Web 安全最佳实践 #

// 安全设计原则实现
const securityDesignPrinciples = {
  // 最小权限原则
  principleOfLeastPrivilege: {
    description: '每个组件应该以完成其任务所需的最小权限运行',
    implementation: {
      database: '使用专用数据库用户，只授予必要的权限',
      fileSystem: '限制文件访问权限，使用适当的目录结构',
      api: '实现基于角色的访问控制，限制 API 访问权限'
    }
  },
  
  // 深度防御
  defenseInDepth: {
    description: '多层安全控制，确保即使某一层被突破，仍有其他层提供保护',
    implementation: {
      network: '防火墙、IDS/IPS、网络隔离',
      application: '输入验证、输出编码、安全头配置',
      data: '加密存储、访问控制、审计日志'
    }
  },
  
  // 故障安全
  failSecurely: {
    description: '系统在发生错误时应保持安全状态',
    implementation: {
      authentication: '认证失败时拒绝访问，不清除安全上下文',
      errors: '错误处理不泄露敏感信息',
      sessions: '会话失效时安全清理'
    }
  },
  
  // 全程安全
  securityByDefault: {
    description: '安全配置是默认配置',
    implementation: {
      defaults: '安全设置默认启用',
      configuration: '最小化攻击面',
      features: '安全功能默认开启'
    }
  }
};

// 威胁建模框架
const threatModeling = {
  // STRIDE 模型
  strideModel: {
    spoofing: {
      description: '身份伪造',
      examples: ['身份验证绕过', '会话劫持', 'IP欺骗'],
      mitigations: [
        '强身份验证',
        '多因素认证',
        '证书验证',
        '会话管理'
      ]
    },
    tampering: {
      description: '数据篡改',
      examples: ['配置文件修改', '数据篡改', '代码注入'],
      mitigations: [
        '数据完整性校验',
        '数字签名',
        '访问控制',
        '输入验证'
      ]
    },
    repudiation: {
      description: '否认行为',
      examples: ['操作否认', '交易否认', '访问否认'],
      mitigations: [
        '审计日志',
        '不可否认性',
        '数字签名',
        '操作确认'
      ]
    },
    informationDisclosure: {
      description: '信息泄露',
      examples: ['敏感数据泄露', '错误信息泄露', '配置泄露'],
      mitigations: [
        '数据加密',
        '错误处理',
        '访问控制',
        '数据脱敏'
      ]
    },
    denialOfService: {
      description: '拒绝服务',
      examples: ['资源耗尽', '服务过载', '协议攻击'],
      mitigations: [
        '速率限制',
        '资源管理',
        '负载均衡',
        '攻击检测'
      ]
    },
    elevationOfPrivilege: {
      description: '权限提升',
      examples: ['权限绕过', '权限提升', '特权升级'],
      mitigations: [
        '访问控制',
        '权限验证',
        '最小权限',
        '安全审计'
      ]
    }
  },
  
  // 威胁建模流程
  process: {
    1: '识别资产',
    2: '创建架构概述',
    3: '分解应用程序',
    4: '识别威胁',
    5: '记录威胁',
    6: '确定风险等级',
    7: '确定缓解措施'
  }
};

// 多因素认证实现
const multiFactorAuth = {
  // TOTP (基于时间的一次性密码)
  totp: {
    generateSecret: function() {
      const speakeasy = require('speakeasy');
      return speakeasy.generateSecret({
        name: 'AppName',
        issuer: 'Your Company'
      });
    },
    
    verifyToken: function(secret, token) {
      const speakeasy = require('speakeasy');
      return speakeasy.totp.verify({
        secret: secret,
        encoding: 'base32',
        token: token,
        window: 2
      });
    }
  },
  
  // 基于短信的认证
  sms: {
    async sendVerificationCode(phoneNumber) {
      const crypto = require('crypto');
      const verificationCode = crypto.randomInt(100000, 999999).toString();
      
