fix: resolve 4 assigned a11y and security issues (#451 #452 #453 #454)#550
Open
oche11207-art wants to merge 1 commit into
Open
fix: resolve 4 assigned a11y and security issues (#451 #452 #453 #454)#550oche11207-art wants to merge 1 commit into
oche11207-art wants to merge 1 commit into
Conversation
Issue MettaChain#453 (P1): PropertyCard - remove nested interactive elements - Replace outer <Link> with <article> to fix nested-interactive violation - Add explicit <Link> for property title and View button - Remove stopPropagation calls (no longer needed without parent link) - Update a11y tests to match new DOM structure Issue MettaChain#454 (P3): ViewToggle - add accessible names - Add aria-labels to grid/list buttons for screen-reader support - Wrap text in <span> for icon-only rendering scenarios Issue MettaChain#451 (P2): Share URL security - Create centralized share URL utility with URL validation - Sanitize display strings to constrained character set - Use URL constructor to validate all URLs - Integrate into ShareButton and MortgageCalculator Issue MettaChain#452 (P2): Global listener leak prevention - Add cleanup functions for extension event listeners - Track console overrides for restoration on cleanup - Create usePerformanceMonitoring hook with lifecycle management
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR addresses all 4 issues currently assigned in the Stellar Wave program.
Issue #453 (P1 - High Priority): PropertyCard nests buttons inside
<a><Link>with nested interactive buttons (cart, favorite, compare, view), causing axe-core nested-interactive violations and broken keyboard semantics.<Link>to<article>. Added explicit<Link>elements for the property title and View button. Removede.preventDefault()/e.stopPropagation()calls that were only needed to suppress parent link navigation.src/components/PropertyCard.tsx,src/components/__tests__/PropertyCard.a11y.test.tsxIssue #454 (P3): ViewToggle buttons missing accessible name
aria-label, relying only on visible text. In icon-only rendering scenarios (small screens), screen-readers lost the accessible name.aria-label="Grid view"andaria-label="List view"to both buttons. Wrapped visible text in<span>for resilient icon-only CSS targeting.src/components/ViewToggle.tsxIssue #451 (P2): Open redirect / unsafe share URL risk
src/utils/security/shareUrl.tswith:sanitizeDisplayString()- constrains to safe character set, truncates to 200 charsbuildPropertyShareUrl()- validates viaURLconstructor, warns on cross-originbuildTwitterShareUrl(),buildLinkedInShareUrl(),buildEmailShareUrl()- useURL.searchParamsfor proper encodingsrc/utils/security/shareUrl.ts(new),src/components/property/ShareButton.tsx,src/components/MortgageCalculator.tsxIssue #452 (P2): web-vitals & global listeners leak
extensionDetection.tsandearlyErrorSuppression.tsregistered globalwindowevent listeners and console overrides at module scope with no cleanup, causing listener accumulation across SPA navigations.cleanup*functionsusePerformanceMonitoringReact hook that ensures singlePerformanceObserverinstance per app lifecyclesrc/utils/extensionDetection.ts,src/utils/earlyErrorSuppression.ts,src/hooks/usePerformanceMonitoring.ts(new)Verification
URLconstructorcloses #451
closes #452
closes #453
closes #454