17. 前端安全和最佳实践

// 简化的安全检查示例
class SimpleSecurityChecker {
  static checkBasicSecurity() {
    const checks = {
      https: location.protocol === 'https:',
      csp: !!document.querySelector('meta[http-equiv*="Content-Security-Policy"]'),
      xFrameOptions: this.hasSecurityHeader('X-Frame-Options'),
      noSniff: this.hasSecurityHeader('X-Content-Type-Options')
    };
 
    const score = Object.values(checks).filter(Boolean).length;
    return { checks, score: (score / 4) * 100 };
  }
 
  static hasSecurityHeader(header) {
    // 简化检查，实际需要检查HTTP响应头
    return document.querySelector(`meta[http-equiv="${header}"]`) !== null;
  }
}
 
 

// 简单的XSS防护工具
class SimpleXSSProtection {
  // HTML实体编码
  static escapeHTML(str) {
    const entityMap = {
      '&': '&',
      '<': '&lt;',
      '>': '&gt;',
      '"': '&quot;',
      "'": '&#x27;',
      '/': '&#x2F;'
    };
 
    return String(str).replace(/[&<>"'/]/g, (s) => entityMap[s]);
  }
 
  // 安全地设置文本内容
  static safeSetText(element, text) {
    element.textContent = text; // 使用textContent而不是innerHTML
  }
 
  // 安全地设置HTML内容（使用DOMPurify等库）
  static safeSetHTML(element, html) {
    // 实际项目中应使用DOMPurify库
    element.innerHTML = this.escapeHTML(html);
  }

<!-- CSP配置示例 -->
<meta http-equiv="Content-Security-Policy"
      content="default-src 'self';
               script-src 'self' 'unsafe-inline' https://cdn.example.com;
               style-src 'self' 'unsafe-inline';
               img-src 'self' data: https:;">

// 动态设置CSP
function setCSP() {
  const meta = document.createElement('meta');
  meta.httpEquiv = 'Content-Security-Policy';
  meta.content = "default-src 'self'; script-src 'self' 'unsafe-inline'";
  document.head.appendChild(meta);

// 简单的CSRF防护工具
class SimpleCSRFProtection {
  // 生成CSRF Token
  static generateToken() {
    return Math.random().toString(36).substring(2) + Date.now().toString(36);
  }
 
  // 设置CSRF Token到表单
  static addTokenToForm(form) {
    const token = this.generateToken();
    sessionStorage.setItem('csrf_token', token);
 
    const input = document.createElement('input');
    input.type = 'hidden';
    input.name = 'csrf_token';
    input.value = token;
    form.appendChild(input);
  }
 
  // 验证CSRF Token
  static validateToken(submittedToken) {
    const storedToken = sessionStorage.getItem('csrf_token');
    return submittedToken === storedToken;
  }

// 设置安全的Cookie
function setSecureCookie(name, value, options = {}) {
  const defaults = {
    secure: true,        // 仅HTTPS传输
    httpOnly: true,      // 防止XSS访问
    sameSite: 'Lax',     // 防止CSRF
    maxAge: 3600         // 1小时过期
  };
 
  const config = { ...defaults, ...options };
  const cookieString = `${name}=${value}; ${Object.entries(config)
    .map(([key, val]) => `${key}=${val}`)
    .join('; ')}`;
 
  document.cookie = cookieString;

<!-- 阶段1：监控模式 -->
<meta http-equiv="Content-Security-Policy-Report-Only"
      content="default-src 'self'; report-uri /csp-report">
 
<!-- 阶段2：宽松策略 -->
<meta http-equiv="Content-Security-Policy"
      content="default-src 'self';
               script-src 'self' 'unsafe-inline' https://cdn.example.com;
               style-src 'self' 'unsafe-inline';">
 
<!-- 阶段3：严格策略 -->
<meta http-equiv="Content-Security-Policy"
      content="default-src 'self';
               script-src 'self' https://cdn.example.com;
               style-src 'self';">

// CSP管理工具
class CSPManager {
  constructor() {
    this.policies = new Map();
    this.nonces = new Map();
  }
 
  // 生成随机nonce
  generateNonce() {
    const array = new Uint8Array(16);
    crypto.getRandomValues(array);
    return btoa(String.fromCharCode.apply(null, array));
  }
 
