Hugging Face's logo

Spaces:
capta1n
/
project9
Running

App Files Community
capta1n commited on
Commit
36b27b6
·
verified ·
1 Parent(s): 528f8c5

Add 3 files

Browse files
Files changed (3) hide show
  1. README.md +7 -5
  2. index.html +1213 -19
  3. prompts.txt +1 -0
README.md CHANGED
@@ -1,10 +1,12 @@
1
  ---
2
- title: Project9
3
- emoji: 👀
4
- colorFrom: red
5
- colorTo: yellow
6
  sdk: static
7
  pinned: false
 
 
8
  ---
9
 
10
- Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
 
1
  ---
2
+ title: project9
3
+ emoji: 🐳
4
+ colorFrom: gray
5
+ colorTo: gray
6
  sdk: static
7
  pinned: false
8
+ tags:
9
+ - deepsite
10
  ---
11
 
12
+ Check out the configuration reference at https://huggingface.co/docs/hub/spaces-config-reference
index.html CHANGED
@@ -1,19 +1,1213 @@
1
- <!doctype html>
2
- <html>
3
- <head>
4
- <meta charset="utf-8" />
5
- <meta name="viewport" content="width=device-width" />
6
- <title>My static Space</title>
7
- <link rel="stylesheet" href="style.css" />
8
- </head>
9
- <body>
10
- <div class="card">
11
- <h1>Welcome to your static Space!</h1>
12
- <p>You can modify this app directly by editing <i>index.html</i> in the Files and versions tab.</p>
13
- <p>
14
- Also don't forget to check the
15
- <a href="https://huggingface.co/docs/hub/spaces" target="_blank">Spaces documentation</a>.
16
- </p>
17
- </div>
18
- </body>
19
- </html>
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1
+ <!DOCTYPE html>
2
+ <html lang="zh-CN">
3
+ <head>
4
+ <meta charset="UTF-8">
5
+ <meta name="viewport" content="width=device-width, initial-scale=1.0">
6
+ <title>AI SDL 数字分身 - 风险项目详情</title>
7
+ <script src="https://cdn.tailwindcss.com"></script>
8
+ <script src="https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js"></script>
9
+ <script src="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/highlight.min.js"></script>
10
+ <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/highlight.js/11.7.0/styles/atom-one-dark.min.css">
11
+ <style>
12
+ .risk-critical { background-color: #fee2e2; border-left: 4px solid #ef4444; }
13
+ .risk-high { background-color: #ffedd5; border-left: 4px solid #f97316; }
14
+ .risk-medium { background-color: #fef9c3; border-left: 4px solid #eab308; }
15
+ .risk-low { background-color: #ecfdf5; border-left: 4px solid #10b981; }
16
+
17
+ .content-container {
18
+ display: grid;
19
+ grid-template-columns: 1fr 1fr;
20
+ gap: 1rem;
21
+ height: calc(100vh - 200px);
22
+ overflow: hidden;
23
+ }
24
+
25
+ .content-panel {
26
+ overflow-y: auto;
27
+ padding: 1rem;
28
+ border: 1px solid #e5e7eb;
29
+ border-radius: 0.5rem;
30
+ height: 100%;
31
+ }
32
+
33
+ .code-block {
34
+ position: relative;
35
+ }
36
+
37
+ .code-block pre {
38
+ margin: 0;
39
+ border-radius: 0.375rem;
40
+ }
41
+
42
+ .vulnerable-line {
43
+ background-color: #fee2e2;
44
+ display: inline-block;
45
+ width: 100%;
46
+ }
47
+
48
+ .fix-suggestion {
49
+ position: absolute;
50
+ top: 100%;
51
+ left: 0;
52
+ width: 100%;
53
+ background: white;
54
+ border: 1px solid #e5e7eb;
55
+ border-radius: 0.375rem;
56
+ padding: 1rem;
57
+ box-shadow: 0 4px 6px -1px rgba(0, 0, 0, 0.1);
58
+ z-index: 10;
59
+ display: none;
60
+ }
61
+
62
+ .mermaid {
63
+ width: 100%;
64
+ min-height: 300px;
65
+ background: white;
66
+ padding: 1rem;
67
+ border-radius: 0.5rem;
68
+ border: 1px solid #e5e7eb;
69
+ margin: 1rem 0;
70
+ }
71
+
72
+ .risk-marker {
73
+ fill: #ef4444;
74
+ stroke: #ef4444;
75
+ }
76
+
77
+ .highlight-risk {
78
+ background-color: #fee2e2;
79
+ padding: 0.1rem 0.2rem;
80
+ border-radius: 0.2rem;
81
+ }
82
+
83
+ .tab-content {
84
+ display: none;
85
+ }
86
+
87
+ .tab-content.active {
88
+ display: block;
89
+ }
90
+
91
+ .nav-tabs .active {
92
+ border-bottom: 2px solid #3b82f6;
93
+ color: #3b82f6;
94
+ font-weight: 600;
95
+ }
96
+
97
+ .release-decision {
98
+ border: 2px solid #ef4444;
99
+ background-color: #fef2f2;
100
+ border-radius: 0.5rem;
101
+ padding: 1.5rem;
102
+ }
103
+
104
+ .vulnerability-item {
105
+ border-bottom: 1px solid #e5e7eb;
106
+ padding: 1rem 0;
107
+ }
108
+ </style>
109
+ </head>
110
+ <body class="bg-gray-50">
111
+ <div class="container mx-auto px-4 py-8">
112
+ <!-- Header -->
113
+ <div class="flex justify-between items-center mb-8">
114
+ <div>
115
+ <h1 class="text-3xl font-bold text-gray-800">AI SDL 数字分身</h1>
116
+ <p class="text-gray-600">风险项目详情分析</p>
117
+ </div>
118
+ <div class="flex items-center space-x-4">
119
+ <div class="relative">
120
+ <input type="text" placeholder="搜索项目..." class="pl-10 pr-4 py-2 border rounded-lg focus:outline-none focus:ring-2 focus:ring-blue-500">
121
+ <svg class="w-5 h-5 text-gray-400 absolute left-3 top-2.5" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
122
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z"></path>
123
+ </svg>
124
+ </div>
125
+ <button class="bg-blue-600 text-white px-4 py-2 rounded-lg hover:bg-blue-700 transition-colors">
126
+ 返回项目列表
127
+ </button>
128
+ </div>
129
+ </div>
130
+
131
+ <!-- Project Overview -->
132
+ <div class="bg-white rounded-xl shadow-md p-6 mb-8">
133
+ <div class="flex justify-between items-start mb-6">
134
+ <div>
135
+ <h2 class="text-2xl font-bold text-gray-800">项目名称: 支付宝国补项目</h2>
136
+ <div class="flex items-center mt-2">
137
+ <span class="bg-red-100 text-red-800 text-xs font-medium px-2.5 py-0.5 rounded-full">高风险</span>
138
+ <span class="ml-2 text-gray-600">最后更新: 2023-06-15 14:30</span>
139
+ </div>
140
+ </div>
141
