From b477e0d668ddd7d4563c8c154301d2976921635f Mon Sep 17 00:00:00 2001
From: Steven Lambert <stevenlambert503@gmail.com>
Date: Thu, 28 Mar 2019 10:36:05 -0600
Subject: [PATCH] fix: Prevent error when using <select name="attributes">
 [#1397] (#1432)

---
 .eslintrc                              |  6 ++++++
 lib/checks/aria/allowed-attr.js        |  2 +-
 lib/checks/aria/unsupportedattr.js     |  2 +-
 lib/checks/aria/valid-attr-value.js    |  2 +-
 lib/checks/aria/valid-attr.js          |  2 +-
 lib/commons/aria/roles.js              |  2 +-
 lib/core/utils/get-node-attributes.js  | 21 +++++++++++++++++++++
 lib/core/utils/get-selector.js         |  8 ++++----
 lib/rules/aria-allowed-attr-matches.js |  2 +-
 lib/rules/aria-has-attr-matches.js     |  2 +-
 test/core/utils/get-node-attributes.js | 26 ++++++++++++++++++++++++++
 11 files changed, 64 insertions(+), 11 deletions(-)
 create mode 100644 lib/core/utils/get-node-attributes.js
 create mode 100644 test/core/utils/get-node-attributes.js

diff --git a/.eslintrc b/.eslintrc
index 93cde8712f..a45c5c4801 100644
--- a/.eslintrc
+++ b/.eslintrc
@@ -70,6 +70,12 @@
       {
         "selector": "MemberExpression[property.name=tagName]",
         "message": "Don't use node.tagName, use node.nodeName instead."
+      },
+      {
+        // node.attributes can be clobbered so is unsafe to use
+        // @see https://github.com/dequelabs/axe-core/pull/1432
+        "selector": "MemberExpression[object.name=node][property.name=attributes]",
+        "message": "Don't use node.attributes, use node.hasAttributes() or axe.utils.getNodeAttributes(node) instead."
       }
     ]
   }
diff --git a/lib/checks/aria/allowed-attr.js b/lib/checks/aria/allowed-attr.js
index 0e1b2d2fa8..b9c8fd7928 100644
--- a/lib/checks/aria/allowed-attr.js
+++ b/lib/checks/aria/allowed-attr.js
@@ -6,7 +6,7 @@ var attr,
 	attrName,
 	allowed,
 	role = node.getAttribute('role'),
-	attrs = node.attributes;
+	attrs = axe.utils.getNodeAttributes(node);
 
 if (!role) {
 	role = axe.commons.aria.implicitRole(node);
diff --git a/lib/checks/aria/unsupportedattr.js b/lib/checks/aria/unsupportedattr.js
index b485d5019e..6c8aca65a3 100644
--- a/lib/checks/aria/unsupportedattr.js
+++ b/lib/checks/aria/unsupportedattr.js
@@ -2,7 +2,7 @@ const nodeName = node.nodeName.toUpperCase();
 const lookupTable = axe.commons.aria.lookupTable;
 const role = axe.commons.aria.getRole(node);
 
-const unsupportedAttrs = Array.from(node.attributes)
+const unsupportedAttrs = Array.from(axe.utils.getNodeAttributes(node))
 	.filter(({ name }) => {
 		const attribute = lookupTable.attributes[name];
 
diff --git a/lib/checks/aria/valid-attr-value.js b/lib/checks/aria/valid-attr-value.js
index e84a02d06d..548d52e805 100644
--- a/lib/checks/aria/valid-attr-value.js
+++ b/lib/checks/aria/valid-attr-value.js
@@ -5,7 +5,7 @@ var invalid = [],
 
 var attr,
 	attrName,
-	attrs = node.attributes;
+	attrs = axe.utils.getNodeAttributes(node);
 
 var skipAttrs = ['aria-errormessage'];
 
diff --git a/lib/checks/aria/valid-attr.js b/lib/checks/aria/valid-attr.js
index d9a46f287f..638ad83114 100644
--- a/lib/checks/aria/valid-attr.js
+++ b/lib/checks/aria/valid-attr.js
@@ -4,7 +4,7 @@ var invalid = [],
 	aria = /^aria-/;
 
 var attr,
-	attrs = node.attributes;
+	attrs = axe.utils.getNodeAttributes(node);
 
 for (var i = 0, l = attrs.length; i < l; i++) {
 	attr = attrs[i].name;
diff --git a/lib/commons/aria/roles.js b/lib/commons/aria/roles.js
index ee55770335..cecd4aeb1b 100644
--- a/lib/commons/aria/roles.js
+++ b/lib/commons/aria/roles.js
@@ -188,7 +188,7 @@ aria.implicitRole = function(node) {
 		return null;
 	}
 
-	var nodeAttributes = node.attributes;
+	var nodeAttributes = axe.utils.getNodeAttributes(node);
 	var ariaAttributes = [];
 
 	/* Get all aria-attributes defined for this node */
diff --git a/lib/core/utils/get-node-attributes.js b/lib/core/utils/get-node-attributes.js
new file mode 100644
index 0000000000..675926d955
--- /dev/null
+++ b/lib/core/utils/get-node-attributes.js
@@ -0,0 +1,21 @@
+/* global axe */
+
+/**
+ * Return the list of attributes of a node.
+ * @method getNodeAttributes
+ * @memberof axe.utils
+ * @param {Element} node
+ * @returns {NamedNodeMap}
+ */
+axe.utils.getNodeAttributes = function getNodeAttributes(node) {
+	// eslint-disable-next-line no-restricted-syntax
+	if (node.attributes instanceof window.NamedNodeMap) {
+		// eslint-disable-next-line no-restricted-syntax
+		return node.attributes;
+	}
+
+	// if the attributes property is not of type NamedNodeMap then the DOM
+	// has been clobbered. E.g. <form><input name="attributes"></form>.
+	// We can clone the node to isolate it and then return the attributes
+	return node.cloneNode(false).attributes;
+};
diff --git a/lib/core/utils/get-selector.js b/lib/core/utils/get-selector.js
index e0af47ad0d..7f2e4775dd 100644
--- a/lib/core/utils/get-selector.js
+++ b/lib/core/utils/get-selector.js
@@ -119,8 +119,8 @@ axe.utils.getSelectorData = function(domTree) {
 			}
 
 			// count all the filtered attributes
-			if (node.attributes) {
-				Array.from(node.attributes)
+			if (node.hasAttributes()) {
+				Array.from(axe.utils.getNodeAttributes(node))
 					.filter(filterAttributes)
 					.forEach(at => {
 						let atnv = getAttributeNameValue(node, at);
@@ -238,8 +238,8 @@ function uncommonAttributes(node, selectorData) {
 	let attData = selectorData.attributes;
 	let tagData = selectorData.tags;
 
-	if (node.attributes) {
-		Array.from(node.attributes)
+	if (node.hasAttributes()) {
+		Array.from(axe.utils.getNodeAttributes(node))
 			.filter(filterAttributes)
 			.forEach(at => {
 				const atnv = getAttributeNameValue(node, at);
diff --git a/lib/rules/aria-allowed-attr-matches.js b/lib/rules/aria-allowed-attr-matches.js
index 782c99b465..09b5d69edc 100644
--- a/lib/rules/aria-allowed-attr-matches.js
+++ b/lib/rules/aria-allowed-attr-matches.js
@@ -1,6 +1,6 @@
 const aria = /^aria-/;
 if (node.hasAttributes()) {
-	let attrs = node.attributes;
+	let attrs = axe.utils.getNodeAttributes(node);
 	for (let i = 0, l = attrs.length; i < l; i++) {
 		if (aria.test(attrs[i].name)) {
 			return true;
diff --git a/lib/rules/aria-has-attr-matches.js b/lib/rules/aria-has-attr-matches.js
index a9bdbc4a5a..c12eb40965 100644
--- a/lib/rules/aria-has-attr-matches.js
+++ b/lib/rules/aria-has-attr-matches.js
@@ -1,6 +1,6 @@
 var aria = /^aria-/;
 if (node.hasAttributes()) {
-	var attrs = node.attributes;
+	var attrs = axe.utils.getNodeAttributes(node);
 	for (var i = 0, l = attrs.length; i < l; i++) {
 		if (aria.test(attrs[i].name)) {
 			return true;
diff --git a/test/core/utils/get-node-attributes.js b/test/core/utils/get-node-attributes.js
new file mode 100644
index 0000000000..bd35887d94
--- /dev/null
+++ b/test/core/utils/get-node-attributes.js
@@ -0,0 +1,26 @@
+describe('axe.utils.getNodeAttributes', function() {
+	'use strict';
+
+	it('should return the list of attributes', function() {
+		var node = document.createElement('div');
+		node.setAttribute('class', 'foo bar');
+		var actual = axe.utils.getNodeAttributes(node);
+		assert.isTrue(actual instanceof window.NamedNodeMap);
+		assert.equal(actual.length, 1);
+		assert.equal(actual[0].name, 'class');
+	});
+
+	it('should return the list of attributes when the DOM is clobbered', function() {
+		var node = document.createElement('form');
+		node.setAttribute('id', '123');
+		node.innerHTML = '<select name="attributes"></select>';
+
+		// eslint-disable-next-line no-restricted-syntax
+		assert.isFalse(node.attributes instanceof window.NamedNodeMap);
+
+		var actual = axe.utils.getNodeAttributes(node);
+		assert.isTrue(actual instanceof window.NamedNodeMap);
+		assert.equal(actual.length, 1);
+		assert.equal(actual[0].name, 'id');
+	});
+});