Adding aria-describedby in RTE not working | Community
Skip to main content
Level 4
September 9, 2020
Solved

Adding aria-describedby in RTE not working

  • September 9, 2020
  • 1 reply
  • 1951 views

I'm using the RTE in our text component and have found I cannot add an aria-describedby attribute in an a tag.

 

For example, in the RTE, I'm using the HTML editor to try to add:

 

<a href="https://www.google.com" aria-describedby="test-id">TEST</a>

 

For some reason, the aria-describedby attribute is being stripped out. Does anyone know why this might be happening and how to fix it?

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by Vaibhavi_J

Hi @alistairp781078 

Have you checked if aria-describedby tag is whitelisted in xssprotection. 

 

AEM uses XSS (Cross Site Scriptingprotection  to prevent attackers to inject code into web pages viewed by other users, is based on AntiSamy Java library provided by OWASP. 

If the tags are not whitelisted, tags will be stripped off while rendering. 

To fix the issue, 

1.Navigate to /libs/cq/xssprotection/config.xml

2.overlay the file under apps. 

3.Add the below code. 

<tag name="a" action="validate">

    <attribute name="aria-describedby">

        <regexp-list> 

           <regexp name="anything"/>

       </regexp-list>

    </attribute>

</tag>

 

Above code will allow the  aria-describedby attribute inside anchor tag. This should fix your issue. 

 

You can refer to below documents to understand in depth. 

https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/security.html#ProtectagainstCr...

https://helpx.adobe.com/experience-manager/kb/target-attribute-issue-tag.html

1 reply

Vaibhavi_J
Vaibhavi_JAccepted solution
Level 7
September 9, 2020

Hi @alistairp781078 

Have you checked if aria-describedby tag is whitelisted in xssprotection. 

 

AEM uses XSS (Cross Site Scriptingprotection  to prevent attackers to inject code into web pages viewed by other users, is based on AntiSamy Java library provided by OWASP. 

If the tags are not whitelisted, tags will be stripped off while rendering. 

To fix the issue, 

1.Navigate to /libs/cq/xssprotection/config.xml

2.overlay the file under apps. 

3.Add the below code. 

<tag name="a" action="validate">

    <attribute name="aria-describedby">

        <regexp-list> 

           <regexp name="anything"/>

       </regexp-list>

    </attribute>

</tag>

 

Above code will allow the  aria-describedby attribute inside anchor tag. This should fix your issue. 

 

You can refer to below documents to understand in depth. 

https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/security.html#ProtectagainstCr...

https://helpx.adobe.com/experience-manager/kb/target-attribute-issue-tag.html

Level 4
September 10, 2020
Hey, thanks for the response. I tried this and it's worked 🙂