Skip to content

Fix: narrow hidden-text-strip display:none carve-out for live regions#212

Merged
twschiller merged 1 commit into
mainfrom
fix/hidden-text-strip-display-none-live-region
Jun 7, 2026
Merged

Fix: narrow hidden-text-strip display:none carve-out for live regions#212
twschiller merged 1 commit into
mainfrom
fix/hidden-text-strip-display-none-live-region

Conversation

@twschiller
Copy link
Copy Markdown
Contributor

Summary

  • Closes audit item docs: add Browserbase + Python integration page #14 from Audit: rule-bypass findings (red-team pass) #203: display:none + role="status" / aria-live smuggling.
  • New trigger in hidden-text-strip: an element with display:none and a live-region opt-in (role=status/alert/log/marquee/timer/alertdialog, or aria-live=polite/assertive) is now stripped. Reason: display-none-live-region.
  • Tab panels, dropdowns, and other display-toggled containers without those attributes stay untouched — the original carve-out's app-state invariant is preserved because legitimate hidden tab panels don't carry live-region attributes (a tab panel announcing its contents while invisible would be a bug).
  • aria-live="off" is treated as explicit opt-out and still falls under the tab-panel carve-out.

Test plan

  • bun run test — all 1680 tests pass, including six new unit cases (status / alert / aria-live polite / aria-live assertive / aria-live off carve-out / descendant element preservation) and a new property test over (live-region attribute × subtree shape).
  • bun run check (Biome + ESLint) passes.
  • bun run typecheck passes.
  • Tightened the existing display:none tab-panel test to also assert textContent is still readable, so a future regression that broadened the trigger would fail.

🤖 Generated with Claude Code

Closes audit item #14 in #203. `display:none` on a live region
(role=status/alert/log/marquee/timer/alertdialog, or aria-live=
polite/assertive) is an opt-in to "announce my contents" — the
carrier reaches agents walking textContent / the a11y tree while
staying invisible to sighted users. Tab panels and dropdowns never
wear those attributes, so the narrower trigger preserves the
app-state-corruption tradeoff that motivated the original
display:none exclusion.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
@vercel
Copy link
Copy Markdown

vercel Bot commented Jun 7, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
agent-browser-shield-demo-site Ready Ready Preview, Comment Jun 7, 2026 7:26pm

Request Review

@twschiller twschiller merged commit 6307a7a into main Jun 7, 2026
7 checks passed
@twschiller twschiller deleted the fix/hidden-text-strip-display-none-live-region branch June 7, 2026 19:28
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant