[Security:AttackDiscovery:ViewInAIAssistant] The ai assistant settings and actions button is announced wrong #206348
Assignees
Labels
defect-level-1
Critical UX disruption
impact:critical
This issue should be addressed immediately due to a critical level of impact on the product.
Team:Security Generative AI
Security Generative AI
Team: SecuritySolution
Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc.
WCAG A
Comments
bhavyarm
added
the
bug
bhavyarm
removed
bug
bhavyarm
added
Team: SecuritySolution
|
Pinging @elastic/security-solution (Team: SecuritySolution) |
bhavyarm
added
defect-level-1
bhavyarm
changed the title
andrew-goldstein
added a commit
to andrew-goldstein/kibana
that referenced
this issue
Jan 17, 2025
… accessibility (a11y) issues This PR fixes the following Security Assistant accessibility (a11y) issues: - <elastic#206348> - _The ai assistant settings and actions button is announced wrong_ - <elastic#206362> - _Close button on View in AI assistant is missing discernible text_ - <elastic#206875> - _Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled_ ### Details #### [206348](elastic#206348) - The ai assistant settings and actions button is announced wrong This issue was resolved by adding an `aria-label` to the assistant settings context menu. This fix was desk tested using Voiceover, as illustrated by the following screenshots: **Before:**  **After:**  Desk testing: see [206348](elastic#206348) for reproduction steps #### [206362](elastic#206362) - Close button on View in AI assistant is missing discernible text This issue was resolved by adding an `aria-label` to the assistant close button. This fix was desk tested using Axe, as illustrated by the following screenshots: **Before:**  **After:**  Desk testing: see [206362](elastic#206362) for reproduction steps #### [206875](elastic#206875) - Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled Issue [206875](elastic#206875) includes the following statement: > Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets disabled. All it says right now "show anonymized" The first part of the statement above: > Anonymization button doesn't get announced appears to be in reference to when the Anonymization toggle button is disabled. This is unfortunately expected, because screen readers do NOT announce disabled buttons, as described in articles like <https://css-tricks.com/making-disabled-buttons-more-inclusive/> The second part of the statement above: > doesn't have enough context in the tooltip about when it gets enabled is addressed by this PR, though there is still a quirk described in detail below. In this PR, when a conversation does NOT have replacements, a new (different) tooltip is displayed, as illustrated by the before / after screenshots below: **Before:**  _Above: Before the fix, the tooltip for the disabled button reads:_ `Show anonymized` **After:**  _Above: After the fix, the tooltip for the disabled button reads:_ `This conversation does not include anonymized fields` Note that there is still a quirk with the button, which is not addressed by this fix: The current implementation enables the `Show anonymized` button when the conversation has _any_ replacements, regardless of whether or not the replacements are applicable to the rendered conversation. As a result, when replacements are present, but not applicable to the rendered conversation, the user may toggle the enabled button, but will not observe any changes to the rendered conversation. Alternatively, the replacements could be applied to the conversation before rendering to facilitate a comparison: If the original conversation and applied conversation are identical, the anonymization button should be disabled. If they are the different, the button should be enabled. This alternative was NOT implemented in this PR. Desk testing: see [206875](elastic#206875) for reproduction steps
andrew-goldstein
added a commit
that referenced
this issue
Jan 22, 2025
…essibility (a11y) issues (#207122) ### [Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues This PR fixes the following Security Assistant accessibility (a11y) issues: - <#206348> - _The ai assistant settings and actions button is announced wrong_ - <#206362> - _Close button on View in AI assistant is missing discernible text_ - <#206875> - _Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled_ ### Details #### [206348](#206348) - The ai assistant settings and actions button is announced wrong This issue was resolved by adding an `aria-label` to the assistant settings context menu. This fix was desk tested using Voiceover, as illustrated by the following screenshots: **Before:**  **After:**  Desk testing: see [206348](#206348) for reproduction steps #### [206362](#206362) - Close button on View in AI assistant is missing discernible text This issue was resolved by adding an `aria-label` to the assistant close button. This fix was desk tested using Axe, as illustrated by the following screenshots: **Before:**  **After:**  Desk testing: see [206362](#206362) for reproduction steps #### [206875](#206875) - Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled Issue [206875](#206875) includes the following statement: > Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets disabled. All it says right now "show anonymized" The first part of the statement above: > Anonymization button doesn't get announced appears to be in reference to when the Anonymization toggle button is disabled. This is unfortunately expected, because screen readers do NOT announce disabled buttons, as described in articles like <https://css-tricks.com/making-disabled-buttons-more-inclusive/> The second part of the statement above: > doesn't have enough context in the tooltip about when it gets enabled is addressed by this