+ <div class="flex space-x-2">
142
+ <button class="flex items-center text-blue-600 hover:text-blue-800">
143
+ <svg class="w-5 h-5 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
144
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M15.172 7l-6.586 6.586a2 2 0 102.828 2.828l6.414-6.586a4 4 0 00-5.656-5.656l-6.415 6.585a6 6 0 108.486 8.486L20.5 13"></path>
145
+ </svg>
146
+ 导出报告
147
+ </button>
148
+ <button class="flex items-center text-blue-600 hover:text-blue-800">
149
+ <svg class="w-5 h-5 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
150
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 5v.01M12 12v.01M12 19v.01M12 6a1 1 0 110-2 1 1 0 010 2zm0 7a1 1 0 110-2 1 1 0 010 2zm0 7a1 1 0 110-2 1 1 0 010 2z"></path>
151
+ </svg>
152
+ 更多操作
153
+ </button>
154
+ </div>
155
+ </div>
156
+
157
+ <div class="grid grid-cols-3 gap-6 mb-6">
158
+ <div class="bg-gray-50 p-4 rounded-lg">
159
+ <h3 class="font-medium text-gray-700 mb-2">项目参与人</h3>
160
+ <div class="flex flex-wrap gap-2">
161
+ <span class="bg-blue-100 text-blue-800 text-xs font-medium px-2.5 py-0.5 rounded">形知</span>
162
+ <span class="bg-blue-100 text-blue-800 text-xs font-medium px-2.5 py-0.5 rounded">铸梦</span>
163
+ <span class="bg-blue-100 text-blue-800 text-xs font-medium px-2.5 py-0.5 rounded">洞悉</span>
164
+ <span class="bg-blue-100 text-blue-800 text-xs font-medium px-2.5 py-0.5 rounded">隐迹</span>
165
+ <span class="bg-blue-100 text-blue-800 text-xs font-medium px-2.5 py-0.5 rounded">晨熙</span>
166
+ </div>
167
+ </div>
168
+ <div class="bg-gray-50 p-4 rounded-lg">
169
+ <h3 class="font-medium text-gray-700 mb-2">风险状态</h3>
170
+ <div class="flex items-center">
171
+ <div class="w-full bg-gray-200 rounded-full h-2.5">
172
+ <div class="bg-red-600 h-2.5 rounded-full" style="width: 65%"></div>
173
+ </div>
174
+ <span class="ml-2 text-sm font-medium text-gray-700">65% 修复</span>
175
+ </div>
176
+ </div>
177
+ <div class="bg-gray-50 p-4 rounded-lg">
178
+ <h3 class="font-medium text-gray-700 mb-2">风险分布</h3>
179
+ <div class="flex space-x-4">
180
+ <div class="flex items-center">
181
+ <div class="w-3 h-3 rounded-full bg-red-500 mr-1"></div>
182
+ <span class="text-sm">需求 2</span>
183
+ </div>
184
+ <div class="flex items-center">
185
+ <div class="w-3 h-3 rounded-full bg-orange-500 mr-1"></div>
186
+ <span class="text-sm">代码 3</span>
187
+ </div>
188
+ <div class="flex items-center">
189
+ <div class="w-3 h-3 rounded-full bg-yellow-500 mr-1"></div>
190
+ <span class="text-sm">测试 1</span>
191
+ </div>
192
+ </div>
193
+ </div>
194
+ </div>
195
+
196
+ <!-- Added Application Info -->
197
+ <div class="grid grid-cols-2 gap-6 mb-6">
198
+ <div class="bg-gray-50 p-4 rounded-lg">
199
+ <h3 class="font-medium text-gray-700 mb-2">应用名称</h3>
200
+ <p class="font-mono text-sm">soc-AI-SDL</p>
201
+ </div>
202
+ <div class="bg-gray-50 p-4 rounded-lg">
203
+ <h3 class="font-medium text-gray-700 mb-2">代码分支地址</h3>
204
+ <p class="font-mono text-sm break-all">git@gitlab.alibaba-inc.com:soc-AI-SDL/soc-AI-SDL.git::/feature/20250414_24651171_tmp_1_stage_1</p>
205
+ </div>
206
+ </div>
207
+
208
+ <div class="mb-6">
209
+ <h3 class="font-medium text-gray-700 mb-2">风险概述</h3>
210
+ <div class="space-y-3">
211
+ <div class="risk-critical p-3 rounded">
212
+ <div class="flex justify-between items-center">
213
+ <span class="font-medium">需求环节: 越权访问风险</span>
214
+ <span class="text-sm bg-red-600 text-white px-2 py-0.5 rounded-full">未修复</span>
215
+ </div>
216
+ <p class="text-sm mt-1">用户权限校验不足，可能导致越权访问敏感数据</p>
217
+ </div>
218
+ <div class="risk-high p-3 rounded">
219
+ <div class="flex justify-between items-center">
220
+ <span class="font-medium">代码环节: SQL注入风险</span>
221
+ <span class="text-sm bg-orange-500 text-white px-2 py-0.5 rounded-full">修复中</span>
222
+ </div>
223
+ <p class="text-sm mt-1">OrderService.java 中直接拼接SQL语句，存在注入风险</p>
224
+ </div>
225
+ <div class="risk-medium p-3 rounded">
226
+ <div class="flex justify-between items-center">
227
+ <span class="font-medium">安全测试: 水平越权</span>
228
+ <span class="text-sm bg-yellow-500 text-white px-2 py-0.5 rounded-full">已修复</span>
229
+ </div>
230
+ <p class="text-sm mt-1">通过修改orderid参数可访问他人订单信息</p>
231
+ </div>
232
+ </div>
233
+ </div>
234
+ </div>
235
+
236
+ <!-- Navigation Tabs -->
237
+ <div class="border-b border-gray-200 mb-6">
238
+ <nav class="flex space-x-8 nav-tabs" aria-label="Tabs">
239
+ <button onclick="switchTab('requirements')" class="py-4 px-1 active inline-flex items-center text-sm font-medium">
240
+ <svg class="w-5 h-5 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
241
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12h6m-6 4h6m2 5H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z"></path>
242
+ </svg>
243
+ 需求分析
244
+ </button>
245
+ <button onclick="switchTab('code')" class="py-4 px-1 inline-flex items-center text-sm font-medium">
246
+ <svg class="w-5 h-5 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
247
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M10 20l4-16m4 4l4 4-4 4M6 16l-4-4 4-4"></path>
248
+ </svg>
249
+ 代码分析
250
+ </button>
251
+ <button onclick="switchTab('testing')" class="py-4 px-1 inline-flex items-center text-sm font-medium">
252
+ <svg class="w-5 h-5 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
253
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19.428 15.428a2 2 0 00-1.022-.547l-2.387-.477a6 6 0 00-3.86.494l-.318.158a6 6 0 01-3.86.494L6.05 15.21a2 2 0 00-1.806.547M8 4h8l-1 1v5.172a2 2 0 00.586 1.414l5 5c1.26 1.26.367 3.414-1.415 3.414H4.828c-1.782 0-2.674-2.154-1.414-3.414l5-5A2 2 0 009 10.172V5L8 4z"></path>
