client: Add ARIA element support to client spider

addOns/client/src/main/java/org/zaproxy/addon/client/internal/ClientSideComponent.java

@@ -149,7 +149,21 @@ public static Type getTypeForKey(String key) {
     public ClientSideComponent(JSONObject json) {
         data = new HashMap<>();
         for (Object key : json.keySet()) {
-            data.put(key.toString(), json.get(key).toString());
+            String keyStr = key.toString();
+            Object value = json.get(key);
+
+            if ("ariaIdentification".equals(keyStr)) {
+                if (value instanceof JSONObject) {
+                    JSONObject ariaObj = (JSONObject) value;
+                    Map<String, String> ariaMap = new HashMap<>();
+                    for (Object ariaKey : ariaObj.keySet()) {
+                        ariaMap.put(ariaKey.toString(), ariaObj.getString(ariaKey.toString()));
+                    }
+                    data.put("ariaIdentification", ariaMapToString(ariaMap));
+                }
+            } else {
+                data.put(keyStr, value.toString());
+            }
         }
 
         this.tagName = json.getString("tagName");
@@ -279,4 +293,12 @@ private static int nullCompare(Object here, Object other) {
         }
         return 1;
     }
+
+    private static String ariaMapToString(Map<String, String> ariaMap) {
+        JSONObject json = new JSONObject();
+        for (Map.Entry<String, String> entry : ariaMap.entrySet()) {
+            json.put(entry.getKey(), entry.getValue());
+        }
+        return json.toString();
+    }
 }

addOns/client/src/main/java/org/zaproxy/addon/client/internal/ReportedElement.java

@@ -19,19 +19,35 @@
  */
 package org.zaproxy.addon.client.internal;
 
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
 import net.sf.json.JSONObject;
 
 public class ReportedElement extends ReportedObject {
 
     private String tagType;
     private int formId = -1;
+    private String role;
+    private Map<String, String> ariaIdentification;
 
     public ReportedElement(JSONObject json) {
         super(json);
         this.tagType = getParam(json, "tagType");
+        this.role = getParam(json, "role");
         if (json.containsKey("formId")) {
             this.formId = json.getInt("formId");
         }
+
+        if (json.containsKey("ariaIdentification")
+                && !json.get("ariaIdentification").equals(null)) {
+            JSONObject ariaObj = json.getJSONObject("ariaIdentification");
+            this.ariaIdentification = new HashMap<>();
+            for (Object key : ariaObj.keySet()) {
+                String keyStr = (String) key;
+                this.ariaIdentification.put(keyStr, ariaObj.getString(keyStr));
+            }
+        }
     }
 
     public String getTagType() {
@@ -41,4 +57,12 @@ public String getTagType() {
     public int getFormId() {
         return formId;
     }
+
+    public String getRole() {
+        return role;
+    }
+
+    public Map<String, String> getAriaIdentification() {
+        return ariaIdentification != null ? Collections.unmodifiableMap(ariaIdentification) : null;
+    }
 }

addOns/client/src/main/java/org/zaproxy/addon/client/spider/actions/ClickElement.java

@@ -19,9 +19,13 @@
  */
 package org.zaproxy.addon.client.spider.actions;
 
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.function.Predicate;
+import net.sf.json.JSONObject;
 import org.apache.commons.httpclient.URI;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
@@ -38,6 +42,26 @@ public class ClickElement extends BaseElementAction {
 
     private static final String STATS_PREFIX = "stats.client.spider.action.click";
 
+    private static final List<String> INTERACTIVE_ARIA_ROLES =
+            Arrays.asList(
+                    "button",
+                    "link",
+                    "checkbox",
+                    "radio",
+                    "switch",
+                    "tab",
+                    "menuitem",
+                    "menuitemcheckbox",
+                    "menuitemradio",
+                    "option",
+                    "treeitem",
+                    "combobox",
+                    "listbox",
+                    "slider",
+                    "spinbutton",
+                    "searchbox",
+                    "textbox");
+
     private final Map<String, String> elementData;
     private final String tagName;
 
@@ -77,6 +101,24 @@ private static By getBy(Map<String, String> data) {
             return By.id(id);
         }
 