PR, though there is still a quirk described in detail below. In this PR, when a conversation does NOT have replacements, a new (different) tooltip is displayed, as illustrated by the before / after screenshots below: **Before:**  _Above: Before the fix, the tooltip for the disabled button reads:_ `Show anonymized` **After:**  _Above: After the fix, the tooltip for the disabled button reads:_ `This conversation does not include anonymized fields` Note that there is still a quirk with the button, which is not addressed by this fix: The current implementation enables the `Show anonymized` button when the conversation has _any_ replacements, regardless of whether or not the replacements are applicable to the rendered conversation. As a result, when replacements are present, but not applicable to the rendered conversation, the user may toggle the enabled button, but will not observe any changes to the rendered conversation. Alternatively, the replacements could be applied to the conversation before rendering to facilitate a comparison: If the original conversation and applied conversation are identical, the anonymization button should be disabled. If they are the different, the button should be enabled. This alternative was NOT implemented in this PR. Desk testing: see [206875](#206875) for reproduction steps
kibanamachine
pushed a commit
to kibanamachine/kibana
that referenced
this issue
Jan 22, 2025
…essibility (a11y) issues (elastic#207122) ### [Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues This PR fixes the following Security Assistant accessibility (a11y) issues: - <elastic#206348> - _The ai assistant settings and actions button is announced wrong_ - <elastic#206362> - _Close button on View in AI assistant is missing discernible text_ - <elastic#206875> - _Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled_ ### Details #### [206348](elastic#206348) - The ai assistant settings and actions button is announced wrong This issue was resolved by adding an `aria-label` to the assistant settings context menu. This fix was desk tested using Voiceover, as illustrated by the following screenshots: **Before:**  **After:**  Desk testing: see [206348](elastic#206348) for reproduction steps #### [206362](elastic#206362) - Close button on View in AI assistant is missing discernible text This issue was resolved by adding an `aria-label` to the assistant close button. This fix was desk tested using Axe, as illustrated by the following screenshots: **Before:**  **After:**  Desk testing: see [206362](elastic#206362) for reproduction steps #### [206875](elastic#206875) - Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled Issue [206875](elastic#206875) includes the following statement: > Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets disabled. All it says right now "show anonymized" The first part of the statement above: > Anonymization button doesn't get announced appears to be in reference to when the Anonymization toggle button is disabled. This is unfortunately expected, because screen readers do NOT announce disabled buttons, as described in articles like <https://css-tricks.com/making-disabled-buttons-more-inclusive/> The second part of the statement above: > doesn't have enough context in the tooltip about when it gets enabled is addressed by this PR, though there is still a quirk described in detail below. In this PR, when a conversation does NOT have replacements, a new (different) tooltip is displayed, as illustrated by the before / after screenshots below: **Before:**  _Above: Before the fix, the tooltip for the disabled button reads:_ `Show anonymized` **After:**  _Above: After the fix, the tooltip for the disabled button reads:_ `This conversation does not include anonymized fields` Note that there is still a quirk with the button, which is not addressed by this fix: The current implementation enables the `Show anonymized` button when the conversation has _any_ replacements, regardless of whether or not the replacements are applicable to the rendered conversation. As a result, when replacements are present, but not applicable to the rendered conversation, the user may toggle the enabled button, but will not observe any changes to the rendered conversation. Alternatively, the replacements could be applied to the conversation before rendering to facilitate a comparison: If the original conversation and applied conversation are identical, the anonymization button should be disabled. If they are the different, the button should be enabled. This alternative was NOT implemented in this PR. Desk testing: see [206875](elastic#206875) for reproduction steps (cherry picked from commit 0e715b6)
kibanamachine
added a commit
that referenced
this issue
Jan 22, 2025
…nt accessibility (a11y) issues (#207122) (#207895) # Backport This will backport the following commits from `main` to `8.x`: - [[Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues (#207122)](#207122) <!--- Backport version: 9.4.3 --> ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport) <!--BACKPORT [{"author":{"name":"Andrew Macri","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-01-22T18:06:54Z","message":"[Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues (#207122)\n\n### [Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues\r\n\r\nThis PR fixes the following Security Assistant accessibility (a11y) issues:\r\n\r\n- <#206348> - _The ai assistant settings and actions button is announced wrong_\r\n- <#206362> - _Close button on View in AI assistant is missing discernible text_\r\n- <#206875> - _Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled_\r\n\r\n### Details\r\n\r\n#### [206348](#206348) - The ai assistant settings and actions button is announced wrong\r\n\r\nThis issue was resolved by adding an `aria-label` to the assistant settings context menu.