const XSS_TESTS = [
'<script>alert("XSS")</script>',
'"><script>alert("XSS")</script>',
'<img src="x" onerror="alert(\'XSS\')">',
'<svg onload="alert(\'XSS\')">',
'javascript:alert("XSS")',
'<a href="javascript:alert(\'XSS\')">点击</a>',
'<iframe src="javascript:alert(\'XSS\')"></iframe>'
];
const CSRF_TESTS = [
`<form action="/transfer" method="POST">
<input type="hidden" name="to" value="attacker">
<input type="hidden" name="amount" value="1000">
<input type="submit" value="点击转账">
</form>`,
`<img src="https://bank.com/transfer?to=attacker&amount=1000" style="display:none;">`
];
class SecurityTester {
constructor() {
this.results = [];
}
async testXSSProtection(inputElement, submitFunction) {
const results = [];
for (const test of XSS_TESTS) {
try {
inputElement.value = '';
inputElement.value = test;
await submitFunction();
const scripts = document.querySelectorAll('script');
const executed = Array.from(scripts).some(script =>
script.textContent.includes('alert')
);
results.push({
test,
passed: !executed,
executed
});
inputElement.value = '';
} catch (error) {
results.push({
test,
passed: false,
error: error.message
});
}
}
this.results.push({
type: 'xss_protection',
tests: results,
summary: {
total: results.length,
passed: results.filter(r => r.passed).length,
failed: results.filter(r => !r.passed).length
}
});
return results;
}
async testCSRFProtection(form) {
const results = [];
for (const test of CSRF_TESTS) {
try {
const iframe = document.createElement('iframe');
iframe.style.display = 'none';
document.body.appendChild(iframe);
iframe.contentDocument.write(test);
iframe.contentDocument.close();
await new Promise(resolve => setTimeout(resolve, 2000));
results.push({
test,
passed: true
});
document.body.removeChild(iframe);
} catch (error) {
results.push({
test,
passed: false,
error: error.message
});
}
}
this.results.push({
type: 'csrf_protection',
tests: results,
summary: {
total: results.length,
passed: results.filter(r => r.passed).length,
failed: results.filter(r => !r.passed).length
}
});
return results;
}
testSecurityConfig() {
const results = [];
const securityHeaders = [
'X-Content-Type-Options',
'X-Frame-Options',
'X-XSS-Protection',
'Content-Security-Policy',
'Strict-Transport-Security'
];
securityHeaders.forEach(header => {
const value = document.defaultView.getComputedStyle(document.documentElement).getPropertyValue(`-x-${header}`);
results.push({
header,
present: !!value,
value
});
});
const cookies = document.cookie.split(';');
const secureCookies = cookies.filter(cookie =>
cookie.trim().includes('Secure') ||
cookie.trim().includes('HttpOnly')
);
results.push({
type: 'cookie_security',
totalCookies: cookies.length,
secureCookies: secureCookies.length
});
this.results.push({
type: 'security_config',
tests: results
});
return results;
}
generateReport() {
const report = {
timestamp: new Date().toISOString(),
results: this.results,
summary: {
totalTests: this.results.reduce((sum, result) => sum + result.tests.length, 0),
passedTests: this.results.reduce((sum, result) =>
sum + (result.summary ? result.summary.passed : 0), 0
),
failedTests: this.results.reduce((sum, result) =>
sum + (result.summary ? result.summary.failed : 0), 0
)
}
};
return this.generateHTMLReport(report);
}
generateHTMLReport(report) {
const html = `
<html>
<head>
<title>安全测试报告</title>
<style>
body { font-family: Arial, sans-serif; margin: 20px; }
.passed { color: green; }
.failed { color: red; }
.test-item { margin: 10px 0; padding: 10px; border: 1px solid #ddd; }
.summary { background: #f0f0f0; padding: 15px; margin: 20px 0; }
</style>
</head>
<body>
<h1>安全测试报告</h1>
<p>测试时间: ${new Date(report.timestamp).toLocaleString()}</p>
<div class="summary">
<h2>测试摘要</h2>
<p>总测试数: ${report.summary.totalTests}</p>
<p>通过测试: <span class="passed">${report.summary.passedTests}</span></p>
<p>失败测试: <span class="failed">${report.summary.failedTests}</span></p>
</div>
<div class="details">
${report.results.map(result => `
<div class="test-item">
<h3>${result.type}</h3>
${result.summary ? `
<p>通过: ${result.summary.passed}, 失败: ${result.summary.failed}</p>
` : ''}
</div>
`).join('')}
</div>
</body>
</html>
`;
return html;
}
}
const securityTester = new SecurityTester();
async function runSecurityTests() {
const inputElement = document.querySelector('input[name="comment"]');
const submitFunction = () => {
document.querySelector('form').submit();
};
await securityTester.testXSSProtection(inputElement, submitFunction);
const form = document.querySelector('form');
await securityTester.testCSRFProtection(form);
securityTester.testSecurityConfig();
const report = securityTester.generateReport();
console.log('安全测试完成', report);
const blob = new Blob([report], { type: 'text/html' });
const url = URL.createObjectURL(blob);
const a = document.createElement('a');
a.href = url;
a.download = 'security-report.html';
a.click();
}
|
微信