      // 存储验证码（带过期时间）
      await redis.setex(`verification:${phoneNumber}`, 300, verificationCode);
      
      // 发送短信（使用短信服务）
      await smsService.send(phoneNumber, `Your verification code is: ${verificationCode}`);
      
      return true;
    },
    
    async verifyCode(phoneNumber, code) {
      const storedCode = await redis.get(`verification:${phoneNumber}`);
      
      if (storedCode && storedCode === code) {
        await redis.del(`verification:${phoneNumber}`);
        return true;
      }
      
      return false;
    }
  },
  
  // 基于邮件的认证
  email: {
    async sendVerificationLink(email, userId) {
      const crypto = require('crypto');
      const token = crypto.randomBytes(32).toString('hex');
      
      // 存储验证令牌
      await db.collection('verification_tokens').insertOne({
        userId,
        token,
        type: 'email_verification',
        expiresAt: new Date(Date.now() + 24 * 60 * 60 * 1000) // 24小时后过期
      });
      
      // 发送验证邮件
      const verificationLink = `${process.env.APP_URL}/verify-email?token=${token}`;
      await emailService.send(email, 'Verify Your Email', verificationLink);
    }
  }
};

// 会话管理
const sessionManagement = {
  // 安全的会话配置
  secureConfig: {
    secret: process.env.SESSION_SECRET,
    resave: false,
    saveUninitialized: false,
    cookie: {
      secure: process.env.NODE_ENV === 'production', // HTTPS only
      httpOnly: true, // 防止 XSS
      maxAge: 24 * 60 * 60 * 1000, // 24小时
      sameSite: 'strict' // 防止 CSRF
    }
  },
  
  // 会话轮换
  async rotateSession(req) {
    return new Promise((resolve, reject) => {
      req.session.regenerate((err) => {
        if (err) {
          reject(err);
        } else {
          resolve();
        }
      });
    });
  },
  
  // 会话验证中间件
  validateSession: function(req, res, next) {
    if (!req.session.userId) {
      return res.status(401).json({ error: 'Authentication required' });
    }
    
    // 验证会话是否仍然有效
    // 这里可以检查数据库中的会话记录
    
    req.session.lastActivity = Date.now();
    next();
  }
};

// RBAC 实现
const rbac = {
  // 角色定义
  roles: {
    admin: {
      permissions: [
        'user:read', 'user:write', 'user:delete',
        'admin:read', 'admin:write', 'admin:delete',
        'system:config'
      ]
    },
    moderator: {
      permissions: [
        'user:read', 'user:write',
        'admin:read', 'admin:write'
      ]
    },
    user: {
      permissions: [
        'user:read'
      ]
    }
  },
  
  // 权限检查
  hasPermission: function(userRole, permission) {
    const role = this.roles[userRole];
    if (!role) {
      return false;
    }
    
    return role.permissions.includes(permission);
  },
  
  // 权限验证中间件
  requirePermission: function(permission) {
    return (req, res, next) => {
      if (!req.user) {
        return res.status(401).json({ error: 'Authentication required' });
      }
      
      if (!this.hasPermission(req.user.role, permission)) {
        return res.status(403).json({ error: 'Insufficient permissions' });
      }
      
      next();
    };
  },
  
  // 动态权限检查
  checkDynamicPermission: async function(userId, resource, action) {
    // 检查用户是否对特定资源有特定操作权限
    const userPermissions = await db.collection('user_permissions')
      .find({ userId: userId })
      .toArray();
    
    const resourcePermission = userPermissions.find(
      p => p.resource === resource && p.action === action
    );
    
    return !!resourcePermission;
  }
};