254
+ </svg>
255
+ 安全测试
256
+ </button>
257
+ <button onclick="switchTab('release')" class="py-4 px-1 inline-flex items-center text-sm font-medium">
258
+ <svg class="w-5 h-5 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
259
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 12h14M5 12a2 2 0 01-2-2V6a2 2 0 012-2h14a2 2 0 012 2v4a2 2 0 01-2 2M5 12a2 2 0 00-2 2v4a2 2 0 002 2h14a2 2 0 002-2v-4a2 2 0 00-2-2m-2-4h.01M17 16h.01"></path>
260
+ </svg>
261
+ 发布检查
262
+ </button>
263
+ <button onclick="switchTab('production')" class="py-4 px-1 inline-flex items-center text-sm font-medium">
264
+ <svg class="w-5 h-5 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
265
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M9 12l2 2 4-4m5.618-4.016A11.955 11.955 0 0112 2.944a11.955 11.955 0 01-8.618 3.04A12.02 12.02 0 003 9c0 5.591 3.824 10.29 9 11.622 5.176-1.332 9-6.03 9-11.622 0-1.042-.133-2.052-.382-3.016z"></path>
266
+ </svg>
267
+ 线上监控
268
+ </button>
269
+ </nav>
270
+ </div>
271
+
272
+ <!-- Tab Contents -->
273
+ <div>
274
+ <!-- Requirements Tab -->
275
+ <div id="requirements" class="tab-content active">
276
+ <div class="content-container">
277
+ <!-- Left Panel - Requirements Content -->
278
+ <div class="content-panel bg-white">
279
+ <h3 class="text-lg font-medium text-gray-800 mb-4">需求文档内容</h3>
280
+ <div class="prose max-w-none">
281
+ <p>支付宝国补项目旨在为政府补贴发放提供数字化解决方案，通过支付宝平台实现补贴的精准发放和核销。</p>
282
+
283
+ <h4>1. 项目背景</h4>
284
+ <p>随着政府数字化转型的推进，各类补贴发放需要更加高效、透明和可追溯的解决方案...</p>
285
+
286
+ <h4>2. 功能需求</h4>
287
+ <p class="highlight-risk">2.1 用户认证与授权</p>
288
+ <p>系统需要支持多级用户角色，包括普通用户、商户用户、政府管理员等。用户通过支付宝账号登录后，系统应根据用户类型显示不同功能模块。</p>
289
+
290
+ <p class="highlight-risk">2.2 补贴申请与审批</p>
291
+ <p>用户可以在线提交补贴申请，上传相关证明材料。政府管理员后台可以审批这些申请，审批通过后补贴金额将直接发放到用户支付宝账户。</p>
292
+
293
+ <p>2.3 补贴核销</p>
294
+ <p>用户在指定商户消费时，可以使用补贴金额进行支付。商户通过扫码枪扫描用户付款码完成交易...</p>
295
+
296
+ <h4>3. 技术架构</h4>
297
+ <div class="mermaid">
298
+ graph TD
299
+ A[用户端] -->|HTTPS| B(API Gateway)
300
+ B --> C[认证服务]
301
+ B --> D[补贴服务]
302
+ B --> E[支付服务]
303
+ D --> F[(MySQL)]
304
+ E --> G[(Redis)]
305
+ C --> H[(LDAP)]
306
+ style D stroke:#ef4444,stroke-width:2px
307
+ style C stroke:#ef4444,stroke-width:2px
308
+ </div>
309
+
310
+ <h4>4. 数据安全</h4>
311
+ <p>所有敏感数据传输必须加密，存储数据需要脱敏处理...</p>
312
+
313
+ <p>5. 性能要求</p>
314
+ <p>系统需要支持每秒1000+的并发请求，响应时间在500ms以内...</p>
315
+ </div>
316
+ </div>
317
+
318
+ <!-- Right Panel - Security Analysis -->
319
+ <div class="content-panel bg-white">
320
+ <h3 class="text-lg font-medium text-gray-800 mb-4">安全分析结果</h3>
321
+
322
+ <div class="mb-6">
323
+ <h4 class="font-medium text-gray-700 mb-2">STRIDE 威胁建模</h4>
324
+ <div class="mermaid">
325
+ graph LR
326
+ subgraph 支付宝国补系统
327
+ A[用户认证] -->|Spoofing| B(冒充管理员)
328
+ A -->|Tampering| C(篡改认证令牌)
329
+ D[补贴审批] -->|Information Disclosure| E(查看他人申请)
330
+ D -->|Elevation of Privilege| F(普通用户执行审批)
331
+ end
332
+ style B fill:#fee2e2,stroke:#ef4444
333
+ style E fill:#fee2e2,stroke:#ef4444
334
+ style F fill:#fee2e2,stroke:#ef4444
335
+ </div>
336
+ </div>
337
+
338
+ <div class="space-y-4">
339
+ <div class="risk-critical p-4 rounded-lg">
340
+ <h4 class="font-medium mb-2">风险点: 用户权限控制不足</h4>
341
+ <div class="grid grid-cols-2 gap-2 text-sm">
342
+ <div>
343
+ <p class="text-gray-600">业务场景:</p>
344
+ <p>用户认证与授权功能</p>
345
+ </div>
346
+ <div>
347
+ <p class="text-gray-600">风险类型:</p>
348
+ <p>越权访问(EoP)</p>
349
+ </div>
350
+ <div>
351
+ <p class="text-gray-600">风险点:</p>
352
+ <p>角色权限划分不明确</p>
353
+ </div>
354
+ <div>
355
+ <p class="text-gray-600">严重程度:</p>
356
+ <p>高危</p>
357
+ </div>
358
+ </div>
359
+ <div class="mt-2">
360
+ <p class="text-gray-600">整改建议:</p>
361
+ <p>1. 明确定义各角色权限边界<br>2. 实现基于RBAC的权限控制系统<br>3. 所有敏感操作增加权限校验</p>
362
+ </div>
363
+ <button onclick="highlightText('2.1 用户认证与授权')" class="mt-2 text-blue-600 text-sm hover:underline">
364
+ 定位到需求文档
365
+ </button>
366
+ </div>
367
+
368
+ <div class="risk-high p-4 rounded-lg">
369
+ <h4 class="font-medium mb-2">风险点: 敏感信息泄露</h4>
370
+ <div class="grid grid-cols-2 gap-2 text-sm">
371
+ <div>
372
+ <p class="text-gray-600">业务场景:</p>
373
+ <p>补贴申请与审批</p>
374
+ </div>
375
+ <div>
376
+ <p class="text-gray-600">风险类型:</p>
377
+ <p>信息泄露(ID)</p>
378
+ </div>
379
+ <div>
380
+ <p class="text-gray-600">风险点:</p>
381
+ <p>审批流程可查看他人申请</p>
382
+ </div>
383
+ <div>
384
+ <p class="text-gray-600">严重程度:</p>
385
+ <p中高危</p>
386
+ </div>
387
+ </div>
388
+ <div class="mt-2">
389
+ <p class="text-gray-600">整改建议:</p>
390
+ <p>1. 实现数据级权限控制<br>2. 审批列表过滤只显示有权限的数据<br>3. 敏感字段脱敏处理</p>
391
+ </div>
392
+ <button onclick="highlightText('2.2 补贴申请与审批')" class="mt-2 text-blue-600 text-sm hover:underline">
393
+ 定位到需求文档
394
+ </button>
395
+ </div>
396
+ </div>
397
+ </div>
398
+ </div>
399
+ </div>
400
+
401
+ <!-- Code Tab -->
402
+ <div id="code" class="tab-content">
403
+ <div class="content-container">
404
+ <!-- Left Panel - Code Content -->
405
+ <div class="content-panel bg-white">
406
+ <div class="flex justify-between items-center mb-4">
407
+ <h3 class="text-lg font-medium text-gray-800">代码内容</h3>
408
+ <div class="flex space-x-2">
409
+ <select class="border rounded px-2 py-1 text-sm">
410
+ <option>OrderService.java</option>
411
+ <option>UserService.java</option>
412
+ <option>AuthController.java</option>
413
+ </select>
414
+ <button class="bg-blue-100 text-blue-800 px-3 py-1 rounded text-sm">
415
+ 全部展开
416
