安全测试 #

// 安全测试类型分类
const securityTestTypes = {
  // 静态应用安全测试
  SAST: {
    name: '静态应用安全测试',
    description: '在不运行代码的情况下分析源代码',
    tools: ['SonarQube', 'Checkmarx', 'Fortify'],
    timing: '开发阶段'
  },
  
  // 动态应用安全测试
  DAST: {
    name: '动态应用安全测试',
    description: '在运行时测试应用程序',
    tools: ['OWASP ZAP', 'Burp Suite', 'Acunetix'],
    timing: '测试/生产阶段'
  },
  
  // 交互式应用安全测试
  IAST: {
    name: '交互式应用安全测试',
    description: '在运行时分析应用程序内部行为',
    tools: ['Contrast Security', 'Synopsys Seeker'],
    timing: '测试/生产阶段'
  },
  
  // 软件成分分析
  SCA: {
    name: '软件成分分析',
    description: '分析第三方组件和依赖项的安全性',
    tools: ['Snyk', 'WhiteSource', 'Dependabot'],
    timing: '开发/构建阶段'
  }
};

// OWASP Top 10 (2021) 安全风险
const owaspTop10 = {
  'A01:2021': {
    name: '失效的访问控制',
    description: '违反访问控制策略，导致未授权信息泄露、修改或破坏',
    examples: ['IDOR', '权限提升', '绕过认证'],
    prevention: ['最小权限原则', '访问控制检查', '安全审计']
  },
  
  'A02:2021': {
    name: '加密失败',
    description: '敏感数据未得到适当保护',
    examples: ['明文存储密码', '弱加密算法', '未加密传输'],
    prevention: ['强加密', '安全传输', '数据分类']
  },
  
  'A03:2021': {
    name: '注入',
    description: '恶意数据被发送到解释器',
    examples: ['SQL注入', 'NoSQL注入', '命令注入'],
    prevention: ['参数化查询', '输入验证', '输出编码']
  },
  
  'A04:2021': {
    name: '不安全的设计',
    description: '缺乏安全设计原则和控制',
    examples: ['缺乏安全架构', '错误的访问控制设计'],
    prevention: ['安全设计原则', '威胁建模', '安全开发生命周期']
  },
  
  'A05:2021': {
    name: '安全配置错误',
    description: '安全配置不当导致的安全漏洞',
    examples: ['默认账户', '错误的HTTP头', '详细错误信息'],
    prevention: ['安全配置', '定期审计', '自动化扫描']
  },
  
  'A06:2021': {
    name: '易受攻击和过时的组件',
    description: '使用已知漏洞的组件',
    examples: ['过时的库', '未打补丁的系统'],
    prevention: ['依赖管理', '定期更新', '漏洞扫描']
  },
  
  'A07:2021': {
    name: '身份识别和身份验证失败',
    description: '身份验证机制不当导致的问题',
    examples: ['弱密码策略', '会话固定', '缺乏MFA'],
    prevention: ['强身份验证', '会话管理', 'MFA']
  },
  
  'A08:2021': {
    name: '软件和数据完整性故障',
    description: '未能验证软件或数据的完整性',
    examples: ['供应链攻击', '未签名的更新'],
    prevention: ['代码签名', '完整性校验', '安全发布']
  },
  
  'A09:2021': {
    name: '安全日志记录和监控故障',
    description: '缺乏适当的日志记录和监控',
    examples: ['无日志记录', '无安全监控', '无告警机制'],
    prevention: ['安全日志', '实时监控', '告警系统']
  },
  
  'A10:2021': {
    name: '服务端请求伪造',
    description: '攻击者诱导服务器发起意外请求',
    examples: ['内部系统访问', 'SSRF绕过'],
    prevention: ['输入验证', '出站请求过滤', '网络隔离']
  }
};

// 渗透测试方法论
const penetrationTesting = {
  phases: [
    {
      name: '侦察',
      activities: [
        '域名和子域名发现',
        '端口扫描',
        '技术栈识别',
        '社会工程学信息收集'
      ],
      tools: ['Nmap', 'Sublist3r', 'Shodan', 'Recon-ng']
    },
    {
      name: '扫描',
      activities: [
        '漏洞扫描',
        '服务识别',
        '配置分析'
      ],
      tools: ['Nessus', 'OpenVAS', 'Nikto', 'Dirb']
    },
    {
      name: '利用',
      activities: [
        '漏洞利用',
        '权限提升',
        '横向移动'
      ],
      tools: ['Metasploit', 'SQLmap', 'Hydra']
    },
    {
      name: '后渗透',
      activities: [
        '持久化访问',
        '数据提取',
        '清理痕迹'
      ],
      tools: ['Mimikatz', 'Cobalt Strike']
    },
    {
      name: '报告',
      activities: [
        '漏洞分析',
        '风险评估',
        '修复建议'
      ]
    }
  ]
};

// 漏洞扫描配置示例
const vulnerabilityScanning = {
  // 自动化扫描配置
  automatedScan: {
    target: 'https://example.com',
    scanner: 'OWASP ZAP',
    parameters: {
      // 扫描类型
      passiveScan: true,
      activeScan: true,
      
      // 认证配置
      authentication: {
        type: 'form',
        loginUrl: '/login',
        usernameField: 'username',
        passwordField: 'password'
      },
      
      // 排除路径
      excludePaths: [
        '/logout',
        '/admin/delete'
      ],
      
      // 扫描深度
      maxDepth: 5,
      maxChildren: 100
    }
  },
  
  // 扫描结果处理
  processResults: function(results) {
    const vulnerabilities = [];
    
    for (const alert of results.alerts) {
      if (alert.risk > 1) { // 忽略低风险
        vulnerabilities.push({
          id: alert.id,
          name: alert.name,
          risk: alert.risk,
          confidence: alert.confidence,
          description: alert.description,
          solution: alert.solution,
          url: alert.url,
          param: alert.param
        });
      }
    }
    
    return vulnerabilities;
  }
};

// OWASP ZAP 自动化测试
const zapAutomation = {
  // API 配置
  apiConfig: {
    baseUrl: 'http://localhost:8080',
    apiKey: process.env.ZAP_API_KEY
  },
  
  // 自动化扫描脚本
  async automatedScan(targetUrl) {
    const axios = require('axios');
    const { baseUrl, apiKey } = this.apiConfig;
    
    try {
      // 1. 访问目标
      await axios.get(`${baseUrl}/JSON/core/action/accessUrl/`, {
        params: {
          url: targetUrl,
          apiKey: apiKey
        }
      });
      
      // 2. 启动被动扫描
      await axios.get(`${baseUrl}/JSON/ascan/action/scan/`, {
        params: {
          url: targetUrl,
          recurse: true,
          apiKey: apiKey
        }
      });
      
      // 3. 等待扫描完成
      let scanProgress = 0;
      while (scanProgress < 100) {
        const progressResponse = await axios.get(`${baseUrl}/JSON/ascan/view/status/`, {
          params: { apiKey: apiKey }
        });
        
        scanProgress = parseInt(progressResponse.data.status);
        console.log(`Scan progress: ${scanProgress}%`);
        await new Promise(resolve => setTimeout(resolve, 5000));
      }
      
      // 4. 获取扫描结果
      const alertsResponse = await axios.get(`${baseUrl}/JSON/core/view/alerts/`, {
        params: {
          baseurl: targetUrl,
          apiKey: apiKey
        }
      });
      
      return alertsResponse.data.alerts;
    } catch (error) {
      console.error('ZAP scan failed:', error);
      throw error;
    }
  }
};

// 使用示例
async function runSecurityScan() {
  const alerts = await zapAutomation.automatedScan('https://example.com');
  console.log('Security scan completed with', alerts.length, 'alerts');
  
  // 处理扫描结果
  for (const alert of alerts) {
    console.log(`[${alert.risk}] ${alert.name}: ${alert.url}`);
  }
}

// Burp Suite 扩展示例（Python）
const burpExtensionExample = {
  extensionCode: `
from burp import IBurpExtender, IScannerCheck
from java.io import PrintWriter
import re

class BurpExtender(IBurpExtender, IScannerCheck):
    def registerExtenderCallbacks(self, callbacks):
        self._callbacks = callbacks
        self._helpers = callbacks.getHelpers()
        callbacks.setExtensionName("Custom Security Scanner")
        self.stdout = PrintWriter(callbacks.getStdout(), True)
        
    def doPassiveScan(self, baseRequestResponse):
        issues = []
        
        # 检查敏感信息泄露
        response = baseRequestResponse.getResponse()
        responseStr = self._helpers.bytesToString(response)
        
        # 检查密码泄露
        if re.search(r'password\\s*[:=]\\s*[\\w\\d\\S]{3,20}', responseStr, re.IGNORECASE):
            issues.append(self.createIssue(
                baseRequestResponse.getHttpService(),
                self._helpers.analyzeRequest(baseRequestResponse).getUrl(),
                [baseRequestResponse],
                "Sensitive Information Disclosure",
                "Password may be exposed in response",
                "High"
            ))
        
        return issues
    
    def doActiveScan(self, baseRequestResponse, insertionPoint):
        # 实现主动扫描逻辑
        return []
    
    def consolidateDuplicateIssues(self, existingIssue, newIssue):
        if existingIssue.getUrl() == newIssue.getUrl() and existingIssue.getIssueName() == newIssue.getIssueName():
            return -1
        return 0
  `
};

// SonarQube 集成示例
const sonarQubeIntegration = {
  // SonarQube 扫描配置
  sonarProperties: `
# 项目配置
sonar.projectKey=myapp
sonar.projectName=My Application
sonar.projectVersion=1.0

# 源代码路径
sonar.sources=src
sonar.tests=test

# 代码覆盖率
sonar.javascript.lcov.reportPaths=coverage/lcov.info

# 安全规则
sonar.security.reportPath=security-report.json

# 排除文件
sonar.exclusions=**/node_modules/**,**/test/**,**/tests/**
  `,
  
  // 运行 SonarQube 扫描
  async runSonarScan() {
    const { exec } = require('child_process');
    
    return new Promise((resolve, reject) => {
      exec('sonar-scanner', (error, stdout, stderr) => {
        if (error) {
          console.error('SonarQube scan failed:', error);
          reject(error);
          return;
        }
        
        console.log('SonarQube scan completed');
        resolve(stdout);
      });
    });
  }
};

// 依赖安全检查
const dependencySecurity = {
  // 检查 npm 依赖
  async checkNpmDependencies() {
    const { exec } = require('child_process');
    
    return new Promise((resolve, reject) => {
      exec('npm audit --json', (error, stdout, stderr) => {
        if (error) {
          reject(error);
          return;
        }
        
        try {
          const auditResult = JSON.parse(stdout);
          resolve(this.processNpmAudit(auditResult));
        } catch (parseError) {
          reject(parseError);
        }
      });
    });
  },
  
  // 处理 npm audit 结果
  processNpmAudit(auditResult) {
    if (!auditResult.vulnerabilities) {
      return { vulnerabilities: [], summary: {} };
    }
    
    const vulnerabilities = [];
    const summary = auditResult.metadata?.vulnerabilities || {};
    
    for (const [packageName, vulnInfo] of Object.entries(auditResult.vulnerabilities)) {
      if (vulnInfo.severity && vulnInfo.severity !== 'low') {
        vulnerabilities.push({
          name: packageName,
          severity: vulnInfo.severity,
          module: vulnInfo.via?.[0]?.module || packageName,
          vulnerable_versions: vulnInfo.vulnerable_versions,
          overview: vulnInfo.overview,
          recommendation: vulnInfo.recommendation,
          effects: vulnInfo.effects
        });
      }
    }
    
    return {
      vulnerabilities,
      summary,
      hasCritical: summary.critical > 0 || summary.high > 0
    };
  },
  
  // 自动修复建议
  getFixRecommendations(vulnerabilities) {
    const recommendations = {
      update: [],
      remove: [],
      alternatives: []
    };
    
    for (const vuln of vulnerabilities) {
      if (vuln.severity === 'critical' || vuln.severity === 'high') {
        recommendations.update.push({
          package: vuln.name,
          command: `npm update ${vuln.name}`,
          versions: vuln.vulnerable_versions
        });
      }
    }
    
    return recommendations;
  }
};

// API 安全测试框架
const apiSecurityTesting = {
  // 测试用例定义
  testCases: {
    // XSS 测试
    xssTest: {
      name: 'XSS 测试',
      description: '测试反射型和存储型 XSS',
      payload: [
        '<script>alert("XSS")</script>',
        'javascript:alert("XSS")',
        '<img src=x onerror=alert("XSS")>'
      ],
      endpoints: ['/search', '/comment', '/profile']
    },
    
    // SQL 注入测试
    sqlInjectionTest: {
      name: 'SQL 注入测试',
      description: '测试各种 SQL 注入漏洞',
      payload: [
        "' OR '1'='1",
        "' UNION SELECT * FROM users--",
        '1; DROP TABLE users--'
      ],
      endpoints: ['/user', '/search', '/login']
    },
    
    // 认证绕过测试
    authBypassTest: {
      name: '认证绕过测试',
      description: '测试认证和授权机制',
      tests: [
        { header: 'Authorization', value: 'Bearer invalid_token' },
        { header: 'X-Forwarded-For', value: '127.0.0.1' },
        { header: 'X-Original-Host', value: 'admin.example.com' }
      ],
      endpoints: ['/admin', '/api/admin']
    }
  },
  
  // 执行安全测试
  async executeSecurityTests(baseUrl, testCases = null) {
    const axios = require('axios');
    const results = [];
    
    const testsToRun = testCases || this.testCases;
    
    for (const [testName, testCase] of Object.entries(testsToRun)) {
      console.log(`Running ${testCase.name}...`);
      
      for (const endpoint of testCase.endpoints) {
        for (const payload of testCase.payload) {
          try {
            const response = await axios.post(`${baseUrl}${endpoint}`, {
              data: payload
            }, {
              timeout: 5000,
              validateStatus: () => true // 接受所有状态码
            });
            
            // 检查响应中是否包含恶意负载
            const responseBody = response.data?.toString() || '';
            const isVulnerable = this.checkVulnerability(response, payload);
            
            if (isVulnerable) {
              results.push({
                test: testName,
                endpoint: endpoint,
                payload: payload,
                vulnerable: true,
                status: response.status,
                responseLength: responseBody.length
              });
            }
          } catch (error) {
            console.error(`Error testing ${endpoint}:`, error.message);
          }
        }
      }
    }
    
    return results;
  },
  
  // 检查漏洞
  checkVulnerability(response, payload) {
    const responseBody = response.data?.toString() || '';
    
    // XSS 检查
    if (responseBody.includes(payload) && this.isXssPayload(payload)) {
      return true;
    }
    
    // 其他漏洞检查...
    return false;
  },
  
  // XSS 负载检测
  isXssPayload(payload) {
    const xssPatterns = [
      /<script/i,
      /javascript:/i,
      /on\w+\s*=/i,
      /<iframe/i,
      /<img/i
    ];
    
    return xssPatterns.some(pattern => pattern.test(payload));
  }
};

// 安全头测试
const securityHeaderTesting = {
  // 预期的安全头
  expectedHeaders: {
    'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
    'X-Frame-Options': 'DENY|SAMEORIGIN',
    'X-Content-Type-Options': 'nosniff',
    'X-XSS-Protection': '1; mode=block',
    'Content-Security-Policy': '.+',
    'Referrer-Policy': '.+',
    'Permissions-Policy': '.+'
  },
  
  // 测试安全头
  async testSecurityHeaders(url) {
    const axios = require('axios');
    
    try {
      const response = await axios.get(url, {
        timeout: 10000
      });
      
      const headers = response.headers;
      const results = {
        url: url,
        present: {},
        missing: [],
        invalid: []
      };
      
      for (const [headerName, expectedPattern] of Object.entries(this.expectedHeaders)) {
        const headerValue = headers[headerName.toLowerCase()];
        
        if (!headerValue) {
          results.missing.push(headerName);
        } else {
          // 检查值是否符合预期模式
          const pattern = new RegExp(expectedPattern);
          if (pattern.test(headerValue)) {
            results.present[headerName] = headerValue;
          } else {
            results.invalid.push({
              header: headerName,
              actual: headerValue,
              expected: expectedPattern
            });
          }
        }
      }
      
      return results;
    } catch (error) {
      throw new Error(`Failed to test security headers for ${url}: ${error.message}`);
    }
  },
  
  // 批量测试
  async batchTestSecurityHeaders(urls) {
    const results = [];
    
    for (const url of urls) {
      try {
        const result = await this.testSecurityHeaders(url);
        results.push(result);
      } catch (error) {
        results.push({
          url: url,
          error: error.message
        });
      }
    }
    
    return results;
  }
};

// CI/CD 安全测试集成
const cicdSecurityTesting = {
  // GitHub Actions 配置示例
  githubActionsConfig: `
name: Security Tests
on: [push, pull_request]

jobs:
  security-test:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    
    - name: Setup Node.js
      uses: actions/setup-node@v2
      with:
        node-version: '16'
    
    - name: Install dependencies
      run: npm ci
    
    - name: Run dependency check
      run: npm audit --audit-level high
    
    - name: Run SAST scan
      uses: sonarqube-quality-gate-action@v1
      env:
        SONAR_TOKEN: \${{ secrets.SONAR_TOKEN }}
        SONAR_HOST_URL: \${{ secrets.SONAR_HOST_URL }}
    
    - name: Run DAST scan
      run: |
        docker run -d --name zap -p 8080:8080 owasp/zap2docker-stable zap.sh -daemon -host 0.0.0.0 -port 8080 -config api.addrs.addr.name=.* -config api.addrs.addr.regex=true
        sleep 30
        python3 run_zap_scan.py \${{ secrets.TARGET_URL }}
  `,
  
  // Jenkins Pipeline 配置示例
  jenkinsPipeline: `
pipeline {
    agent any
    
    stages {
        stage('Security Test') {
            steps {
                script {
                    // 依赖安全扫描
                    sh 'npm audit --audit-level high'
                    
                    // SAST 扫描
                    sh '''
                        sonar-scanner \
                        -Dsonar.projectKey=myapp \
                        -Dsonar.sources=src \
                        -Dsonar.host.url=\${SONAR_HOST_URL} \
                        -Dsonar.token=\${SONAR_TOKEN}
                    '''
                    
                    // DAST 扫描
                    sh 'docker run --rm -v $(pwd):/zap/wrk:rw -t owasp/zap2docker-stable zap-baseline.py -t https://example.com -d'
                }
            }
        }
    }
    
    post {
        always {
            // 发布安全报告
            publishHTML([
                allowMissing: false,
                alwaysLinkToLastBuild: true,
                keepAll: true,
                reportDir: 'target/site',
                reportFiles: 'index.html',
                reportName: 'Security Report'
            ])
        }
    }
}
  `
};

// 自动化安全测试脚本
const automatedSecurityTests = {
  // 测试配置
  config: {
    target: process.env.SECURITY_TEST_TARGET || 'http://localhost:3000',
    maxConcurrent: 5,
    timeout: 30000,
    reportPath: './security-reports'
  },
  
  // 运行所有安全测试
  async runAllTests() {
    const startTime = Date.now();
    const results = {
      summary: {},
      details: {},
      timestamp: new Date().toISOString()
    };
    
    try {
      // 1. 依赖安全检查
      console.log('Running dependency security check...');
      results.details.dependencies = await dependencySecurity.checkNpmDependencies();
      
      // 2. 安全头测试
      console.log('Running security header tests...');
      results.details.securityHeaders = await securityHeaderTesting.batchTestSecurityHeaders([
        this.config.target,
        `${this.config.target}/api`,
        `${this.config.target}/admin`
      ]);
      
      // 3. API 安全测试
      console.log('Running API security tests...');
      results.details.apiSecurity = await apiSecurityTesting.executeSecurityTests(this.config.target);
      
      // 4. 生成汇总报告
      results.summary = this.generateSummary(results.details);
      
      // 5. 保存报告
      await this.saveReport(results);
      
      const duration = Date.now() - startTime;
      console.log(`Security tests completed in ${duration}ms`);
      
      return results;
    } catch (error) {
      console.error('Security test failed:', error);
      throw error;
    }
  },
  
  // 生成汇总报告
  generateSummary(details) {
    const summary = {
      totalTests: 0,
      vulnerabilitiesFound: 0,
      criticalIssues: 0,
      highIssues: 0,
      mediumIssues: 0,
      lowIssues: 0,
      passed: true
    };
    
    // 统计依赖漏洞
    if (details.dependencies?.vulnerabilities) {
      summary.totalTests++;
      const vulns = details.dependencies.vulnerabilities;
      summary.vulnerabilitiesFound += vulns.length;
      
      for (const vuln of vulns) {
        if (vuln.severity === 'critical') summary.criticalIssues++;
        else if (vuln.severity === 'high') summary.highIssues++;
        else if (vuln.severity === 'medium') summary.mediumIssues++;
        else if (vuln.severity === 'low') summary.lowIssues++;
      }
    }
    
    // 统计 API 漏洞
    if (details.apiSecurity) {
      summary.totalTests++;
      const apiVulns = details.apiSecurity.filter(v => v.vulnerable);
      summary.vulnerabilitiesFound += apiVulns.length;
      summary.criticalIssues += apiVulns.length; // 假设都是严重问题
    }
    
