From 25bb75ba27c9d1aecb4f6bf6b8e512aaa4a7dfca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Tue, 21 Apr 2026 12:25:35 +0200
Subject: [PATCH 1/2] =?UTF-8?q?fix:=20template-no-invalid-aria-attributes?=
 =?UTF-8?q?=20=E2=80=94=20accept=20"undefined"=20as=20valid=20token=20for?=
 =?UTF-8?q?=20aria-orientation?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per aria-query 5.3.2, `aria-orientation` has `type: 'token'` with
`values: ['vertical', 'undefined', 'horizontal']` — i.e. the literal
string "undefined" is an explicit, valid token.

Our previous implementation short-circuited on `value === 'undefined'`
by returning `Boolean(attrDef.allowundefined)` before the token check.
Because `aria-orientation` carries `allowundefined: false` in aria-query,
the valid token "undefined" was incorrectly rejected.

Fix: before applying the generic `allowundefined` shortcut, check
whether the attribute is a `token`/`tokenlist` whose `values` array
explicitly includes `'undefined'`. If so, the value is valid regardless
of `allowundefined`.

Regression tests cover the valid (`undefined`, `horizontal`) and invalid
(`sideways`) cases for `aria-orientation`, in both `<template>` and hbs
parsers.

Reference: audit finding B9 (tests/audit/aria-props/peer-parity.js on
audit/phase3/aria-props); PR #28 backlog item F1.
---
 lib/rules/template-no-invalid-aria-attributes.js   | 13 +++++++++++++
 .../rules/template-no-invalid-aria-attributes.js   | 14 ++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/lib/rules/template-no-invalid-aria-attributes.js b/lib/rules/template-no-invalid-aria-attributes.js
index 4a5c7a2a48..98efd0b05f 100644
--- a/lib/rules/template-no-invalid-aria-attributes.js
+++ b/lib/rules/template-no-invalid-aria-attributes.js
@@ -17,6 +17,19 @@ function isValidAriaValue(attrName, value) {
     return true;
   }
 
+  // Check whether 'undefined' is an explicit token in the attribute's value list
+  // (e.g. aria-orientation allows 'undefined' per aria-query) BEFORE applying the
+  // generic allowundefined shortcut. Otherwise valid tokens get rejected for
+  // attributes where allowundefined is false.
+  if (
+    value === 'undefined' &&
+    (attrDef.type === 'token' || attrDef.type === 'tokenlist') &&
+    Array.isArray(attrDef.values) &&
+    attrDef.values.includes('undefined')
+  ) {
+    return true;
+  }
+
   if (value === 'undefined') {
     return Boolean(attrDef.allowundefined);
   }
diff --git a/tests/lib/rules/template-no-invalid-aria-attributes.js b/tests/lib/rules/template-no-invalid-aria-attributes.js
index 7f8e10b8e6..aefa9d0cd9 100644
--- a/tests/lib/rules/template-no-invalid-aria-attributes.js
+++ b/tests/lib/rules/template-no-invalid-aria-attributes.js
@@ -32,6 +32,8 @@ ruleTester.run('template-no-invalid-aria-attributes', rule, {
     '<template><button type="submit" aria-disabled={{this.isDisabled}}>Submit</button></template>',
     '<template><div role="textbox" aria-sort={{if this.hasCustomSort "other" "ascending"}}></div></template>',
     '<template><div role="combobox" aria-expanded="undefined"></div></template>',
+    '<template><div role="slider" aria-orientation="undefined"></div></template>',
+    '<template><div role="slider" aria-orientation="horizontal"></div></template>',
     '<template><button aria-label={{if @isNew (t "actions.add") (t "actions.edit")}}></button></template>',
   ],
   invalid: [
@@ -121,6 +123,11 @@ ruleTester.run('template-no-invalid-aria-attributes', rule, {
       output: null,
       errors: [{ messageId: 'invalidAriaAttributeValue' }],
     },
+    {
+      code: '<template><div role="slider" aria-orientation="sideways"></div></template>',
+      output: null,
+      errors: [{ messageId: 'invalidAriaAttributeValue' }],
+    },
   ],
 });
 