+        String ariaString = data.get("ariaIdentification");
+        if (StringUtils.isNotBlank(ariaString)) {
+            Map<String, String> ariaAttrs = parseAriaIdentification(ariaString);
+
+            if (!ariaAttrs.isEmpty()) {
+                StringBuilder xpathBuilder = new StringBuilder("//*");
+                for (Map.Entry<String, String> entry : ariaAttrs.entrySet()) {
+                    xpathBuilder
+                            .append("[@")
+                            .append(entry.getKey())
+                            .append("='")
+                            .append(entry.getValue())
+                            .append("']");
+                }
+                return By.xpath(xpathBuilder.toString());
+            }
+        }
+
         String tag = getTagName(data);
         String text = data.get("text");
         if ("INPUT".equalsIgnoreCase(tag)) {
@@ -110,7 +152,24 @@ public static boolean isSupported(Predicate<String> scopeChecker, Map<String, St
                 return "submit".equalsIgnoreCase(type) || "button".equalsIgnoreCase(type);
 
             default:
-                return false;
+                String role = data.get("role");
+                return StringUtils.isNotBlank(role) && INTERACTIVE_ARIA_ROLES.contains(role.toLowerCase());
+        }
+    }
+
+    private static Map<String, String> parseAriaIdentification(String ariaString) {
+        Map<String, String> result = new HashMap<>();
+        if (ariaString == null || ariaString.isEmpty()) {
+            return result;
+        }
+        try {
+            JSONObject json = JSONObject.fromObject(ariaString);
+            for (Object key : json.keySet()) {
+                result.put(key.toString(), json.getString(key.toString()));
+            }
+        } catch (Exception e) {
+            LOGGER.debug("Failed to parse ariaIdentification: {}", ariaString, e);
         }
+        return result;
     }
 }

addOns/client/src/test/java/org/zaproxy/addon/client/internal/ClientSideComponentUnitTest.java

@@ -31,6 +31,7 @@
 import java.util.SortedSet;
 import java.util.TreeSet;
 import java.util.stream.Stream;
+import net.sf.json.JSONObject;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.params.ParameterizedTest;
@@ -460,4 +461,47 @@ void shouldCompareFormIdAsExpected(int first, int second, int expected) {
         // Then
         assertThat(actual, is(equalTo(expected)));
     }
+
+    @Test
+    void shouldSerializeAriaIdentificationToJsonString() {
+        // Given
+        JSONObject json = new JSONObject();
+        json.put("tagName", "DIV");
+        json.put("id", "");
+        json.put("url", EXAMPLE_URL);
+        json.put("type", "nodeAdded");
+
+        JSONObject ariaObj = new JSONObject();
+        ariaObj.put("role", "button");
+        ariaObj.put("aria-label", "Submit");
+        ariaObj.put("aria-pressed", "false");
+        json.put("ariaIdentification", ariaObj);
+
+        // When
+        ClientSideComponent component = new ClientSideComponent(json);
+
+        // Then
+        String ariaString = component.getData().get("ariaIdentification");
+        assertThat(ariaString.contains("role"), is(true));
+        assertThat(ariaString.contains("button"), is(true));
+        assertThat(ariaString.contains("aria-label"), is(true));
+        assertThat(ariaString.contains("Submit"), is(true));
+    }
+
+    @Test
+    void shouldSkipNullAriaIdentification() {
+        // Given
+        JSONObject json = new JSONObject();
+        json.put("tagName", "DIV");
+        json.put("id", "test-id");
+        json.put("url", EXAMPLE_URL);
+        json.put("type", "nodeAdded");
+        // No ariaIdentification
+
+        // When
+        ClientSideComponent component = new ClientSideComponent(json);
+
+        // Then - ariaIdentification should not be in data map
+        assertThat(component.getData().containsKey("ariaIdentification"), is(false));
+    }
 }

addOns/client/src/test/java/org/zaproxy/addon/client/spider/actions/ClickElementUnitTest.java

