Skip to content

axe.run crashes if an iframe's contentDocument is used #3864

@TastyPi

Description

@TastyPi

Product

axe-core

Product Version

4.6.2

Latest Version

  • I have tested the issue with the latest version of the product

Issue Description

Expectation

When calling axe.run with an iframe's contentDocument I expect it to perform the checks on just the iframe's document.

Actual

Throws an error:

Uncaught RangeError: Maximum call stack size exceeded
    at clone (axe.js:6044:14)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)
    at clone (axe.js:6059:26)

How to Reproduce

  1. Create a HTML file with the following content:
<!DOCTYPE html>
<html>
  <head>
    <script src="https://cdnjs.cloudflare.com/ajax/libs/axe-core/4.6.2/axe.js"></script>
    <script>
      function runAxe() {
        const iframe = document.getElementById("iframe")
        
        axe.run(iframe).then(result => console.log("Running on the element succeeds"))
        axe.run(iframe.contentDocument).then(result => console.log("You won't see this"))
      }
    </script>
  </head>
  <body>
    <iframe id="iframe"></iframe>
    <button onclick="runAxe()">Run</button>
  </body>
</html>
  1. Server it locally with a basic HTTP server (e.g. python -m http.server)
  2. Visit the file in a browser and click the "Run" button
  3. See the stack trace in the console

Additional context

The clone function avoids cloning HTML elements by checking if it is an instance of window.Node, however because the iframe's context is different Node instances from inside the iframe are not instances of window.Node, they are instances of iframe.contentWindow.Node.

The solution to this might just be to say "you can't do that, if you want to test an iframe just pass the iframe's element and make sure the iframe option is true", but I figured it might be possible to find an easy fix if the clone function can detect Node instances from iframes.

Metadata

Metadata

Assignees

Labels

coreIssues in the core code (lib/core)fixBug fixesprA pr has been created for the issue

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions