
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
@quailjs/quail
Advanced tools
The project website is quailjs.io.
Quail is a Node module and a jQuery plugin that lets you easily check HTML for adherence to accessibility standards. It comes with over 200 tests which implement Open Accessibility Tests and comes with WCAG 1.0, WCAG 2.0, and Section 508 guidelines.
Developers can build their own guidelines, or easily build a custom guideline that integrates with their project. While the project supports checking entire HTML pages, integration with a CMS to check partial HTML content is probably the most popular use case.
Notice for developers working in the 2.2.x version.
Please base your changes on the master-2.2.x
branch.
You will need the following installed on your system to run Quail.
Run the following commands to build Quail.
git clone https://github.com/quailjs/quail.git
cd quail
npm install
bower install
grunt build
To see the Quail CLI API, run the following. You can also add the Quail bin directory to your PATH if you are so inclined.
./bin/quail --help
Once the command is set up, you can run the following to test any addressable web page.
./bin/quail eval http://placekitten.com
Write the results as a JSON object out to file in an existing directory.
./bin/quail evaluate http://placekitten.com -o ./analyses
You can also pass configurations to the evaluator.
./bin/quail evaluate http://placekitten.com -c ~/path/to/myconfig.json -o ./analyses
This is the default set of configurations. Your configurations will replace the defaults.
{
"phantomjs": {
"resourceTimeout": 5000
},
"blacklists": {
"domains": [
"fbstatic.com",
"facebook.com",
"twitter.com",
"google-analytics.com",
"googleadservices.com",
"googlesyndication.com",
"perfectaudience.com",
"typekit.com",
"sharethis.com",
"doubleclick.com",
"optimizely.com",
"gigya.com"
],
"mimetypes": [
"application/x-shockwave-flash",
"application/(ms)?(word|powerpoint|excel)"
],
"headers": []
}
}
The phantomjs
configurations affect the PhantomJS runtime.
The blacklists
block resource resource requests from PhantomJS by the resource's domain, its mime type or a header name in the request. Currently the only header value that can be blocked is the value of Accept (mime type).
To work on an existing assessment in a browser (so that breakpoints can be set in the console), run the following.
./bin/quail dev aMustHaveTitle
The following is experimental, which means it probably won't work. You can generate a new assessment with this command.
./bin/quail gen someNewAssessment
./node_modules/karma/bin/karma start ./config/karma-unit.conf.js
All assessments. This takes about 10 minutes to run.
node ./test/assessmentSpecs/testRunner.js
An individual assessment. This takes about 2 seconds to run.
node ./test/assessmentSpecs/testRunner.js -I aMustHaveTitle
In a specific browser.
_BROWSER=chrome node ./test/assessmentSpecs/testRunner.js
Full documentation is available via readthedocs.org.
Pull requests should be made against the master branch.
We are currently looking for the following types of contritions.
HTML Test Suite for WCAG 2.0, Sorted by Guideline
QUAIL is covered under the MIT License, and is copyright (c) 2015 by Jesse Beach. Current license is at http://quailjs.org/license.
FAQs
Accessibility testing in the browser and on the server.
The npm package @quailjs/quail receives a total of 1 weekly downloads. As such, @quailjs/quail popularity was classified as not popular.
We found that @quailjs/quail demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.