Our developer sandbox sets front-end challenges and checks the submission. The checks were string searches against the submitted source, and most of them could not fail.
The tests that passed everything
// "Renders the content"
code.toLowerCase().includes("content")
// "Uses colour"
code.includes("rgb")The first passes on any HTML document containing the word content — including the starter template we hand out. The second passes on any page with a single colour anywhere. A learner could submit the unmodified starter and be told all tests passed.
Asserting against a document
Checks now parse the submission with DOMParser and assert against the resulting document — is there a real button element, does the trigger carry aria-expanded, is the panel actually collapsed at rest. DOMParser builds a document without executing scripts, so running someone's submission through the checker cannot run their code in our page.
Verifying the verifier
Each challenge is now checked in both directions: the starter template must score zero, and a known-good solution must score full marks. A test suite that has never been observed failing is not a test suite.