VirtualNode props getter throws in an AngularJS v1 edge case with hidden input elements

[dbjorge]

We debugged a customer issue today involving an axe-core crash when running against a specific customer page. The page in question was using AngularJS 1.7.8 and included a DOM snippet with a structure similar to the following:

<div id="outer">
  <div class="hidden"></div>
  <input type="hidden" id="field_1" value="0" autocomplete="off">





  <input type="hidden" id="field_2" value="1.2.3.4 (value=)" autocomplete="off">
</div>

AngularJS v1.7.8 includes this hacky workaround that is intended to be applied to <input type="hidden"> elements to override the way their value property getters work. However, in the customer page, for some reason this overriden value getter ended up applied not just to the input elements, but also to some of the text Nodes representing the whitespace in between the two hidden inputs.

This causes axe-core to throw an error in /lib/core/base/virtual-node/virtual-node.js when it attempts to read the value of the text nodes in question - it expects that this operation should just harmlessly return undefined for a text node, but the AngularJS override ends up trying to invoke theTextNode.getAttribute('value'), which throws because it's a text node.

Unfortunately, we were unable to extract a minimal/standalone repro for this issue - the above code is structurally similar to what we saw in the customer's page, but not enough on its own to trigger the issue. We know that the override in question isn't present in newer/supported versions of angular, so we think it's probably not a good use of time to further debug the root cause of the override being applied to the unexpected nodes; it's unlikely that the issue would be fixed even if we identified the root cause. Instead, we can mitigate the customer impact by just being more defensive about when we read the value property - it (and a few other props) shouldn't need to be read at all for non-input elements.