+ </button>
417
+ </div>
418
+ </div>
419
+
420
+ <div class="code-block">
421
+ <pre><code class="language-java">package com.alipay.subsidy.service;
422
+
423
+ import java.sql.*;
424
+ import java.util.List;
425
+
426
+ public class OrderService {
427
+ private Connection conn;
428
+
429
+ public OrderService() {
430
+ try {
431
+ conn = DriverManager.getConnection(
432
+ "jdbc:mysql://localhost:3306/subsidy",
433
+ "root",
434
+ "password"
435
+ );
436
+ } catch (SQLException e) {
437
+ e.printStackTrace();
438
+ }
439
+ }
440
+
441
+ public List&lt;Order&gt; getOrdersByUserId(String userId) {
442
+ List&lt;Order&gt; orders = new ArrayList&lt;&gt;();
443
+ try {
444
+ // 漏洞点: SQL注入风险
445
+ <span id="vuln-line-1" class="vulnerable-line">Statement stmt = conn.createStatement();
446
+ ResultSet rs = stmt.executeQuery("SELECT * FROM orders WHERE user_id = '" + userId + "'");</span>
447
+
448
+ while (rs.next()) {
449
+ Order order = new Order();
450
+ order.setId(rs.getString("id"));
451
+ order.setAmount(rs.getBigDecimal("amount"));
452
+ orders.add(order);
453
+ }
454
+ } catch (SQLException e) {
455
+ e.printStackTrace();
456
+ }
457
+ return orders;
458
+ }
459
+
460
+ public Order getOrderById(String orderId) {
461
+ Order order = null;
462
+ try {
463
+ // 漏洞点: 越权访问风险
464
+ <span id="vuln-line-2" class="vulnerable-line">Statement stmt = conn.createStatement();
465
+ ResultSet rs = stmt.executeQuery("SELECT * FROM orders WHERE id = '" + orderId + "'");</span>
466
+
467
+ if (rs.next()) {
468
+ order = new Order();
469
+ order.setId(rs.getString("id"));
470
+ order.setUserId(rs.getString("user_id"));
471
+ order.setAmount(rs.getBigDecimal("amount"));
472
+ }
473
+ } catch (SQLException e) {
474
+ e.printStackTrace();
475
+ }
476
+ return order;
477
+ }
478
+
479
+ public void updateOrderStatus(String orderId, String status) {
480
+ try {
481
+ // 漏洞点: 缺乏权限校验
482
+ <span id="vuln-line-3" class="vulnerable-line">PreparedStatement pstmt = conn.prepareStatement(
483
+ "UPDATE orders SET status = ? WHERE id = ?"
484
+ );
485
+ pstmt.setString(1, status);
486
+ pstmt.setString(2, orderId);
487
+ pstmt.executeUpdate();</span>
488
+ } catch (SQLException e) {
489
+ e.printStackTrace();
490
+ }
491
+ }
492
+ }</code></pre>
493
+ </div>
494
+ </div>
495
+
496
+ <!-- Right Panel - Security Analysis -->
497
+ <div class="content-panel bg-white">
498
+ <h3 class="text-lg font-medium text-gray-800 mb-4">安全分析结果</h3>
499
+
500
+ <div class="space-y-4">
501
+ <div class="risk-critical p-4 rounded-lg">
502
+ <div class="flex justify-between items-start">
503
+ <div>
504
+ <h4 class="font-medium mb-1">SQL注入漏洞</h4>
505
+ <p class="text-sm text-gray-600">OrderService.java - getOrdersByUserId()</p>
506
+ </div>
507
+ <span class="bg-red-600 text-white text-xs px-2 py-0.5 rounded-full">高危</span>
508
+ </div>
509
+
510
+ <div class="mt-2 grid grid-cols-2 gap-2 text-sm">
511
+ <div>
512
+ <p class="text-gray-600">漏洞类型:</p>
513
+ <p>SQL注入</p>
514
+ </div>
515
+ <div>
516
+ <p class="text-gray-600">风险接口:</p>
517
+ <p>/api/orders?userId={userId}</p>
518
+ </div>
519
+ </div>
520
+
521
+ <div class="mt-2">
522
+ <p class="text-gray-600">漏洞描述:</p>
523
+ <p class="text-sm">直接拼接用户输入的userId到SQL查询中，攻击者可以构造恶意输入执行任意SQL命令。</p>
524
+ </div>
525
+
526
+ <div class="mt-2">
527
+ <p class="text-gray-600">漏洞代码:</p>
528
+ <button onclick="highlightCode('vuln-line-1')" class="text-blue-600 text-sm hover:underline">
529
+ 定位到代码
530
+ </button>
531
+ </div>
532
+
533
+ <div class="mt-2">
534
+ <p class="text-gray-600">修复建议:</p>
535
+ <pre class="bg-gray-100 p-2 rounded text-sm"><code>// 使用预编译语句修复
536
+ PreparedStatement pstmt = conn.prepareStatement(
537
+ "SELECT * FROM orders WHERE user_id = ?"
538
+ );
539
+ pstmt.setString(1, userId);
540
+ ResultSet rs = pstmt.executeQuery();</code></pre>
541
+ </div>
542
+ </div>
543
+
544
+ <div class="risk-high p-4 rounded-lg">
545
+ <div class="flex justify-between items-start">
546
+ <div>
547
+ <h4 class="font-medium mb-1">越权访问漏洞</h4>
548
+ <p class="text-sm text-gray-600">OrderService.java - getOrderById()</p>
549
+ </div>
550
+ <span class="bg-orange-500 text-white text-xs px-2 py-0.5 rounded-full">中高危</span>
551
+ </div>
552
+
553
+ <div class="mt-2 grid grid-cols-2 gap-2 text-sm">
554
+ <div>
555
+ <p class="text-gray-600">漏洞类型:</p>
556
+ <p>水平越权</p>
557
+ </div>
558
+ <div>
559
+ <p class="text-gray-600">风险接口:</p>
560
+ <p>/api/orders/{orderId}</p>
561
+ </div>
562
+ </div>
563
+
564
+ <div class="mt-2">
565
+ <p class="text-gray-600">漏洞描述:</p>
566
+ <p class="text-sm">接口直接根据orderId查询订单信息，没有校验当前用户是否有权限访问该订单。</p>
567
+ </div>
568
+
569
+ <div class="mt-2">
570
+ <p class="text-gray-600">漏洞代码:</p>
571
+ <button onclick="highlightCode('vuln-line-2')" class="text-blue-600 text-sm hover:underline">
572
+ 定位到代码
573
+ </button>
574
+ </div>
575
+
576
+ <div class="mt-2">
577
+ <p class="text-gray-600">修复建议:</p>
578
+ <pre class="bg-gray-100 p-2 rounded text-sm"><code>// 增加权限校验
579
+ Order order = getOrderById(orderId);
580
+ if (order != null && !order.getUserId().equals(currentUserId)) {
581
+ throw new AccessDeniedException("无权访问该订单");
582
+ }
583
+ return order;</code></pre>
584
+ </div>
585
+ </div>
586
+ </div>
587
+ </div>
588
+ </div>
589
+ </div>
590
+
591
+ <!-- Security Testing Tab -->
592
+ <div id="testing" class="tab-content">
593
+ <div class="content-container">
594
+ <!-- Left Panel - Testing Content -->
595
+ <div class="content-panel bg-white">
596
+ <h3 class="text-lg font-medium text-gray-800 mb-4">测试用例与Payload</h3>
597
+
598
+ <div class="space-y-6">
599
+ <div>
600
+ <h4 class="font-medium mb-2">测试接口: /api/orders/{orderId</h4>
601
+ <div class="code-block">
602
+ <pre><code class="language-http">GET /api/orders/1001 HTTP/1.1
603
+ Host: api.alipay-subsidy.com
604
+ Authorization: Bearer user1_token
605
+ Accept: application/json</code></pre>
606
+ </div>
607
+
608
+ <div class="mt-2">
609
+ <h5 class="font-medium text-sm mb-1">测试Payload:</h5>
610
+ <div class="code-block">
611
+ <pre><code class="language-http"># 修改orderId尝试访问他人订单
612
+ GET /api/orders/1002 HTTP/1.1
613
+ Host: api.alipay-subsidy.com
614
+ Authorization: Bearer user1_token
615
+ Accept: application/json
616
+
617
+ GET /api/orders/1003 HTTP/1.1
618
+ Host: api.alipay-subsidy.com
619
+ Authorization: Bearer user1_token
620
+ Accept: application/json</code></pre>
621
+ </div>
622
+ </div>
623
+
624
+ <div class="mt-2">
625
+ <h5 class="font-medium text-sm mb-1">测试结果:</h5>
626
+ <div class="code-block">
627
+ <pre><code class="language-json">{
628
+ "id": "1002",
629
+ "userId": "user2",
630
+ "amount": 150.00,
631
+ "items": [
632
+ {"name": "商品A", "price": 50.00},
633
+ {"name": "商品B", "price": 100.00}
634
+ ]
635
+ }</code></pre>
636
+ </div>
637
+ </div>
638
+ </div>
639
+
640
+ <div>
641
+ <h4 class="font-medium mb-2">测试接口: /api/orders?userId={userId}</h4>
642
+ <div class="code-block">
643
+ <pre><code class="language-http">GET /api/orders?userId=user1 HTTP/1.1
644
+ Host: api.alipay-subsidy.com
645
+ Authorization: Bearer user1_token
646
+ Accept: application/json</code></pre>
647
+ </div>
648
+
649
+ <div class="mt-2">
650
+ <h5 class="font-medium text-sm mb-1">SQL注入Payload:</h5>
651
+ <div class="code-block">
652
+ <pre><code class="language-http"># 基础注入测试
653
+ GET /api/orders?userId=user1' OR '1'='1 HTTP/1.1
654
+ Host: api.alipay-subsidy.com
655
+ Authorization: Bearer user1_token
656
+ Accept: application/json
657
+
658
+ # 联合查询获取其他表数据
659
+ GET /api/orders?userId=user1' UNION SELECT 1,username,password FROM users-- HTTP/1.1
660
+ Host: api.alipay-subsidy.com
661
+ Authorization: Bearer user1_token
662
+ Accept: application/json</code></pre>
663
+ </div>
664
+ </div>
665
+
666
+ <div class="mt-2">
667
+ <h5 class="font-medium text-sm mb-1">测试结果:</h5>
668
+ <div class="code-block">
669
+ <pre><code class="language-json">{
670
+ "error": "Internal Server Error",
671
+ "status": 500,
672
+ "message": "Error executing SQL query"
673
+ }</code></pre>
674
+ </div>
675
+ </div>
676
+ </div>
677
+ </div>
678
+ </div>
679
+
680
+ <!-- Right Panel - Security Analysis -->
681
+ <div class="content-panel bg-white">
682
+ <h3 class="text-lg font-medium text-gray-800 mb-4">安全测试分析</h3>
683
+
684
+ <div class="space-y-4">
685
+ <div class="risk-high p-4 rounded-lg">
686
+ <div class="flex justify-between items-start">
687
+ <div>
688
+ <h4 class="font-medium mb-1">水平越权漏洞</h4>
689
+ <p class="text-sm text-gray-600">订单信息越权访问</p>
690
+ </div>
691
+ <span class="bg-orange-500 text-white text-xs px-2 py-0.5 rounded-full">中高危</span>
692
+ </div>
693
+
694
+ <div class="mt-2">
695
+ <p class="text-gray-600">风险接口:</p>
696
+ <p class="text-sm font-mono">/api/orders/{orderId}</p>
697
+ </div>
698
+
699
+ <div class="mt-2">
700
+ <p class="text-gray-600">风险描述:</p>
701
+ <p class="text-sm">攻击者可以通过修改orderId参数访问其他用户的订单信息，导致敏感数据泄露。</p>
702
+ </div>
703
+
704
+ <div class="mt-2">
705
+ <p class="text-gray-600">攻击手法:</p>
706
+ <ol class="list-decimal list-inside text-sm space-y-1">
707
+ <li>攻击者登录自己的账号，获取一个合法的订单ID（如1001）</li>
708
+ <li>修改请求中的orderid参数，尝试访问其他订单ID（如1002、1003等）</li>
709
+ <li>服务器未进行权限校验，攻击者成功获取其他用户的订单信息</li>
710
+ <li>通过自动化工具（如Burp Suite或脚本），批量枚举订单ID获取大量用户数据</li>
711
+ </ol>
712
+ </div>
713
+
714
+ <div class="mt-2">
715
+ <p class="text-gray-600">修复建议:</p>
716
+ <p class="text-sm">1. 服务端增加订单所属用户校验<br>2. 实现数据级权限控制<br>3. 对订单ID增加访问频率限制</p>
717
+ </div>
718
+ </div>
719
+
720
+ <div class="risk-critical p-4 rounded-lg">
721
+ <div class="flex justify-between items-start">
722
+ <div>
723
+ <h4 class="font-medium mb-1">SQL注入漏洞</h4>
724
+ <p class="text-sm text-gray-600">订单查询SQL注入</p>
725
+ </div>
726
+ <span class="bg-red-600 text-white text-xs px-2 py-0.5 rounded-full">高危</span>
727
+ </div>
728
+
729
+ <div class="mt-2">
730
+ <p class="text-gray-600">风险接口:</p>
731
+ <p class="text-sm font-mono">/api/orders?userId={userId}</p>
732
+ </div>
733
+
734
+ <div class="mt-2">
735
+ <p class="text-gray-600">风险描述:</p>
736
+ <p class="text-sm">接口存在SQL注入漏洞，攻击者可以构造恶意输入执行任意SQL命令，可能导致数据库信息泄露甚至服务器被控制。</p>
737
+ </div>
738
+
739
+ <div class="mt-2">
740
+ <p class="text-gray-600">攻击Payload:</p>
741
+ <div class="code-block">
742
+ <pre><code class="language-sql">user1' UNION SELECT 1,username,password FROM users--</code></pre>
743
+ </div>
744
+ </div>
745
+
746
+ <div class="mt-2">
747
+ <p class="text-gray-600">修复建议:</p>
748
+ <p class="text-sm">1. 使用预编译语句(PreparedStatement)替代字符串拼接<br>2. 实施输入验证和参数化查询<br>3. 限制数据库账户权限</p>
749
+ </div>
750
+ </div>
751
+ </div>
752
+ </div>
753
+ </div>
754
+ </div>
755
+
756
+ <!-- Release Check Tab -->
757
+ <div id="release" class="tab-content">
758
+ <div class="content-container">
759
+ <!-- Left Panel - Release Content -->
760
+ <div class="content-panel bg-white">
761
+ <h3 class="text-lg font-medium text-gray-800 mb-4">发布安全检查</h3>
762
+
763
+ <div class="space-y-4">
764
+ <div class="p-4 border rounded-lg">
765
+ <h4 class="font-medium mb-2">安全检查项</h4>
766
+ <div class="space-y-3">
767
