From 439fd7afec32675e10cce952e58e1365526512ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marcus=20=C3=96sterberg?= <m@tba.nu>
Date: Wed, 15 Jul 2026 16:31:57 +0200
Subject: [PATCH] Only analyze HTML belonging to the tested page

A browsertime HAR can contain more than one page, for example when a
concurrent browsertime run on the same host races for the same Chrome
DevTools port and its crossed CDP session records another website's
page load into this run's recording (see
Webperf-se/webperf_core#1557).

This analyzer took the first HTML response in the whole HAR as the
page to search for an accessibility statement, so a crossed-in
recording could make it search (and rate) another website's page.

Filter entries to the ones belonging to the first page in the HAR's
pages array, and verify that the recording's first request matches the
tested URL's hostname (the URL API normalizes IDN hostnames to
punycode on both sides). On mismatch nothing is analyzed and the
existing no-network issue is reported. HARs without a pages array and
entries without pageref behave as before.
---
 lib/harAnalyzer.js | 47 +++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 42 insertions(+), 5 deletions(-)

diff --git a/lib/harAnalyzer.js b/lib/harAnalyzer.js
index 0767197..fe4ee21 100644
--- a/lib/harAnalyzer.js
+++ b/lib/harAnalyzer.js
@@ -46,19 +46,56 @@ export class HarAnalyzer {
         }
     }
 
+    getFirstPageEntries(url, harData) {
+        if ('log' in harData) {
+            harData = harData['log'];
+        }
+
+        const entries = harData.entries;
+        if (!Array.isArray(entries)) {
+            return [];
+        }
+
+        // A HAR can contain more than one page, for example when a concurrent
+        // browsertime run ends up in the same browser session (crossed DevTools
+        // port) and navigates to another website mid-recording. Requests made
+        // by other pages must not be attributed to the tested website, and if
+        // the recording doesn't even start with the tested website nothing in
+        // it can be trusted.
+        if (url && entries.length > 0) {
+            const firstUrl = entries[0].request && entries[0].request.url;
+            if (firstUrl) {
+                try {
+                    if (new URL(firstUrl).hostname !== new URL(url).hostname) {
+                        return [];
+                    }
+                } catch {
+                    // Unparsable URLs are handled by the entry loops as before
+                }
+            }
+        }
+
+        const pages = harData.pages;
+        if (!Array.isArray(pages) || pages.length === 0) {
+            return entries;
+        }
+        const firstPageId = pages[0].id;
+        if (firstPageId === undefined) {
+            return entries;
+        }
+        return entries.filter(entry =>
+            entry.pageref === undefined || entry.pageref === firstPageId);
+    }
+
     transform2SimplifiedData(harData, url) {
         const data = {
             'url': url,
             'htmls': []
         };
 
-        if ('log' in harData) {
-            harData = harData['log'];
-        }
-
         let reqIndex = 1;
 
-        for (const entry of harData.entries) {
+        for (const entry of this.getFirstPageEntries(url, harData)) {
             const req = entry.request;
             const res = entry.response;
             const reqUrl = req.url;