// 数据加密实现
const dataEncryption = {
  // 对称加密 (AES)
  symmetric: {
    encrypt: function(data, key) {
      const crypto = require('crypto');
      const algorithm = 'aes-256-gcm';
      
      const iv = crypto.randomBytes(16);
      const cipher = crypto.createCipher(algorithm, key);
      let encrypted = cipher.update(data, 'utf8', 'hex');
      encrypted += cipher.final('hex');
      
      const authTag = cipher.getAuthTag();
      
      return {
        encrypted: encrypted,
        iv: iv.toString('hex'),
        authTag: authTag.toString('hex')
      };
    },
    
    decrypt: function(encryptedData, key) {
      const crypto = require('crypto');
      const algorithm = 'aes-256-gcm';
      
      const decipher = crypto.createDecipher(algorithm, key);
      decipher.setAuthTag(Buffer.from(encryptedData.authTag, 'hex'));
      
      let decrypted = decipher.update(encryptedData.encrypted, 'hex', 'utf8');
      decrypted += decipher.final('utf8');
      
      return decrypted;
    }
  },
  
  // 非对称加密 (RSA)
  asymmetric: {
    generateKeyPair: function() {
      const crypto = require('crypto');
      
      const { publicKey, privateKey } = crypto.generateKeyPairSync('rsa', {
        modulusLength: 4096,
        publicKeyEncoding: {
          type: 'spki',
          format: 'pem'
        },
        privateKeyEncoding: {
          type: 'pkcs8',
          format: 'pem'
        }
      });
      
      return { publicKey, privateKey };
    },
    
    encrypt: function(data, publicKey) {
      const crypto = require('crypto');
      return crypto.publicEncrypt(
        publicKey,
        Buffer.from(data)
      ).toString('base64');
    },
    
    decrypt: function(encryptedData, privateKey) {
      const crypto = require('crypto');
      return crypto.privateDecrypt(
        privateKey,
        Buffer.from(encryptedData, 'base64')
      ).toString();
    }
  },
  
  // 密码哈希
  passwordHashing: {
    async hashPassword(password) {
      const bcrypt = require('bcrypt');
      const saltRounds = 12;
      return await bcrypt.hash(password, saltRounds);
    },
    
    async verifyPassword(password, hash) {
      const bcrypt = require('bcrypt');
      return await bcrypt.compare(password, hash);
    }
  }
};

// 数据脱敏实现
const dataMasking = {
  // 信用卡号脱敏
  maskCreditCard: function(cardNumber) {
    if (!cardNumber) return cardNumber;
    
    const cleanNumber = cardNumber.replace(/\D/g, '');
    if (cleanNumber.length < 4) return cleanNumber;
    
    const lastFour = cleanNumber.slice(-4);
    const masked = '*'.repeat(cleanNumber.length - 4) + lastFour;
    
    // 格式化显示
    return masked.replace(/(.{4})/g, '$1 ').trim();
  },
  
  // 邮箱脱敏
  maskEmail: function(email) {
    if (!email) return email;
    
    const [local, domain] = email.split('@');
    if (!local || !domain) return email;
    
    if (local.length <= 2) {
      return `${local[0]}***@${domain}`;
    }
    
    const maskedLocal = `${local[0]}${'*'.repeat(local.length - 2)}${local[local.length - 1]}`;
    return `${maskedLocal}@${domain}`;
  },
  
  // 手机号脱敏
  maskPhone: function(phone) {
    if (!phone) return phone;
    
    const cleanPhone = phone.replace(/\D/g, '');
    if (cleanPhone.length < 7) return phone;
    
    const areaCode = cleanPhone.slice(0, 3);
    const lastFour = cleanPhone.slice(-4);
    const middle = '*'.repeat(cleanPhone.length - 7);
    
    return `${areaCode}${middle}${lastFour}`;
  },
  
  // 批量数据脱敏
  maskObject: function(obj, rules) {
    const masked = { ...obj };
    
    for (const [field, maskFunction] of Object.entries(rules)) {
      if (masked[field] !== undefined) {
        masked[field] = maskFunction(masked[field]);
      }
    }
    
    return masked;
  }
};