@@ -0,0 +1,140 @@
+/*
+ * Zed Attack Proxy (ZAP) and its related class files.
+ *
+ * ZAP is an HTTP/HTTPS proxy for assessing web application security.
+ *
+ * Copyright 2025 The ZAP Development Team
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.zaproxy.addon.client.spider.actions;
+
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.hamcrest.Matchers.is;
+
+import java.util.HashMap;
+import java.util.Map;
+import net.sf.json.JSONObject;
+import org.junit.jupiter.api.Test;
+
+/** Unit Tests for {@code ClickElement} */
+class ClickElementUnitTest {
+
+    @Test
+    void shouldSupportElementWithInteractiveAriaRole() {
+        // Given
+        Map<String, String> data = new HashMap<>();
+        data.put("tagName", "DIV");
+        data.put("id", "");
+        data.put("role", "button");
+        JSONObject ariaObj = new JSONObject();
+        ariaObj.put("aria-label", "Submit");
+        data.put("ariaIdentification", ariaObj.toString());
+
+        // When
+        boolean supported = ClickElement.isSupported(href -> true, data);
+
+        // Then
+        assertThat(supported, is(true));
+    }
+
+    @Test
+    void shouldSupportElementWithIdAndRole() {
+        // Given
+        Map<String, String> data = new HashMap<>();
+        data.put("tagName", "DIV");
+        data.put("id", "my-aria-button");
+        data.put("role", "button");
+
+        // When
+        boolean supported = ClickElement.isSupported(href -> true, data);
+
+        // Then
+        assertThat(supported, is(true));
+    }
+
+    @Test
+    void shouldNotSupportElementWithOnlyAriaAttribute() {
+        // Given
+        Map<String, String> data = new HashMap<>();
+        data.put("tagName", "DIV");
+        data.put("id", "");
+        JSONObject ariaObj = new JSONObject();
+        ariaObj.put("aria-pressed", "false");
+        data.put("ariaIdentification", ariaObj.toString());
+
+        // When
+        boolean supported = ClickElement.isSupported(href -> true, data);
+
+        // Then
+        assertThat(supported, is(false));
+    }
+
+    @Test
+    void shouldNotSupportElementWithoutAriaRoleOrAttribute() {
+        // Given
+        Map<String, String> data = new HashMap<>();
+        data.put("tagName", "DIV");
+        data.put("id", "test-id");
+
+        // When
+        boolean supported = ClickElement.isSupported(href -> true, data);
+
+        // Then
+        assertThat(supported, is(false));
+    }
+
+    @Test
+    void shouldSupportStandardButton() {
+        // Given
+        Map<String, String> data = new HashMap<>();
+        data.put("tagName", "BUTTON");
+        data.put("id", "btn-id");
+
+        // When
+        boolean supported = ClickElement.isSupported(href -> true, data);
+
+        // Then
+        assertThat(supported, is(true));
+    }
+
+    @Test
+    void shouldSupportStandardLink() {
+        // Given
+        Map<String, String> data = new HashMap<>();
+        data.put("tagName", "A");
+        data.put("id", "link-id");
+        data.put("href", "https://example.com");
+
+        // When
+        boolean supported = ClickElement.isSupported(href -> true, data);
+
+        // Then
+        assertThat(supported, is(true));
+    }
+
+    @Test
+    void shouldNotSupportLinkOutOfScope() {
+        // Given
+        Map<String, String> data = new HashMap<>();
+        data.put("tagName", "A");
+        data.put("id", "link-id");
+        data.put("href", "https://example.com");
+
+        // When
+        boolean supported = ClickElement.isSupported(href -> false, data);
+
+        // Then
+        assertThat(supported, is(false));
+    }
+}

addOns/dev/src/main/java/org/zaproxy/addon/dev/TestProxyServer.java

@@ -119,9 +119,11 @@ public TestProxyServer(ExtensionDev extension, ExtensionNetwork extensionNetwork
         TestDirectory elStoreDir = new TestDirectory(this, "elements");
         TestDirectory locStoreDir = new TestDirectory(this, "localStorage");
         TestDirectory sessStoreDir = new TestDirectory(this, "sessionStorage");
+        TestDirectory ariaDir = new TestDirectory(this, "aria");
         htmlDir.addDirectory(elStoreDir);
         htmlDir.addDirectory(locStoreDir);
         htmlDir.addDirectory(sessStoreDir);
+        htmlDir.addDirectory(ariaDir);
 
         TestDirectory seqDir = new TestDirectory(this, "seq");
         seqDir.addDirectory(new PerformanceDir(this, "performance"));