@@ -150,6 +157,8 @@ hbsRuleTester.run('template-no-invalid-aria-attributes', rule, {
     '<button type="submit" aria-disabled={{this.isDisabled}}>Submit</button>',
     '<div role="textbox" aria-sort={{if this.hasCustomSort "other" "ascending"}}></div>',
     '<div role="combobox" aria-expanded="undefined"></div>',
+    '<div role="slider" aria-orientation="undefined"></div>',
+    '<div role="slider" aria-orientation="horizontal"></div>',
     '<button aria-label={{if @isNew (t "actions.add") (t "actions.edit")}}></button>',
   ],
   invalid: [
@@ -223,5 +232,10 @@ hbsRuleTester.run('template-no-invalid-aria-attributes', rule, {
       output: null,
       errors: [{ messageId: 'invalidAriaAttributeValue' }],
     },
+    {
+      code: '<div role="slider" aria-orientation="sideways"></div>',
+      output: null,
+      errors: [{ messageId: 'invalidAriaAttributeValue' }],
+    },
   ],
 });

From c0e0fcd5a35f08a3d7de9edbea13835b9a39d3ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Johan=20R=C3=B8ed?= <johanroed@gmail.com>
Date: Tue, 21 Apr 2026 14:00:11 +0200
Subject: [PATCH 2/2] refactor: extract validateByType to drop isValidAriaValue
 complexity below 20

---
 .../template-no-invalid-aria-attributes.js    | 50 ++++++++++---------
 1 file changed, 27 insertions(+), 23 deletions(-)

diff --git a/lib/rules/template-no-invalid-aria-attributes.js b/lib/rules/template-no-invalid-aria-attributes.js
index 98efd0b05f..302c8267a7 100644
--- a/lib/rules/template-no-invalid-aria-attributes.js
+++ b/lib/rules/template-no-invalid-aria-attributes.js
@@ -11,29 +11,7 @@ function isNumeric(value) {
   return !Number.isNaN(Number(value));
 }
 
-function isValidAriaValue(attrName, value) {
-  const attrDef = aria.get(attrName);
-  if (!attrDef) {
-    return true;
-  }
-
-  // Check whether 'undefined' is an explicit token in the attribute's value list
-  // (e.g. aria-orientation allows 'undefined' per aria-query) BEFORE applying the
-  // generic allowundefined shortcut. Otherwise valid tokens get rejected for
-  // attributes where allowundefined is false.
-  if (
-    value === 'undefined' &&
-    (attrDef.type === 'token' || attrDef.type === 'tokenlist') &&
-    Array.isArray(attrDef.values) &&
-    attrDef.values.includes('undefined')
-  ) {
-    return true;
-  }
-
-  if (value === 'undefined') {
-    return Boolean(attrDef.allowundefined);
-  }
-
+function validateByType(attrDef, value) {
   switch (attrDef.type) {
     case 'boolean': {
       return isBoolean(value);
@@ -73,6 +51,32 @@ function isValidAriaValue(attrName, value) {
   }
 }
 
+function isValidAriaValue(attrName, value) {
+  const attrDef = aria.get(attrName);
+  if (!attrDef) {
+    return true;
+  }
+
+  // Check whether 'undefined' is an explicit token in the attribute's value list
+  // (e.g. aria-orientation allows 'undefined' per aria-query) BEFORE applying the
+  // generic allowundefined shortcut. Otherwise valid tokens get rejected for
+  // attributes where allowundefined is false.
+  if (
+    value === 'undefined' &&
+    (attrDef.type === 'token' || attrDef.type === 'tokenlist') &&
+    Array.isArray(attrDef.values) &&
+    attrDef.values.includes('undefined')
+  ) {
+    return true;
+  }
+
+  if (value === 'undefined') {
+    return Boolean(attrDef.allowundefined);
+  }
+
+  return validateByType(attrDef, value);
+}
+
 function getExpectedTypeDescription(attrName) {
   const attrDef = aria.get(attrName);
   if (!attrDef) {