+ <div class="flex items-center">
768
+ <svg class="w-5 h-5 text-green-500 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
769
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"></path>
770
+ </svg>
771
+ <span>代码静态扫描通过</span>
772
+ </div>
773
+ <div class="flex items-center">
774
+ <svg class="w-5 h-5 text-green-500 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
775
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"></path>
776
+ </svg>
777
+ <span>依赖库无已知漏洞</span>
778
+ </div>
779
+ <div class="flex items-center">
780
+ <svg class="w-5 h-5 text-red-500 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
781
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"></path>
782
+ </svg>
783
+ <span>越权风险未完全修复</span>
784
+ </div>
785
+ <div class="flex items-center">
786
+ <svg class="w-5 h-5 text-yellow-500 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
787
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"></path>
788
+ </svg>
789
+ <span>SQL注入风险部分修复</span>
790
+ </div>
791
+ </div>
792
+ </div>
793
+
794
+ <div class="p-4 border rounded-lg">
795
+ <h4 class="font-medium mb-2">发布检查记录</h4>
796
+ <div class="text-sm space-y-2">
797
+ <div class="flex justify-between">
798
+ <span>2023-06-10 14:30</span>
799
+ <span class="text-red-600">安全检查不通过</span>
800
+ </div>
801
+ <div class="flex justify-between">
802
+ <span>2023-06-12 09:15</span>
803
+ <span class="text-yellow-500">部分风险未修复</span>
804
+ </div>
805
+ <div class="flex justify-between">
806
+ <span>2023-06-14 16:45</span>
807
+ <span class="text-yellow-500">关键风险仍存在</span>
808
+ </div>
809
+ </div>
810
+ </div>
811
+
812
+ <!-- Enhanced Release Decision Section -->
813
+ <div class="release-decision">
814
+ <div class="flex items-center mb-4">
815
+ <svg class="w-8 h-8 text-red-500 mr-3" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
816
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"></path>
817
+ </svg>
818
+ <div>
819
+ <h4 class="text-xl font-bold">发布决策</h4>
820
+ <p class="text-sm text-gray-600">安全团队最终评审结果</p>
821
+ </div>
822
+ </div>
823
+
824
+ <div class="flex items-center mb-3">
825
+ <svg class="w-6 h-6 text-red-500 mr-2" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
826
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M6 18L18 6M6 6l12 12"></path>
827
+ </svg>
828
+ <span class="font-bold text-lg">拒绝发布</span>
829
+ </div>
830
+
831
+ <div class="bg-white p-4 rounded-lg border border-red-200">
832
+ <h5 class="font-medium mb-2">拒绝原因</h5>
833
+ <ul class="list-disc list-inside text-sm space-y-1">
834
+ <li>存在未修复的高危SQL注入漏洞</li>
835
+ <li>越权访问风险未完全解决</li>
836
+ <li>关键安全测试用例未通过</li>
837
+ </ul>
838
+ </div>
839
+
840
+ <div class="mt-4">
841
+ <h5 class="font-medium mb-2">后续行动</h5>
842
+ <ol class="list-decimal list-inside text-sm space-y-1">
843
+ <li>修复所有高风险安全问题</li>
844
+ <li>重新进行安全测试验证</li>
845
+ <li>重新提交发布申请</li>
846
+ </ol>
847
+ </div>
848
+
849
+ <div class="mt-4 text-sm">
850
+ <p class="text-gray-600">决策人: 安全团队 - 张安全</p>
851
+ <p class="text-gray-600">决策时间: 2023-06-15 10:30</p>
852
+ </div>
853
+ </div>
854
+ </div>
855
+ </div>
856
+
857
+ <!-- Right Panel - Security Analysis -->
858
+ <div class="content-panel bg-white">
859
+ <h3 class="text-lg font-medium text-gray-800 mb-4">未修复风险分析</h3>
860
+
861
+ <div class="space-y-4">
862
+ <div class="risk-critical p-4 rounded-lg">
863
+ <div class="flex justify-between items-start">
864
+ <div>
865
+ <h4 class="font-medium mb-1">需求环节: 越权访问风险</h4>
866
+ <p class="text-sm text-gray-600">用户权限控制不足</p>
867
+ </div>
868
+ <span class="bg-red-600 text-white text-xs px-2 py-0.5 rounded-full">未修复</span>
869
+ </div>
870
+
871
+ <div class="mt-2 text-sm">
872
+ <p>风险描述: 用户权限校验不足，可能导致越权访问敏感数据</p>
873
+ <p class="mt-1">影响范围: 补贴审批、订单查询等核心功能</p>
874
+ </div>
875
+
876
+ <div class="mt-2">
877
+ <p class="text-gray-600">修复进度:</p>
878
+ <div class="w-full bg-gray-200 rounded-full h-2.5 mt-1">
879
+ <div class="bg-red-600 h-2.5 rounded-full" style="width: 20%"></div>
880
+ </div>
881
+ <p class="text-xs mt-1 text-gray-600">仅完成需求分析，未进行代码实现</p>
882
+ </div>
883
+ </div>
884
+
885
+ <div class="risk-high p-4 rounded-lg">
886
+ <div class="flex justify-between items-start">
887
+ <div>
888
+ <h4 class="font-medium mb-1">代码环节: SQL注入风险</h4>
889
+ <p class="text-sm text-gray-600">OrderService.java</p>
890
+ </div>
891
+ <span class="bg-orange-500 text-white text-xs px-2 py-0.5 rounded-full">部分修复</span>
892
+ </div>
893
+
894
+ <div class="mt-2 text-sm">
895
+ <p>风险描述: 直接拼接SQL语句，存在注入风险</p>
896
+ <p class="mt-1">影响接口: /api/orders?userId={userId}</p>
897
+ </div>
898
+
899
+ <div class="mt-2">
900
+ <p class="text-gray-600">修复进度:</p>
901
+ <div class="w-full bg-gray-200 rounded-full h-2.5 mt-1">
902
+ <div class="bg-orange-500 h-2.5 rounded-full" style="width: 70%"></div>
903
+ </div>
904
+ <p class="text-xs mt-1 text-gray-600">主接口已修复，但部分边缘接口仍存在风险</p>
905
+ </div>
906
+ </div>
907
+
908
+ <div class="risk-medium p-4 rounded-lg">
909
+ <div class="flex justify-between items-start">
910
+ <div>
911
+ <h4 class="font-medium mb-1">安全测试: 水平越权</h4>
912
+ <p class="text-sm text-gray-600">订单信息越权访问</p>
913
+ </div>
914
+ <span class="bg-yellow-500 text-white text-xs px-2 py-0.5 rounded-full">已修复待验证</span>
915
+ </div>
916
+
917
+ <div class="mt-2 text-sm">
918
+ <p>风险描述: 通过修改orderid参数可访问他人订单信息</p>
919
+ <p class="mt-1">影响接口: /api/orders/{orderId}</p>
920
+ </div>
921
+
922
+ <div class="mt-2">
923
+ <p class="text-gray-600">修复进度:</p>
924
