
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Browser-based accessibility testing tools and plugins require manually testing each page, one at a time. Tools that can crawl a website can only scan pages that do not require login credentials, and that are not behind a firewall. Instead of developing, testing, and using a separate accessibility test suite, you can now integrate accessibility testing into your existing automation test suite using AATT.
AATT tests web applications regarding conformance to the Web Content Accessibility Guidelines (WCAG) 2.1 (for axe engine).
AATT provides an accessibility API and custom web application for HTML CodeSniffer, Axe and Chrome developer tool. Using the AATT web application, you can configure test server configurations inside the firewall, and test individual pages.
AATT includes HTML CodeSniffer, Axe and Chrome developer tool with Express and PhantomJS, which runs on Node.
For example, it can be used to test Java web applications using SeLion automation test frameworks.
For node applications, it can be integrated into NemoJS testing framework to run accessibility testing during automated unit testing .For Nemo framework use [Nemo-Accessibility plugin] (https://github.com/paypal/nemo-accessibility)
$ git clone https://github.com/paypal/AATT.git
$ cd AATT
$ npm i
$ DEBUG=AATT* http_port=3000 node app.js . (If you want to run in Debug mode printing logs)
$sudo node app.js will run in default port 80 without printing log information
You can now access the running instance of AATT from http://localhost:3000
AATT provides an API for evaluating HTML Source code from other servers. The API EndPoint is: https://your_nodejs_server/evaluate
Accepts the following OPTIONAL parameters:
"source" to send the HTML source of the page. Can be a whole page or partial page source. Defaults to document
"engine" E.g. engine=htmlcs. This is the engine which will scan the code. It accepts a single value of "axe", chrome" or "htmlcs". Defaults to axe
"ouput" to get the jsonified string. E.g. output=json. If this parameter is not set or left empty, it will return a string with table data that can be parsed or appended directly into your page. Defaults to json.
"errLevel" Error level like Error, Warning or Notices . Mapped to 1, 2 and 3 respectively. E.g. "1,2,3" . (For HTMLCS engine)
"level" This option applies only for the default htmlcs evaluation engine. Options can be either of the following WCAG2AA, WCAG2A, WCAG2AAA, Section508 . Defaults to "WCAG2A" (For HTMLCS engine)
Set the Request Header Content-type as application/x-www-form-urlencoded
Here is a sample ajax script which would initiate the request:
var xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST","http://your_nodejs_server/evaluate",true);
xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
xmlhttp.send("source=" + document.getElementById('source').value + "&priority=" + document.getElementById('priority').value);
Nemo is a node.js based automation framework for browser automation. It's plugin-architecture helps switch on/off different capabilities. The nemo-accessibility plugin performs accessibility scanning while running browser automation using Nemo framework.
nemo-accessibility plugin uses the AATT accessibility API to evaluate HTML source. Therefore you must specify the API url under as a plugin argument like below.
"nemo-accessibility":{
"module":"nemo-accessibility",
"arguments": ["https://your_nodejs_accessibility_server/evaluate"]
}
Nightwatch JS is another UI automated testing framework powered by Node.js and uses the Selenium WebDriver API. To call AATT, you need to use the request module. NightwatchJs has call back functions like before and after hooks that would be called before or after executing a test case. Request to AATT API should be done in after hook passing the source code of the page to the API. Here is an example commit on how to do this with Nightwatch.
The AATT evaluate function can be used directly as a node module, without the need for using a web API.
Add the module to your project
npm install --save aatt
This takes the same options as the web /evaluate HTTP endpoint.
const { evaluate } = require('aatt');
evaluate({
source: "<html xml:lang='en-gb'><head><title>Foo</title></head><body><p>Bar</p></body></html>",
output: "json",
engine: "htmlcs",
level: "WCAG2A"
}).then(result => {
console.log('Results', JSON.parse(result));
});
Copyright 2021, PayPal under the BSD license.
We welcome your feedback. Please file issues and/or enhancement requests.
FAQs
Automated Accessibility Testing Tool
We found that aatt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.