\r\n\r\nThis fix was desk tested using Voiceover, as illustrated by the following screenshots:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n**After:**\r\n\r\n\r\n\r\nDesk testing: see [206348](#206348) for reproduction steps\r\n\r\n#### [206362](#206362) - Close button on View in AI assistant is missing discernible text\r\n\r\nThis issue was resolved by adding an `aria-label` to the assistant close button.\r\n\r\nThis fix was desk tested using Axe, as illustrated by the following screenshots:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n**After:**\r\n\r\n\r\n\r\nDesk testing: see [206362](#206362) for reproduction steps\r\n\r\n#### [206875](#206875) - Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled\r\n\r\nIssue [206875](#206875) includes the following statement:\r\n\r\n> Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets disabled. All it says right now \"show anonymized\"\r\n\r\nThe first part of the statement above:\r\n\r\n> Anonymization button doesn't get announced\r\n\r\nappears to be in reference to when the Anonymization toggle button is disabled. This is unfortunately expected, because screen readers do NOT announce disabled buttons, as described in articles like <https://css-tricks.com/making-disabled-buttons-more-inclusive/>\r\n\r\nThe second part of the statement above:\r\n\r\n> doesn't have enough context in the tooltip about when it gets enabled\r\n\r\nis addressed by this PR, though there is still a quirk described in detail below.\r\n\r\nIn this PR, when a conversation does NOT have replacements, a new (different) tooltip is displayed, as illustrated by the before / after screenshots below:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n_Above: Before the fix, the tooltip for the disabled button reads:_ `Show anonymized`\r\n\r\n**After:**\r\n\r\n\r\n\r\n_Above: After the fix, the tooltip for the disabled button reads:_ `This conversation does not include anonymized fields`\r\n\r\nNote that there is still a quirk with the button, which is not addressed by this fix:\r\n\r\nThe current implementation enables the `Show anonymized` button when the conversation has _any_ replacements, regardless of whether or not the replacements are applicable to the rendered conversation. As a result, when replacements are present, but not applicable to the rendered conversation, the user may toggle the enabled button, but will not observe any changes to the rendered conversation.\r\n\r\nAlternatively, the replacements could be applied to the conversation before rendering to facilitate a comparison: If the original conversation and applied conversation are identical, the anonymization button should be disabled. If they are the different, the button should be enabled. This alternative was NOT implemented in this PR.\r\n\r\nDesk testing: see [206875](#206875) for reproduction steps","sha":"0e715b650e402c4bd7d7391e5c009ff64f896ef8","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","v9.0.0","Team: SecuritySolution","Team:Security Generative AI","backport:version","v8.18.0"],"title":"[Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues","number":207122,"url":"https://github.com/elastic/kibana/pull/207122","mergeCommit":{"message":"[Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues (#207122)\n\n### [Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues\r\n\r\nThis PR fixes the following Security Assistant accessibility (a11y) issues:\r\n\r\n- <#206348> - _The ai assistant settings and actions button is announced wrong_\r\n- <#206362> - _Close button on View in AI assistant is missing discernible text_\r\n- <#206875> - _Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled_\r\n\r\n### Details\r\n\r\n#### [206348](#206348) - The ai assistant settings and actions button is announced wrong\r\n\r\nThis issue was resolved by adding an `aria-label` to the assistant settings context menu.\r\n\r\nThis fix was desk tested using Voiceover, as illustrated by the following screenshots:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n**After:**\r\n\r\n\r\n\r\nDesk testing: see [206348](#206348) for reproduction steps\r\n\r\n#### [206362](#206362) - Close button on View in AI assistant is missing discernible text\r\n\r\nThis issue was resolved by adding an `aria-label` to the assistant close button.\r\n\r\nThis fix was desk tested using Axe, as illustrated by the following screenshots:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n**After:**\r\n\r\n\r\n\r\nDesk testing: see [206362](#206362) for reproduction steps\r\n\r\n#### [206875](#206875) - Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled\r\n\r\nIssue [206875](#206875) includes the following statement:\r\n\r\n> Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets disabled. All it says right now \"show anonymized\"\r\n\r\nThe first part of the statement above:\r\n\r\n> Anonymization button doesn't get announced\r\n\r\nappears to be in reference to when the Anonymization toggle button is disabled. This is unfortunately expected, because screen readers do NOT announce disabled buttons, as described in articles like <https://css-tricks.com/making-disabled-buttons-more-inclusive/>\r\n\r\nThe second part of the statement above:\r\n\r\n> doesn't have enough context in the tooltip about when it gets enabled\r\n\r\nis addressed by this PR, though there is still a quirk described in detail below.