// 输入验证框架
const inputValidation = {
  // 验证规则定义
  rules: {
    email: {
      pattern: /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/,
      maxLength: 254,
      validate: (value) => /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/.test(value)
    },
    
    username: {
      pattern: /^[a-zA-Z0-9_]{3,20}$/,
      validate: (value) => /^[a-zA-Z0-9_]{3,20}$/.test(value)
    },
    
    password: {
      minLength: 8,
      maxLength: 128,
      validate: (value) => {
        if (value.length < 8) return false;
        
        // 检查是否包含大写字母、小写字母、数字和特殊字符
        const hasUpper = /[A-Z]/.test(value);
        const hasLower = /[a-z]/.test(value);
        const hasNumber = /\d/.test(value);
        const hasSpecial = /[!@#$%^&*(),.?":{}|<>]/.test(value);
        
        return hasUpper && hasLower && hasNumber && hasSpecial;
      }
    }
  },
  
  // 白名单验证
  whitelistValidation: function(value, allowedValues) {
    return allowedValues.includes(value);
  },
  
  // 参数化查询辅助
  parameterizedQuery: function(baseQuery, params) {
    // 确保参数安全
    const validatedParams = {};
    
    for (const [key, value] of Object.entries(params)) {
      // 根据参数类型进行验证
      if (typeof value === 'string') {
        validatedParams[key] = this.sanitizeString(value);
      } else if (typeof value === 'number') {
        validatedParams[key] = this.validateNumber(value);
      } else {
        validatedParams[key] = value;
      }
    }
    
    return {
      query: baseQuery,
      params: validatedParams
    };
  },
  
  // 字符串清理
  sanitizeString: function(str) {
    if (typeof str !== 'string') return str;
    
    // 移除控制字符
    str = str.replace(/[\x00-\x1F\x7F]/g, '');
    
    // 防止 XSS
    str = str.replace(/[<>"'&]/g, function(match) {
      switch(match) {
        case '<': return '&lt;';
        case '>': return '&gt;';
        case '"': return '&quot;';
        case "'": return '&#x27;';
        case '&': return '&amp;';
        default: return match;
      }
    });
    
    return str;
  },
  
  // 数字验证
  validateNumber: function(num, min = -Infinity, max = Infinity) {
    if (typeof num !== 'number' || isNaN(num)) {
      throw new Error('Invalid number');
    }
    
    if (num < min || num > max) {
      throw new Error(`Number must be between ${min} and ${max}`);
    }
    
    return num;
  }
};

// 输出编码工具
const outputEncoding = {
  // HTML 编码
  htmlEncode: function(str) {
    if (typeof str !== 'string') return str;
    
    return str
      .replace(/&/g, '&')
      .replace(/</g, '&lt;')
      .replace(/>/g, '&gt;')
      .replace(/"/g, '&quot;')
      .replace(/'/g, '&#x27;')
      .replace(/\//g, '&#x2F;');
  },
  
  // HTML 解码
  htmlDecode: function(str) {
    if (typeof str !== 'string') return str;
    
    return str
      .replace(/&amp;/g, '&')
      .replace(/&lt;/g, '<')
      .replace(/&gt;/g, '>')
      .replace(/&quot;/g, '"')
      .replace(/&#x27;/g, "'")
      .replace(/&#x2F;/g, '/');
  },
  
  // JavaScript 编码
  jsEncode: function(str) {
    if (typeof str !== 'string') return str;
    
    return str
      .replace(/\\/g, '\\\\')
      .replace(/'/g, "\\'")
      .replace(/"/g, '\\"')
      .replace(/\n/g, '\\n')
      .replace(/\r/g, '\\r')
      .replace(/\t/g, '\\t')
      .replace(/\f/g, '\\f')
      .replace(/[\b]/g, '\\b');
  },
  
  // URL 编码
  urlEncode: function(str) {
    return encodeURIComponent(str);
  },
  
  // CSS 编码
  cssEncode: function(str) {
    if (typeof str !== 'string') return str;
    
    return str.replace(/[^a-zA-Z0-9]/g, function(match) {
      return '\\' + match.charCodeAt(0).toString(16);
    });
  },
  
  // 编码上下文感知
  encodeForContext: function(str, context) {
    switch(context) {
      case 'html':
        return this.htmlEncode(str);
      case 'javascript':
        return this.jsEncode(str);
      case 'url':
        return this.urlEncode(str);
      case 'css':
        return this.cssEncode(str);
      case 'attribute':
        return this.htmlEncode(str);
      default:
        return str;
    }
  }
};

// 安全头配置
const securityHeaders = {
  // 内容安全策略
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'"], // 生产环境应避免 'unsafe-inline'
      styleSrc: ["'self'", "'unsafe-inline'"],  // 生产环境应避免 'unsafe-inline'
      imgSrc: ["'self'", "data:", "https:"],
      fontSrc: ["'self'", "https:", "data:"],
      connectSrc: ["'self'", "https://api.example.com"],
      frameSrc: ["'none'"],
      objectSrc: ["'none'"],
      frameAncestors: ["'none'"],
      formAction: ["'self'"],
      baseUri: ["'self'"]
    },
    
    build: function() {
      return Object.entries(this.directives)
        .filter(([_, sources]) => sources.length > 0)
        .map(([directive, sources]) => {
          const directiveName = directive
            .replace(/([A-Z])/g, '-$1')
            .toLowerCase();
          const sourceList = sources.join(' ');
          return `${directiveName} ${sourceList}`;
        })
        .join('; ');
    }
  },
  
  // 严格传输安全
  strictTransportSecurity: {
    maxAge: 31536000, // 一年
    includeSubDomains: true,
    preload: true,
    
    build: function() {
      return [
        `max-age=${this.maxAge}`,
        this.includeSubDomains ? 'includeSubDomains' : '',
        this.preload ? 'preload' : ''
      ].filter(Boolean).join('; ');
    }
  },
  
  // 其他安全头
  otherHeaders: {
    'X-Frame-Options': 'DENY',
    'X-Content-Type-Options': 'nosniff',
    'X-XSS-Protection': '1; mode=block',
    'Referrer-Policy': 'strict-origin-when-cross-origin',
    'Permissions-Policy': 'geolocation=(), microphone=(), camera=()'
  },
  
  // 应用安全头中间件
  applyHeaders: function(req, res, next) {
    // CSP
    res.setHeader('Content-Security-Policy', this.contentSecurityPolicy.build());
    
    // HSTS
    if (req.secure) {
      res.setHeader('Strict-Transport-Security', this.strictTransportSecurity.build());
    }
    
    // 其他安全头
    Object.entries(this.otherHeaders).forEach(([header, value]) => {
      res.setHeader(header, value);
    });
    
    next();
  }
};

// 安全错误处理
const secureErrorHandling = {
  // 通用错误处理
  handleError: function(error, req, res, next) {
    // 记录详细错误信息（仅在日志中，不返回给客户端）
    console.error('Error occurred:', {
      message: error.message,
      stack: error.stack,
      url: req.url,
      method: req.method,
      ip: req.ip,
      timestamp: new Date().toISOString()
    });
    
    // 返回通用错误信息
    const errorResponse = {
      error: 'An internal server error occurred',
      timestamp: new Date().toISOString()
    };
    
    // 根据错误类型返回不同状态码
    if (error.name === 'ValidationError') {
      res.status(400).json(errorResponse);
    } else if (error.name === 'UnauthorizedError') {
      res.status(401).json(errorResponse);
    } else if (error.name === 'ForbiddenError') {
      res.status(403).json(errorResponse);
    } else {
      res.status(500).json(errorResponse);
    }
  },
  
  // 自定义错误类
  createCustomError: function(name, message, statusCode) {
    class CustomError extends Error {
      constructor(message) {
        super(message);
        this.name = name;
        this.statusCode = statusCode;
        Error.captureStackTrace(this, this.constructor);
      }
    }
    
    return CustomError;
  },
  
  // 输入验证错误
  ValidationError: function(message) {
    const ErrorClass = this.createCustomError('ValidationError', message, 400);
    return new ErrorClass(message);
  },
  
  // 认证错误
  UnauthorizedError: function(message = 'Unauthorized') {
    const ErrorClass = this.createCustomError('UnauthorizedError', message, 401);
    return new ErrorClass(message);
  },
  
  // 授权错误
  ForbiddenError: function(message = 'Forbidden') {
    const ErrorClass = this.createCustomError('ForbiddenError', message, 403);
    return new ErrorClass(message);
  }
};

// 安全日志实现
const securityLogging = {
  // 敏感操作日志
  logSensitiveOperation: function(operation, user, details) {
    const logEntry = {
      timestamp: new Date().toISOString(),
      operation: operation,
      userId: user.id,
      userName: user.name,
      ip: details.ip,
      userAgent: details.userAgent,
      success: details.success,
      details: details.data || {}
    };
    
    // 记录到安全日志
    console.log('SECURITY_LOG:', JSON.stringify(logEntry));
    
    // 可以发送到专门的安全日志系统
    this.sendToSecurityLog(logEntry);
  },
  
  // 登录尝试日志
  logLoginAttempt: function(username, success, ip, userAgent) {
    const logEntry = {
      type: 'login_attempt',
      timestamp: new Date().toISOString(),
      username: username,
      success: success,
      ip: ip,
      userAgent: userAgent
    };
    
    console.log('LOGIN_LOG:', JSON.stringify(logEntry));
  },
  
  // 失败登录监控
  failedLoginMonitor: {
    attempts: new Map(), // 存储失败尝试次数
    threshold: 5, // 阈值
    lockoutDuration: 15 * 60 * 1000, // 15分钟锁定
    
    recordFailure: function(ip, username) {
      const key = `${ip}:${username}`;
      const now = Date.now();
      
      let attempt = this.attempts.get(key);
      if (!attempt) {
        attempt = { count: 0, firstAttempt: now, lockedUntil: null };
      }
      
      // 检查是否在锁定期内
      if (attempt.lockedUntil && now < attempt.lockedUntil) {
        return { blocked: true, timeRemaining: attempt.lockedUntil - now };
      }
      
      attempt.count++;
      attempt.firstAttempt = now;
      
      // 如果超过阈值，锁定账户
      if (attempt.count >= this.threshold) {
        attempt.lockedUntil = now + this.lockoutDuration;
        attempt.count = 0; // 重置计数
      }
      
      this.attempts.set(key, attempt);
      
      return {
        blocked: false,
        attemptsRemaining: Math.max(0, this.threshold - attempt.count)
      };
    },
    
    clearAttempts: function(ip, username) {
      this.attempts.delete(`${ip}:${username}`);
    }
  },
  
  // 安全日志分析
  analyzeSecurityLogs: function(logs) {
    const analysis = {
      totalEvents: logs.length,
      byType: {},
      bySeverity: {},
      suspiciousPatterns: []
    };
    
    for (const log of logs) {
      // 按类型统计
      analysis.byType[log.type] = (analysis.byType[log.type] || 0) + 1;
      
      // 检测异常模式
      if (this.detectAnomaly(log)) {
        analysis.suspiciousPatterns.push(log);
      }
    }
    
    return analysis;
  },
  
  // 异常检测
  detectAnomaly: function(log) {
    // 检测频繁失败登录
    if (log.type === 'login_failure') {
      // 这里可以实现更复杂的异常检测逻辑
      return true;
    }
    
    return false;
  }
};

// 自动化安全测试框架
const automatedSecurityTesting = {
  // 测试配置
  config: {
    target: process.env.SECURITY_TEST_TARGET || 'http://localhost:3000',
    tests: [
      'xss',
      'sql_injection',
      'csrf',
      'auth_bypass',
      'session_fixation'
    ]
  },
  