    // 统计安全头问题
    if (details.securityHeaders) {
      summary.totalTests++;
      for (const result of details.securityHeaders) {
        if (result.missing || result.invalid) {
          summary.vulnerabilitiesFound += (result.missing?.length || 0) + (result.invalid?.length || 0);
          summary.mediumIssues += (result.missing?.length || 0) + (result.invalid?.length || 0);
        }
      }
    }
    
    summary.passed = summary.criticalIssues === 0 && summary.highIssues === 0;
    
    return summary;
  },
  
  // 保存报告
  async saveReport(results) {
    const fs = require('fs').promises;
    const path = require('path');
    
    const reportPath = path.join(this.config.reportPath, `security-report-${Date.now()}.json`);
    
    // 确保目录存在
    await fs.mkdir(this.config.reportPath, { recursive: true });
    
    // 保存报告
    await fs.writeFile(reportPath, JSON.stringify(results, null, 2));
    
    console.log(`Security report saved to: ${reportPath}`);
  }
};

// 命令行接口
async function runSecurityTests() {
  try {
    const results = await automatedSecurityTests.runAllTests();
    
    console.log('\n=== SECURITY TEST RESULTS ===');
    console.log(`Total Tests: ${results.summary.totalTests}`);
    console.log(`Vulnerabilities Found: ${results.summary.vulnerabilitiesFound}`);
    console.log(`Critical: ${results.summary.criticalIssues}`);
    console.log(`High: ${results.summary.highIssues}`);
    console.log(`Medium: ${results.summary.mediumIssues}`);
    console.log(`Low: ${results.summary.lowIssues}`);
    console.log(`Passed: ${results.summary.passed ? '✓' : '✗'}`);
    
    if (!results.summary.passed) {
      process.exit(1); // 失败时退出码为 1
    }
  } catch (error) {
    console.error('Security tests failed:', error);
    process.exit(1);
  }
}

// 如果直接运行此文件
if (require.main === module) {
  runSecurityTests();
}

// 安全监控系统
const securityMonitoring = {
  // 监控指标
  metrics: {
    failedLoginAttempts: 0,
    suspiciousRequests: 0,
    sqlInjectionAttempts: 0,
    xssAttempts: 0,
    unauthorizedAccess: 0
  },
  
  // 安全事件检测
  detectSecurityEvents(req, res, next) {
    // 检测 SQL 注入尝试
    if (this.detectSqlInjection(req)) {
      this.logSecurityEvent('SQL_INJECTION_ATTEMPT', req);
      this.metrics.sqlInjectionAttempts++;
    }
    
    // 检测 XSS 尝试
    if (this.detectXss(req)) {
      this.logSecurityEvent('XSS_ATTEMPT', req);
      this.metrics.xssAttempts++;
    }
    
    // 检测可疑的用户代理
    if (this.detectSuspiciousUserAgent(req)) {
      this.logSecurityEvent('SUSPICIOUS_USER_AGENT', req);
      this.metrics.suspiciousRequests++;
    }
    
    next();
  },
  
  // SQL 注入检测
  detectSqlInjection(req) {
    const sqlPatterns = [
      /(\bUNION\b|\bSELECT\b|\bINSERT\b|\bUPDATE\b|\bDELETE\b|\bDROP\b|\bCREATE\b|\bALTER\b)/i,
      /('|--|;|\/\*|\*\/|xp_|sp_|exec|execute)/i,
      /(information_schema|sysobjects|pg_tables|sqlite_master)/i
    ];
    
    const content = JSON.stringify(req.query) + JSON.stringify(req.body) + req.url;
    
    return sqlPatterns.some(pattern => pattern.test(content));
  },
  
  // XSS 检测
  detectXss(req) {
    const xssPatterns = [
      /<script/i,
      /javascript:/i,
      /vbscript:/i,
      /on\w+\s*=/i,
      /<iframe/i,
      /<img/i
    ];
    
    const content = JSON.stringify(req.query) + JSON.stringify(req.body) + req.url;
    
    return xssPatterns.some(pattern => pattern.test(content));
  },
  
  // 可疑用户代理检测
  detectSuspiciousUserAgent(req) {
    const suspiciousAgents = [
      /sqlmap/i,
      /nikto/i,
      /nessus/i,
      /burp/i,
      /zaproxy/i,
      /nmap/i
    ];
    
    const userAgent = req.headers['user-agent'] || '';
    
    return suspiciousAgents.some(pattern => pattern.test(userAgent));
  },
  
  // 记录安全事件
  logSecurityEvent(type, req) {
    const event = {
      type,
      timestamp: new Date().toISOString(),
      ip: req.ip,
      userAgent: req.headers['user-agent'],
      url: req.url,
      method: req.method,
      params: req.query,
      body: req.body
    };
    
    console.error('SECURITY EVENT:', event);
    