\r\n\r\nIn this PR, when a conversation does NOT have replacements, a new (different) tooltip is displayed, as illustrated by the before / after screenshots below:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n_Above: Before the fix, the tooltip for the disabled button reads:_ `Show anonymized`\r\n\r\n**After:**\r\n\r\n\r\n\r\n_Above: After the fix, the tooltip for the disabled button reads:_ `This conversation does not include anonymized fields`\r\n\r\nNote that there is still a quirk with the button, which is not addressed by this fix:\r\n\r\nThe current implementation enables the `Show anonymized` button when the conversation has _any_ replacements, regardless of whether or not the replacements are applicable to the rendered conversation. As a result, when replacements are present, but not applicable to the rendered conversation, the user may toggle the enabled button, but will not observe any changes to the rendered conversation.\r\n\r\nAlternatively, the replacements could be applied to the conversation before rendering to facilitate a comparison: If the original conversation and applied conversation are identical, the anonymization button should be disabled. If they are the different, the button should be enabled. This alternative was NOT implemented in this PR.\r\n\r\nDesk testing: see [206875](#206875) for reproduction steps","sha":"0e715b650e402c4bd7d7391e5c009ff64f896ef8"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/207122","number":207122,"mergeCommit":{"message":"[Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues (#207122)\n\n### [Security Solution] [Security Assistant] Fixes Security Assistant accessibility (a11y) issues\r\n\r\nThis PR fixes the following Security Assistant accessibility (a11y) issues:\r\n\r\n- <#206348> - _The ai assistant settings and actions button is announced wrong_\r\n- <#206362> - _Close button on View in AI assistant is missing discernible text_\r\n- <#206875> - _Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled_\r\n\r\n### Details\r\n\r\n#### [206348](#206348) - The ai assistant settings and actions button is announced wrong\r\n\r\nThis issue was resolved by adding an `aria-label` to the assistant settings context menu.\r\n\r\nThis fix was desk tested using Voiceover, as illustrated by the following screenshots:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n**After:**\r\n\r\n\r\n\r\nDesk testing: see [206348](#206348) for reproduction steps\r\n\r\n#### [206362](#206362) - Close button on View in AI assistant is missing discernible text\r\n\r\nThis issue was resolved by adding an `aria-label` to the assistant close button.\r\n\r\nThis fix was desk tested using Axe, as illustrated by the following screenshots:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n**After:**\r\n\r\n\r\n\r\nDesk testing: see [206362](#206362) for reproduction steps\r\n\r\n#### [206875](#206875) - Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets enabled\r\n\r\nIssue [206875](#206875) includes the following statement:\r\n\r\n> Anonymization button doesn't get announced and doesn't have enough context in the tooltip about when it gets disabled. All it says right now \"show anonymized\"\r\n\r\nThe first part of the statement above:\r\n\r\n> Anonymization button doesn't get announced\r\n\r\nappears to be in reference to when the Anonymization toggle button is disabled. This is unfortunately expected, because screen readers do NOT announce disabled buttons, as described in articles like <https://css-tricks.com/making-disabled-buttons-more-inclusive/>\r\n\r\nThe second part of the statement above:\r\n\r\n> doesn't have enough context in the tooltip about when it gets enabled\r\n\r\nis addressed by this PR, though there is still a quirk described in detail below.\r\n\r\nIn this PR, when a conversation does NOT have replacements, a new (different) tooltip is displayed, as illustrated by the before / after screenshots below:\r\n\r\n**Before:**\r\n\r\n\r\n\r\n_Above: Before the fix, the tooltip for the disabled button reads:_ `Show anonymized`\r\n\r\n**After:**\r\n\r\n\r\n\r\n_Above: After the fix, the tooltip for the disabled button reads:_ `This conversation does not include anonymized fields`\r\n\r\nNote that there is still a quirk with the button, which is not addressed by this fix:\r\n\r\nThe current implementation enables the `Show anonymized` button when the conversation has _any_ replacements, regardless of whether or not the replacements are applicable to the rendered conversation. As a result, when replacements are present, but not applicable to the rendered conversation, the user may toggle the enabled button, but will not observe any changes to the rendered conversation.\r\n\r\nAlternatively, the replacements could be applied to the conversation before rendering to facilitate a comparison: If the original conversation and applied conversation are identical, the anonymization button should be disabled. If they are the different, the button should be enabled. This alternative was NOT implemented in this PR.\r\n\r\nDesk testing: see [206875](#206875) for reproduction steps","sha":"0e715b650e402c4bd7d7391e5c009ff64f896ef8"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}] BACKPORT--> Co-authored-by: Andrew Macri <[email protected]>
|
Thanks for finding this issue @bhavyarm! This issue is resolved by the following PRs: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Description
The ai assistant settings and actions button on view in AI assistant panel reads "test" in screen reader. This doesn't give any information to the user about the purpose of the button.
Preconditions
Security -> Attack Discovery -> populated ->view in AI assistant
Steps to reproduce
These are actions possible on that button:
Kibana Version: 8.17.0
OS: OX X
Browser: Chrome latest
WCAG or Vendor Guidance (optional)
Guidelines:
Understanding SC 4.1.2: Name, Role, Value (Level A)(https://www.w3.org/WAI/WCAG22/Understanding/name-role-value.html)
Related to: https://github.com/elastic/kibana-team/issues/1280
The text was updated successfully, but these errors were encountered: