweck I'm investigating further. This shouldn't have caused a new issue. This code has been in place for the past 3 years. I don't think I know what new issues you may be seeing with 4.9.1, can you open a separate issue for it?