    // 可以发送到日志服务或 SIEM 系统
    this.sendToSecurityLog(event);
  },
  
  // 发送安全日志
  sendToSecurityLog(event) {
    // 实现日志发送逻辑
    // 可以发送到 ELK、Splunk 等系统
  }
};

// 在应用中使用安全监控
app.use(securityMonitoring.detectSecurityEvents.bind(securityMonitoring));

// 安全测试报告生成器
const securityReportGenerator = {
  // 生成 HTML 报告
  generateHtmlReport(results) {
    return `
<!DOCTYPE html>
<html>
<head>
    <title>Security Test Report</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        .header { background-color: #f4f4f4; padding: 20px; border-radius: 5px; }
        .summary { display: grid; grid-template-columns: repeat(auto-fit, minmax(200px, 1fr)); gap: 20px; margin: 20px 0; }
        .metric { background-color: #e7f3ff; padding: 15px; border-radius: 5px; text-align: center; }
        .metric.critical { background-color: #ffebee; }
        .metric.high { background-color: #fff3e0; }
        .metric.medium { background-color: #fff8e1; }
        .metric.passed { background-color: #e8f5e8; }
        .vulnerability { border: 1px solid #ddd; margin: 10px 0; padding: 15px; border-radius: 5px; }
        .critical { border-left: 5px solid #f44336; }
        .high { border-left: 5px solid #ff9800; }
        .medium { border-left: 5px solid #ffc107; }
    </style>
</head>
<body>
    <div class="header">
        <h1>Security Test Report</h1>
        <p>Generated on: ${results.timestamp}</p>
        <p>Target: ${results.config?.target || 'Unknown'}</p>
    </div>
    
    <div class="summary">
        <div class="metric">
            <h3>Total Tests</h3>
            <p>${results.summary.totalTests}</p>
        </div>
        <div class="metric ${results.summary.criticalIssues > 0 ? 'critical' : 'passed'}">
            <h3>Critical</h3>
            <p>${results.summary.criticalIssues}</p>
        </div>
        <div class="metric ${results.summary.highIssues > 0 ? 'high' : 'passed'}">
            <h3>High</h3>
            <p>${results.summary.highIssues}</p>
        </div>
        <div class="metric ${results.summary.mediumIssues > 0 ? 'medium' : 'passed'}">
            <h3>Medium</h3>
            <p>${results.summary.mediumIssues}</p>
        </div>
        <div class="metric ${results.summary.passed ? 'passed' : 'critical'}">
            <h3>Status</h3>
            <p>${results.summary.passed ? 'PASSED' : 'FAILED'}</p>
        </div>
    </div>
    
    <h2>Test Details</h2>
    ${this.generateTestSection('Dependencies', results.details.dependencies)}
    ${this.generateTestSection('API Security', results.details.apiSecurity)}
    ${this.generateTestSection('Security Headers', results.details.securityHeaders)}
</body>
</html>
    `;
  },
  
  // 生成测试部分
  generateTestSection(title, data) {
    if (!data) return '';
    
    if (Array.isArray(data) && data.length > 0) {
      const items = data.map(item => `
        <div class="vulnerability ${this.getVulnerabilityClass(item)}">
          <h4>${item.name || item.url || item.endpoint || 'Issue'}</h4>
          <p>${item.description || item.message || item.payload || 'Details not available'}</p>
        </div>
      `).join('');
      
      return `<h3>${title}</h3>${items}`;
    }
    
    return `<h3>${title}</h3><p>No issues found</p>`;
  },
  
  // 获取漏洞级别 CSS 类
  getVulnerabilityClass(item) {
    if (item.severity === 'critical') return 'critical';
    if (item.severity === 'high') return 'high';
    if (item.severity === 'medium') return 'medium';
    return '';
  }
};