Add 2 files

index.html

@@ -254,7 +254,7 @@
                     </div>
                     
                     <div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-5 gap-4">
-                        <div class="stats-card bg-gray-50 p-4 rounded-lg active-scan">
+                        <div class="stats-card bg-gray-50 p-4 rounded-lg active-san">
                             <div class="flex items-center">
                                 <div class="bg-green-100 rounded-full h-10 w-10 flex items-center justify-center text-green-600 mr-3 flicker">
                                     <i class="fas fa-file-alt"></i>
@@ -319,12 +319,6 @@
                             </div>
                         </div>
                     </div>
-                    
-                    <div class="mt-6 pt-4 border-t border-gray-200">
-                        <button class="bg-green-600 hover:bg-green-700 text-white font-medium py-2 px-4 rounded-md flex items-center justify-center transition">
-                            <i class="fas fa-file-pdf mr-2"></i> Generate Security Report
-                        </button>
-                    </div>
                 </div>
             </div>
             
@@ -588,29 +582,6 @@
                         </div>
                     </div>
                 </div>
-                
-                <!-- Floating Action Bar -->
-                <div class="mt-6 bg-white border border-gray-200 rounded-lg p-4 shadow-sm">
-                    <div class="flex items-center justify-between">
-                        <div class="flex items-center">
-                            <div class="bg-green-100 rounded-full h-10 w-10 flex items-center justify-center text-green-600 mr-3">
-                                <i class="fas fa-robot"></i>
-                            </div>
-                            <div>
-                                <h4 class="text-sm font-medium text-gray-700">SDL Security Guardian</h4>
-                                <p class="text-xs text-gray-500">Continuously analyzing your SDL processes</p>
-                            </div>
-                        </div>
-                        <div class="flex space-x-2">
-                            <button class="bg-gray-100 hover:bg-gray-200 text-gray-800 font-medium py-2 px-4 rounded-md text-sm transition">
-                                <i class="fas fa-pause mr-1"></i> Pause
-                            </button>
-                            <button class="bg-green-600 hover:bg-green-700 text-white font-medium py-2 px-4 rounded-md text-sm transition">
-                                <i class="fas fa-sync-alt mr-1"></i> Rescan
-                            </button>
-                        </div>
-                    </div>
-                </div>
             </div>
             
             <!-- Risk Alerts Section -->
@@ -885,7 +856,7 @@
             
             // 转义所有数据
             const escapedData = {};
-            for (const key in data) {
+            for const key in data) {
                 if (data.hasOwnProperty(key)) {
                     escapedData[key] = escapeHtml(data[key]);
                 }
@@ -1015,7 +986,7 @@
             
             if (isSafeUrl(url)) {
                 element.href = url;
-            } else {
+            else {
                 element.removeAttribute('href');
                 console.warn('Unsafe URL blocked:', url);
             }
@@ -1027,7 +998,7 @@
             
             if (isSafeUrl(src)) {
                 element.src = src;
-            } else {
+            else {
                 element.removeAttribute('src');
                 console.warn('Unsafe image source blocked:', src);
             }
@@ -1039,7 +1010,7 @@
             
             if (isSafeUrl(src)) {
                 element.src = src;
-            } else {
+            else {
                 element.removeAttribute('src');
                 console.warn('Unsafe iframe source blocked:', src);
             }
@@ -1051,7 +1022,7 @@
             
