client: Add ARIA element support to client spider

addOns/client/src/main/java/org/zaproxy/addon/client/internal/ClientSideComponent.java

@@ -149,7 +149,21 @@ public static Type getTypeForKey(String key) {
     public ClientSideComponent(JSONObject json) {
         data = new HashMap<>();
         for (Object key : json.keySet()) {
-            data.put(key.toString(), json.get(key).toString());
+            String keyStr = key.toString();
+            Object value = json.get(key);
+
+            if ("ariaIdentification".equals(keyStr)) {
+                if (value instanceof JSONObject) {
+                    JSONObject ariaObj = (JSONObject) value;
+                    Map<String, String> ariaMap = new HashMap<>();
+                    for (Object ariaKey : ariaObj.keySet()) {
+                        ariaMap.put(ariaKey.toString(), ariaObj.getString(ariaKey.toString()));
+                    }
+                    data.put("ariaIdentification", ariaMapToString(ariaMap));
+                }
+            } else {
+                data.put(keyStr, value.toString());
+            }
         }
 
         this.tagName = json.getString("tagName");
@@ -279,4 +293,12 @@ private static int nullCompare(Object here, Object other) {
         }
         return 1;
     }
+
+    private static String ariaMapToString(Map<String, String> ariaMap) {
+        JSONObject json = new JSONObject();
+        for (Map.Entry<String, String> entry : ariaMap.entrySet()) {
+            json.put(entry.getKey(), entry.getValue());
+        }
+        return json.toString();
+    }
 }

addOns/client/src/main/java/org/zaproxy/addon/client/internal/ReportedElement.java

@@ -19,19 +19,35 @@
  */
 package org.zaproxy.addon.client.internal;
 
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
 import net.sf.json.JSONObject;
 
 public class ReportedElement extends ReportedObject {
 
     private String tagType;
     private int formId = -1;
+    private String role;
+    private Map<String, String> ariaIdentification;
 
     public ReportedElement(JSONObject json) {
         super(json);
         this.tagType = getParam(json, "tagType");
+        this.role = getParam(json, "role");
         if (json.containsKey("formId")) {
             this.formId = json.getInt("formId");
         }
+
+        if (json.containsKey("ariaIdentification")
+                && !json.get("ariaIdentification").equals(null)) {
+            JSONObject ariaObj = json.getJSONObject("ariaIdentification");
+            this.ariaIdentification = new HashMap<>();
+            for (Object key : ariaObj.keySet()) {
+                String keyStr = (String) key;
+                this.ariaIdentification.put(keyStr, ariaObj.getString(keyStr));
+            }
+        }
     }
 
     public String getTagType() {
@@ -41,4 +57,12 @@ public String getTagType() {
     public int getFormId() {
         return formId;
     }
+
+    public String getRole() {
+        return role;
+    }
+
+    public Map<String, String> getAriaIdentification() {
+        return ariaIdentification != null ? Collections.unmodifiableMap(ariaIdentification) : null;
+    }
 }

addOns/client/src/main/java/org/zaproxy/addon/client/spider/actions/ClickElement.java

@@ -19,9 +19,13 @@
  */
 package org.zaproxy.addon.client.spider.actions;
 
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.function.Predicate;
+import net.sf.json.JSONObject;
 import org.apache.commons.httpclient.URI;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
@@ -38,6 +42,26 @@ public class ClickElement extends BaseElementAction {
 
     private static final String STATS_PREFIX = "stats.client.spider.action.click";
 
+    private static final List<String> INTERACTIVE_ARIA_ROLES =
+            Arrays.asList(
+                    "button",
+                    "link",
+                    "checkbox",
+                    "radio",
+                    "switch",
+                    "tab",
+                    "menuitem",
+                    "menuitemcheckbox",
+                    "menuitemradio",
+                    "option",
+                    "treeitem",
+                    "combobox",
+                    "listbox",
+                    "slider",
+                    "spinbutton",
+                    "searchbox",
+                    "textbox");
+
     private final Map<String, String> elementData;
     private final String tagName;
 
@@ -78,18 +102,61 @@ private static By getBy(Map<String, String> data) {
         }
 
         String tag = getTagName(data);
+        String ariaString = data.get("ariaIdentification");
+        if (StringUtils.isNotBlank(ariaString)) {
+            Map<String, String> ariaAttrs = parseAriaIdentification(ariaString);
+
+            if (!ariaAttrs.isEmpty()) {
+                String role = data.get("role");
+                StringBuilder xpathBuilder =
+                        new StringBuilder("//").append(StringUtils.isNotBlank(tag) ? tag : "*");
+                appendXpathAttribute(xpathBuilder, "role", role);
+                ariaAttrs.forEach((key, value) -> appendXpathAttribute(xpathBuilder, key, value));
+                return By.xpath(xpathBuilder.toString());
+            }
+        }
+
         String text = data.get("text");
         if ("INPUT".equalsIgnoreCase(tag)) {
-            return By.xpath("//" + tag + "[@value='" + text + "']");
+            return By.xpath("//" + tag + "[@value=" + escapeXpathValue(text) + "]");
         }
 
         if (StringUtils.isNotBlank(text)) {
-            return By.xpath("//" + tag + "[contains(text(), '" + text + "')]");
+            return By.xpath("//" + tag + "[contains(text(), " + escapeXpathValue(text) + ")]");
         }
 
         return By.tagName(tag);
     }
 
+    private static void appendXpathAttribute(StringBuilder builder, String name, String value) {
+        if (StringUtils.isNotBlank(value)) {
+            builder.append("[@")
+                    .append(name)
+                    .append("=")
+                    .append(escapeXpathValue(value))
+                    .append("]");
+        }
+    }
+
+    private static String escapeXpathValue(String value) {
+        if (!value.contains("'")) {
+            return "'" + value + "'";
+        }
+        if (!value.contains("\"")) {
+            return "\"" + value + "\"";
+        }
+        StringBuilder result = new StringBuilder("concat(");
+        String[] parts = value.split("'", -1);
+        for (int i = 0; i < parts.length; i++) {
+            if (i > 0) {
+                result.append(", \"'\", ");
+            }
+            result.append("'").append(parts[i]).append("'");
+        }
+        result.append(")");
+        return result.toString();
+    }
+
     public static boolean isSupported(Predicate<String> scopeChecker, Map<String, String> data) {
         String tag = getTagName(data);
         if (tag == null) {
@@ -110,7 +177,25 @@ public static boolean isSupported(Predicate<String> scopeChecker, Map<String, St
                 return "submit".equalsIgnoreCase(type) || "button".equalsIgnoreCase(type);
 
             default:
-                return false;
+                String role = data.get("role");
+                return StringUtils.isNotBlank(role)
+                        && INTERACTIVE_ARIA_ROLES.contains(role.toLowerCase());
+        }
+    }
+
+    private static Map<String, String> parseAriaIdentification(String ariaString) {
+        Map<String, String> result = new HashMap<>();
+        if (ariaString == null || ariaString.isEmpty()) {
+            return result;
+        }
+        try {
+            JSONObject json = JSONObject.fromObject(ariaString);
+            for (Object key : json.keySet()) {
+                result.put(key.toString(), json.getString(key.toString()));
+            }
+        } catch (Exception e) {
+            LOGGER.debug("Failed to parse ariaIdentification: {}", ariaString, e);
         }
+        return result;
     }
 }

addOns/client/src/test/java/org/zaproxy/addon/client/internal/ClientSideComponentUnitTest.java

@@ -31,6 +31,7 @@
 import java.util.SortedSet;
 import java.util.TreeSet;
 import java.util.stream.Stream;
+import net.sf.json.JSONObject;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -460,4 +461,47 @@ void shouldCompareFormIdAsExpected(int first, int second, int expected) {
         // Then
         assertThat(actual, is(equalTo(expected)));
     }
+
+    @Test
+    void shouldSerializeAriaIdentificationToJsonString() {
+        // Given
+        JSONObject json = new JSONObject();
+        json.put("tagName", "DIV");
+        json.put("id", "");
+        json.put("url", EXAMPLE_URL);
+        json.put("type", "nodeAdded");
+
+        JSONObject ariaObj = new JSONObject();
+        ariaObj.put("role", "button");
+        ariaObj.put("aria-label", "Submit");
+        ariaObj.put("aria-pressed", "false");
+        json.put("ariaIdentification", ariaObj);
+
+        // When
+        ClientSideComponent component = new ClientSideComponent(json);
+
+        // Then
+        String ariaString = component.getData().get("ariaIdentification");
+        assertThat(ariaString.contains("role"), is(true));
+        assertThat(ariaString.contains("button"), is(true));
+        assertThat(ariaString.contains("aria-label"), is(true));
+        assertThat(ariaString.contains("Submit"), is(true));
+    }
+
+    @Test
+    void shouldSkipNullAriaIdentification() {
+        // Given
+        JSONObject json = new JSONObject();
+        json.put("tagName", "DIV");
+        json.put("id", "test-id");
+        json.put("url", EXAMPLE_URL);
+        json.put("type", "nodeAdded");
+        // No ariaIdentification
+
+        // When
+        ClientSideComponent component = new ClientSideComponent(json);
+
+        // Then - ariaIdentification should not be in data map
+        assertThat(component.getData().containsKey("ariaIdentification"), is(false));
+    }
 }