  // XSS 测试
  xssTest: {
    payloads: [
      '<script>alert("XSS")</script>',
      'javascript:alert("XSS")',
      '<img src=x onerror=alert("XSS")>',
      '<svg onload=alert("XSS")>'
    ],
    
    async testEndpoint(url, param, payload) {
      const axios = require('axios');
      
      const testUrl = new URL(url);
      testUrl.searchParams.set(param, payload);
      
      try {
        const response = await axios.get(testUrl.toString(), {
          timeout: 5000,
          validateStatus: () => true
        });
        
        // 检查响应中是否包含恶意负载
        const responseText = response.data?.toString() || '';
        return responseText.includes(payload);
      } catch (error) {
        return false;
      }
    }
  },
  
  // SQL 注入测试
  sqlInjectionTest: {
    payloads: [
      "' OR '1'='1",
      "' UNION SELECT * FROM users--",
      "'; DROP TABLE users--",
      "1; WAITFOR DELAY '00:00:05'--"
    ],
    
    async testEndpoint(url, param, payload) {
      const axios = require('axios');
      
      try {
        const start = Date.now();
        const response = await axios.post(url, { [param]: payload }, {
          timeout: 10000,
          validateStatus: () => true
        });
        const duration = Date.now() - start;
        
        // 检查响应时间是否异常长（可能的盲注）
        if (duration > 8000) { // 超过8秒
          return true;
        }
        
        // 检查错误消息
        const responseText = response.data?.toString() || '';
        const sqlErrorPatterns = [
          /SQL error/i,
          /MySQL/i,
          /PostgreSQL/i,
          /ORA-\d+/i,
          /Microsoft SQL Server/i
        ];
        
        return sqlErrorPatterns.some(pattern => pattern.test(responseText));
      } catch (error) {
        return false;
      }
    }
  },
  
  // 运行所有安全测试
  async runAllTests() {
    const results = {
      xss: [],
      sql_injection: [],
      csrf: [],
      auth_bypass: [],
      session_fixation: []
    };
    
    // 运行 XSS 测试
    for (const payload of this.xssTest.payloads) {
      // 这里应该测试实际的端点
      // results.xss.push(await this.xssTest.testEndpoint(url, param, payload));
    }
    
    // 运行 SQL 注入测试
    for (const payload of this.sqlInjectionTest.payloads) {
      // 这里应该测试实际的端点
      // results.sql_injection.push(await this.sqlInjectionTest.testEndpoint(url, param, payload));
    }
    
    return results;
  }
};

// 安全编码最佳实践
const secureCodingPractices = {
  // 输入验证最佳实践
  inputValidation: [
    '永远不要信任用户输入',
    '使用白名单而不是黑名单',
    '在服务器端验证所有输入',
    '对所有输入进行类型检查',
    '限制输入长度和格式'
  ],
  
  // 输出编码最佳实践
  outputEncoding: [
    '在输出到 HTML 时进行 HTML 编码',
    '在输出到 JavaScript 时进行 JavaScript 编码',
    '在输出到 URL 时进行 URL 编码',
    '使用参数化查询防止 SQL 注入',
    '对所有动态内容进行适当的上下文编码'
  ],
  
  // 身份验证最佳实践
  authentication: [
    '使用强密码策略',
    '实施多因素认证',
    '使用安全的会话管理',
    '定期轮换会话 ID',
    '实施适当的锁定策略'
  ],
  
  // 授权最佳实践
  authorization: [
    '使用最小权限原则',
    '在服务器端验证权限',
    '实施基于角色的访问控制',
    '定期审查权限分配',
    '记录所有授权决策'
  ],
  
  // 数据保护最佳实践
  dataProtection: [
    '加密传输中的数据',
    '加密静态数据',
    '使用强加密算法',
    '安全地管理加密密钥',
    '实施数据脱敏'
  ]
};