Adding aria-describedby in RTE not working

[#1]

I'm using the RTE in our text component and have found I cannot add an aria-describedby attribute in an a tag.

For example, in the RTE, I'm using the HTML editor to try to add:

<a href="https://www.google.com" aria-describedby="test-id">TEST</a>

For some reason, the aria-describedby attribute is being stripped out. Does anyone know why this might be happening and how to fix it?

[alistairp781078 · Accepted solution]

Hi @alistairp781078 

Have you checked if aria-describedby tag is whitelisted in xssprotection. 

AEM uses XSS (Cross Site Scripting) protection  to prevent attackers to inject code into web pages viewed by other users, is based on AntiSamy Java library provided by OWASP. 

If the tags are not whitelisted, tags will be stripped off while rendering. 

To fix the issue, 

1.Navigate to /libs/cq/xssprotection/config.xml

2.overlay the file under apps. 

3.Add the below code. 

<tag name="a" action="validate">

    <attribute name="aria-describedby">

        <regexp-list> 

           <regexp name="anything"/>

       </regexp-list>

    </attribute>

</tag>

Above code will allow the  aria-describedby attribute inside anchor tag. This should fix your issue. 

You can refer to below documents to understand in depth. 

https://helpx.adobe.com/experience-manager/6-3/sites/developing/using/security.html#ProtectagainstCr...

https://helpx.adobe.com/experience-manager/kb/target-attribute-issue-tag.html

[alistairp781078 · Accepted solution]

Hey, thanks for the response. I tried this and it's worked 🙂