+ <div class="w-full bg-gray-200 rounded-full h-2.5 mt-1">
925
+ <div class="bg-yellow-500 h-2.5 rounded-full" style="width: 90%"></div>
926
+ </div>
927
+ <p class="text-xs mt-1 text-gray-600">代码已修复，等待安全团队验证</p>
928
+ </div>
929
+ </div>
930
+ </div>
931
+ </div>
932
+ </div>
933
+ </div>
934
+
935
+ <!-- Production Monitoring Tab -->
936
+ <div id="production" class="tab-content">
937
+ <div class="content-container">
938
+ <!-- Left Panel - Production Content -->
939
+ <div class="content-panel bg-white">
940
+ <h3 class="text-lg font-medium text-gray-800 mb-4">线上监控数据</h3>
941
+
942
+ <div class="space-y-6">
943
+ <div>
944
+ <h4 class="font-medium mb-2">安全事件记录</h4>
945
+ <div class="border rounded-lg overflow-hidden">
946
+ <table class="min-w-full divide-y divide-gray-200">
947
+ <thead class="bg-gray-50">
948
+ <tr>
949
+ <th class="px-4 py-2 text-left text-xs font-medium text-gray-500 uppercase">时间</th>
950
+ <th class="px-4 py-2 text-left text-xs font-medium text-gray-500 uppercase">事件类型</th>
951
+ <th class="px-4 py-2 text-left text-xs font-medium text-gray-500 uppercase">状态</th>
952
+ </tr>
953
+ </thead>
954
+ <tbody class="bg-white divide-y divide-gray-200">
955
+ <tr>
956
+ <td class="px-4 py-2 whitespace-nowrap text-sm text-gray-900">2023-06-08 03:15</td>
957
+ <td class="px-4 py-2 whitespace-nowrap text-sm text-gray-900">异常登录尝试</td>
958
+ <td class="px-4 py-2 whitespace-nowrap">
959
+ <span class="px-2 py-1 text-xs rounded-full bg-green-100 text-green-800">已处理</span>
960
+ </td>
961
+ </tr>
962
+ <tr>
963
+ <td class="px-4 py-2 whitespace-nowrap text-sm text-gray-900">2023-06-10 14:30</td>
964
+ <td class="px-4 py-2 whitespace-nowrap text-sm text-gray-900">SQL注入攻击</td>
965
+ <td class="px-4 py-2 whitespace-nowrap">
966
+ <span class="px-2 py-1 text-xs rounded-full bg-red-100 text-red-800">待修复</span>
967
+ </td>
968
+ </tr>
969
+ <tr>
970
+ <td class="px-4 py-2 whitespace-nowrap text-sm text-gray-900">2023-06-12 09:15</td>
971
+ <td class="px-4 py-2 whitespace-nowrap text-sm text-gray-900">批量订单查询</td>
972
+ <td class="px-4 py-2 whitespace-nowrap">
973
+ <span class="px-2 py-1 text-xs rounded-full bg-yellow-100 text-yellow-800">监控中</span>
974
+ </td>
975
+ </tr>
976
+ </tbody>
977
+ </table>
978
+ </div>
979
+ </div>
980
+
981
+ <!-- Added Vulnerability Status Module -->
982
+ <div>
983
+ <h4 class="font-medium mb-2">漏洞及修复状态</h4>
984
+ <div class="border rounded-lg p-4">
985
+ <div class="space-y-4">
986
+ <div class="vulnerability-item">
987
+ <div class="flex justify-between items-center">
988
+ <h5 class="font-medium">SQL注入漏洞</h5>
989
+ <span class="px-2 py-1 text-xs rounded-full bg-red-100 text-red-800">未修复</span>
990
+ </div>
991
+ <p class="text-sm text-gray-600 mt-1">影响接口: /api/orders?userId={userId}</p>
992
+ <div class="mt-2">
993
+ <p class="text-xs text-gray-500">发现时间: 2023-06-10</p>
994
+ <p class="text-xs text-gray-500">最后检测: 2023-06-15</p>
995
+ </div>
996
+ </div>
997
+
998
+ <div class="vulnerability-item">
999
+ <div class="flex justify-between items-center">
1000
+ <h5 class="font-medium">越权访问漏洞</h5>
1001
+ <span class="px-2 py-1 text-xs rounded-full bg-yellow-100 text-yellow-800">修复中</span>
1002
+ </div>
1003
+ <p class="text-sm text-gray-600 mt-1">影响接口: /api/orders/{orderId}</p>
1004
+ <div class="mt-2">
1005
+ <p class="text-xs text-gray-500">发现时间: 2023-06-08</p>
1006
+ <p class="text-xs text-gray-500">预计修复: 2023-06-20</p>
1007
+ </div>
1008
+ </div>
1009
+
1010
+ <div class="vulnerability-item">
1011
+ <div class="flex justify-between items-center">
1012
+ <h5 class="font-medium">敏感信息泄露</h5>
1013
+ <span class="px-2 py-1 text-xs rounded-full bg-green-100 text-green-800">已修复</span>
1014
+ </div>
1015
+ <p class="text-sm text-gray-600 mt-1">影响接口: /api/user/profile</p>
1016
+ <div class="mt-2">
1017
+ <p class="text-xs text-gray-500">发现时间: 2023-06-05</p>
1018
+ <p class="text-xs text-gray-500">修复时间: 2023-06-12</p>
1019
+ </div>
1020
+ </div>
1021
+ </div>
1022
+ </div>
1023
+ </div>
1024
+ </div>
1025
+ </div>
1026
+
1027
+ <!-- Right Panel - Security Analysis -->
1028
+ <div class="content-panel bg-white">
1029
+ <h3 class="text-lg font-medium text-gray-800 mb-4">线上风险分析</h3>
1030
+
1031
+ <div class="space-y-4">
1032
+ <div class="risk-critical p-4 rounded-lg">
1033
+ <div class="flex justify-between items-start">
1034
+ <div>
1035
+ <h4 class="font-medium mb-1">SQL注入攻击</h4>
1036
+ <p class="text-sm text-gray-600">2023-06-10 14:30</p>
1037
+ </div>
1038
+ <span class="bg-red-600 text-white text-xs px-2 py-0.5 rounded-full">高危</span>
1039
+ </div>
1040
+
1041
+ <div class="mt-2 text-sm">
1042
+ <p>攻击描述: 攻击者尝试通过userId参数注入SQL命令</p>
1043
+ <p class="mt-1">攻击Payload: <code class="bg-gray-100 px-1 rounded">user1' UNION SELECT 1,username,password FROM users--</code></p>
1044
+ <p class="mt-1">影响范围: 订单查询接口</p>
1045
+ </div>
1046
+
1047
+ <div class="mt-2">
1048
+ <p class="text-gray-600">修复情况:</p>
1049
+ <div class="flex items-center mt-1">
1050
+ <svg class="w-5 h-5 text-yellow-500 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
1051
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"></path>
1052
+ </svg>
1053
+ <span>已热修复，待版本更新</span>
1054
+ </div>
1055
+ </div>
1056
+ </div>
1057
+
1058
+ <div class="risk-high p-4 rounded-lg">
1059
+ <div class="flex justify-between items-start">
1060
+ <div>
1061
+ <h4 class="font-medium mb-1">批量订单查询</h4>
1062
+ <p class="text-sm text-gray-600">2023-06-12 09:15</p>
1063
+ </div>
1064
+ <span class="bg-orange-500 text-white text-xs px-2 py-0.5 rounded-full">中高危</span>