             if (isSafeUrl(action)) {
                 element.action = action;
-            } else {
+            else {
                 element.removeAttribute('action');
                 console.warn('Unsafe form action blocked:', action);
             }
@@ -1064,7 +1035,7 @@
             // 验证类名只包含字母、数字、连字符和下划线
             if (/^[a-zA-Z0-9-_]+$/.test(className)) {
                 element.classList.add(className);
-            } else {
+            else {
                 console.warn('Invalid class name:', className);
             }
         }
@@ -1076,7 +1047,7 @@
             // 验证类名只包含字母、数字、连字符和下划线
             if (/^[a-zA-Z0-9-_]+$/.test(className)) {
                 element.classList.remove(className);
-            } else {
+            else {
                 console.warn('Invalid class name:', className);
             }
         }
@@ -1088,7 +1059,7 @@
             // 验证类名只包含字母、数字、连字符和下划线
             if (/^[a-zA-Z0-9-_]+$/.test(className)) {
                 element.classList.toggle(className);
-            } else {
+            else {
                 console.warn('Invalid class name:', className);
             }
         }
@@ -1100,7 +1071,7 @@
             // 验证属性名只包含字母、数字和连字符
             if (/^[a-zA-Z0-9-]+$/.test(name)) {
                 element.dataset[name] = escapeHtml(value);
-            } else {
+            else {
                 console.warn('Invalid data attribute name:', name);
             }
         }
@@ -1112,7 +1083,7 @@
             // 验证ID只包含字母、数字、连字符和下划线
             if (/^[a-zA-Z0-9-_]+$/.test(id)) {
                 element.id = id;
-            } else {
+            else {
                 console.warn('Invalid ID:', id);
             }
         }
@@ -1171,7 +1142,7 @@
             // 验证属性名只包含字母、数字和连字符
             if (/^[a-zA-Z0-9-]+$/.test(name)) {
                 element.setAttribute(name, escapeHtml(value));
-            } else {
+            else {
                 console.warn('Invalid custom attribute name:', name);
             }
         }
@@ -1189,7 +1160,7 @@
             // 验证事件名只包含字母
             if (/^[a-zA-Z]+$/.test(event)) {
                 element.addEventListener(event, safeEventHandler(handler));
-            } else {
+            else {
                 console.warn('Invalid event name:', event);
             }
         }
@@ -1201,7 +1172,7 @@
             // 验证事件名只包含字母
             if (/^[a-zA-Z]+$/.test(event)) {
                 element.removeEventListener(event, safeEventHandler(handler));
-            } else {
+            else {
                 console.warn('Invalid event name:', event);
             }
         }
@@ -1213,7 +1184,7 @@
             // 验证事件名只包含字母
             if (/^[a-zA-Z]+$/.test(event)) {
                 element[`on${event}`] = safeEventHandler(handler);
-            } else {
+            else {
                 console.warn('Invalid event name:', event);
             }
         }
@@ -1225,7 +1196,7 @@
             // 验证变量名只包含字母、数字和连字符
             if (/^--[a-zA-Z0-9-]+$/.test(name)) {
                 element.style.setProperty(name, escapeHtml(value));
-            } else {
+            else {
                 console.warn('Invalid CSS variable name:', name);
             }
         }
@@ -1885,5 +1856,65 @@
             
             // 验证src是安全URL
             if (!isSafeUrl(src)) {
-                console
+                console.warn('Unsafe noscript embed src:', src);
+                return;
+            }
+            
+            // 查找或创建noscript元素
+            let noscript = document.querySelector('noscript');
+            if (!noscript) {
+                noscript = document.createElement('noscript');
+                document.body.appendChild(noscript);
+            }
+            
+            // 创建embed元素
+            const embed = document.createElement('embed');
+            embed.src = src;
+            embed.type = escapeHtml(type);
+            
+            // 添加到noscript
+            noscript.appendChild(embed);
+        }
+
+        // 安全设置noscript视频
+        function safeSetNoscriptVideo(src, type) {
+            if (!src || !type) return;
+            
+            // 验证src是安全URL
+            if (!isSafeUrl(src)) {
+                console.warn('Unsafe noscript video src:', src);
+                return;
+            }
+            
+            // 查找或创建noscript元素
+            let noscript = document.querySelector('noscript');
+            if (!noscript) {
+                noscript = document.createElement('noscript');
+                document.body.appendChild(noscript);
+            }
+            
+            // 创建video元素
+            const video = document.createElement('video');
+            video.src = src;
+            video.type = escapeHtml(type);
+            
+            // 添加到noscript
+            noscript.appendChild(video);
+        }
+
+        // 安全设置noscript音频
+        function safeSetNoscriptAudio(src, type) {
+            if (!src || !type) return;
+            
+            // 验证src是安全URL
+            if (!isSafeUrl(src)) {
+                console.warn('Unsafe noscript audio src:', src);
+                return;
+            }
+            
+            // 查找或创建noscript元素
+            let noscript = document.querySelector('noscript');
+            if (!noscript) {
+                noscript = document.createElement('noscript');
+               
 </html>

prompts.txt

@@ -1 +1,2 @@
-修复项目中存在的xss问题
+修复项目中存在的xss问题
+删除里面的Generate Security Report和pause/rescan功能模块