1065
+ </div>
1066
+
1067
+ <div class="mt-2 text-sm">
1068
+ <p>攻击描述: 同一IP在短时间内发起大量订单查询请求</p>
1069
+ <p class="mt-1">请求频率: 120次/分钟</p>
1070
+ <p class="mt-1">影响范围: 订单查询接口</p>
1071
+ </div>
1072
+
1073
+ <div class="mt-2">
1074
+ <p class="text-gray-600">处理措施:</p>
1075
+ <ol class="list-decimal list-inside text-sm space-y-1 mt-1">
1076
+ <li>已临时封禁攻击IP</li>
1077
+ <li>增加接口频率限制(60次/分钟)</li>
1078
+ <li>增加异常行为监控告警</li>
1079
+ </ol>
1080
+ </div>
1081
+ </div>
1082
+
1083
+ <div class="risk-medium p-4 rounded-lg">
1084
+ <div class="flex justify-between items-start">
1085
+ <div>
1086
+ <h4 class="font-medium mb-1">异常登录尝试</h4>
1087
+ <p class="text-sm text-gray-600">2023-06-08 03:15</p>
1088
+ </div>
1089
+ <span class="bg-yellow-500 text-white text-xs px-2 py-0.5 rounded-full">中危</span>
1090
+ </div>
1091
+
1092
+ <div class="mt-2 text-sm">
1093
+ <p>攻击描述: 来自异常地理位置的登录尝试</p>
1094
+ <p class="mt-1">攻击IP: 192.168.34.56 (俄罗斯)</p>
1095
+ <p class="mt-1">攻击方式: 密码爆破</p>
1096
+ </div>
1097
+
1098
+ <div class="mt-2">
1099
+ <p class="text-gray-600">处理结果:</p>
1100
+ <div class="flex items-center mt-1">
1101
+ <svg class="w-5 h-5 text-green-500 mr-1" fill="none" stroke="currentColor" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
1102
+ <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"></path>
1103
+ </svg>
1104
+ <span>已阻止，账户安全</span>
1105
+ </div>
1106
+ </div>
1107
+ </div>
1108
+ </div>
1109
+ </div>
1110
+ </div>
1111
+ </div>
1112
+ </div>
1113
+ </div>
1114
+
1115
+ <script>
1116
+ // Initialize Mermaid with proper configuration
1117
+ mermaid.initialize({
1118
+ startOnLoad: true,
1119
+ theme: 'default',
1120
+ flowchart: {
1121
+ useMaxWidth: true,
1122
+ htmlLabels: true
1123
+ },
1124
+ securityLevel: 'loose',
1125
+ themeCSS: `
1126
+ .risk-marker {
1127
+ fill: #ef4444;
1128
+ stroke: #ef4444;
1129
+ }
1130
+ `
1131
+ });
1132
+
1133
+ // Re-render Mermaid diagrams when tab is switched
1134
+ function renderMermaidDiagrams() {
1135
+ const mermaidElements = document.querySelectorAll('.mermaid');
1136
+ mermaidElements.forEach(el => {
1137
+ // Only render if not already rendered
1138
+ if (!el.querySelector('svg')) {
1139
+ const graphDefinition = el.textContent.trim();
1140
+ try {
1141
+ mermaid.init(undefined, el);
1142
+ } catch (e) {
1143
+ console.error('Mermaid rendering error:', e);
1144
+ }
1145
+ }
1146
+ });
1147
+ }
1148
+
1149
+ // Initialize Highlight.js
1150
+ document.addEventListener('DOMContentLoaded', (event) => {
1151
+ document.querySelectorAll('pre code').forEach((el) => {
1152
+ hljs.highlightElement(el);
1153
+ });
1154
+
1155
+ // Initial render of Mermaid diagrams
1156
+ renderMermaidDiagrams();
1157
+ });
1158
+
1159
+ // Switch tabs
1160
+ function switchTab(tabId) {
1161
+ // Hide all tab contents
1162
+ document.querySelectorAll('.tab-content').forEach(tab => {
1163
+ tab.classList.remove('active');
1164
+ });
1165
+
1166
+ // Remove active class from all tabs
1167
+ document.querySelectorAll('.nav-tabs button').forEach(tab => {
1168
+ tab.classList.remove('active');
1169
+ });
1170
+
1171
+ // Show selected tab content
1172
+ document.getElementById(tabId).classList.add('active');
1173
+
1174
+ // Add active class to clicked tab
1175
+ event.currentTarget.classList.add('active');
1176
+
1177
+ // Render Mermaid diagrams in the newly shown tab
1178
+ setTimeout(renderMermaidDiagrams, 100);
1179
+ }
1180
+
1181
+ // Highlight text in requirements
1182
+ function highlightText(text) {
1183
+ const elements = document.querySelectorAll('.highlight-risk');
1184
+ elements.forEach(el => {
1185
+ el.classList.remove('highlight-risk');
1186
+ });
1187
+
1188
+ // Simple text matching for demonstration
1189
+ const allElements = document.querySelectorAll('#requirements p, #requirements h4');
1190
+ allElements.forEach(el => {
1191
+ if (el.textContent.includes(text)) {
1192
+ el.classList.add('highlight-risk');
1193
+ el.scrollIntoView({ behavior: 'smooth', block: 'center' });
1194
+ }
1195
+ });
1196
+ }
1197
+
1198
+ // Highlight code line
1199
+ function highlightCode(lineId) {
1200
+ const elements = document.querySelectorAll('.vulnerable-line');
1201
+ elements.forEach(el => {
1202
+ el.classList.remove('vulnerable-line-highlight');
1203
+ });
1204
+
1205
+ const targetElement = document.getElementById(lineId);
1206
+ if (targetElement) {
1207
+ targetElement.classList.add('vulnerable-line-highlight');
1208
+ targetElement.scrollIntoView({ behavior: 'smooth', block: 'center' });
1209
+ }
1210
+ }
1211
+ </script>
1212
+ <p style="border-radius: 8px; text-align: center; font-size: 12px; color: #fff; margin-top: 16px;position: fixed; left: 8px; bottom: 8px; z-index: 10; background: rgba(0, 0, 0, 0.8); padding: 4px 8px;">Made with <img src="https://enzostvs-deepsite.hf.space/logo.svg" alt="DeepSite Logo" style="width: 16px; height: 16px; vertical-align: middle;display:inline-block;margin-right:3px;filter:brightness(0) invert(1);"><a href="https://enzostvs-deepsite.hf.space" style="color: #fff;text-decoration: underline;" target="_blank" >DeepSite</a> - 🧬 <a href="https://enzostvs-deepsite.hf.space?remix=capta1n/project9" style="color: #fff;text-decoration: underline;" target="_blank" >Remix</a></p></body>
1213
+ </html>
prompts.txt ADDED
@@ -0,0 +1 @@
 
 
1
+ 项目概要模块增加以下内容：1、应用名称：soc-AI-SDL 2、代码分支地址：git@gitlab.alibaba-inc.com:soc-AI-SDL/soc-AI-SDL.git::/feature/20250414_24651171_tmp_1_stage_1 发布检查模块：突出发布决策内容模块 线上监控模块：1、增加漏洞及修复状态模块 2、删除风险趋势模块