  // 设置页面级CSP
  setPageCSP(policies) {
    const cspString = Object.entries(policies)
      .map(([directive, sources]) => {
        const sourceList = Array.isArray(sources) ? sources.join(' ') : sources;
        return `${directive} ${sourceList}`;
      })
      .join('; ');
 
    const meta = document.createElement('meta');
    meta.httpEquiv = 'Content-Security-Policy';
    meta.content = cspString;
    document.head.appendChild(meta);
  }
 
  // 为内联脚本生成nonce
  createInlineScript(code, nonce = null) {
    if (!nonce) {
      nonce = this.generateNonce();
    }
 
    const script = document.createElement('script');
    script.nonce = nonce;
    script.textContent = code;
 
    return { script, nonce };
  }
 
  // 验证CSP违规
  handleCSPViolation(event) {
    const violation = {
      documentURI: event.documentURI,
      violatedDirective: event.violatedDirective,
      blockedURI: event.blockedURI,
      lineNumber: event.lineNumber,
      sourceFile: event.sourceFile,
      timestamp: Date.now()
    };
 
    // 发送违规报告
    this.reportViolation(violation);
  }
 
  // 发送违规报告
  async reportViolation(violation) {
    try {
      await fetch('/api/csp-report', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(violation)
      });
    } catch (error) {
      console.error('Failed to report CSP violation:', error);
    }
  }
}
 
// 使用示例
const cspManager = new CSPManager();
 
// 设置严格的CSP策略
cspManager.setPageCSP({
  'default-src': "'self'",
  'script-src': "'self' 'nonce-abc123'",
  'style-src': "'self' 'unsafe-inline'",
  'img-src': "'self' data: https:",
  'connect-src': "'self' https://api.example.com"
});
 
// 监听CSP违规事件
document.addEventListener('securitypolicyviolation', (event) => {
  cspManager.handleCSPViolation(event);
});

// CSP配置模板
const CSPTemplates = {
  // 严格模式 - 最高安全性
  strict: {
    'default-src': "'none'",
    'script-src': "'self'",
    'style-src': "'self'",
    'img-src': "'self' data:",
    'font-src': "'self'",
    'connect-src': "'self'",
    'object-src': "'none'",
    'base-uri': "'self'",
    'form-action': "'self'"
  },
 
  // 平衡模式 - 安全性与兼容性平衡
  balanced: {
    'default-src': "'self'",
    'script-src': "'self' 'unsafe-inline' https://cdn.jsdelivr.net",
    'style-src': "'self' 'unsafe-inline' https://fonts.googleapis.com",
    'img-src': "'self' data: https:",
    'font-src': "'self' https://fonts.gstatic.com",
    'connect-src': "'self' https://api.example.com"
  },
 
  // 宽松模式 - 兼容性优先
  permissive: {
    'default-src': "'self'",
    'script-src': "'self' 'unsafe-inline' 'unsafe-eval'",
    'style-src': "'self' 'unsafe-inline'",
    'img-src': "*",
    'font-src': "*"
  }
};

// 安全头配置
const SecurityHeaders = {
  // 强制HTTPS
  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains; preload',
 
  // 防止点击劫持
  'X-Frame-Options': 'DENY',
 
  // 防止MIME类型嗅探
  'X-Content-Type-Options': 'nosniff',
 
  // XSS保护
  'X-XSS-Protection': '1; mode=block',
 
  // 引用策略
  'Referrer-Policy': 'strict-origin-when-cross-origin',
 
  // 权限策略
  'Permissions-Policy': 'geolocation=(), microphone=(), camera=()'
};
 
// 检查安全头
class SecurityHeaderChecker {
  static async checkHeaders(url) {
    try {
      const response = await fetch(url, { method: 'HEAD' });
      const headers = {};
 
      for (const [key, value] of response.headers.entries()) {
        headers[key] = value;
      }
 
      return this.analyzeHeaders(headers);
    } catch (error) {
      return { error: error.message };
    }
  }
 
  static analyzeHeaders(headers) {
    const analysis = {
      score: 0,
      maxScore: 0,
      details: {}
    };
 
    const checks = [
      {
        name: 'HTTPS Enforcement',
        header: 'strict-transport-security',
        weight: 20,
        check: (value) => value && value.includes('max-age')
      },
      {
        name: 'Clickjacking Protection',
        header: 'x-frame-options',
        weight: 15,
        check: (value) => value && (value.includes('DENY') || value.includes('SAMEORIGIN'))
      },
      {
        name: 'MIME Sniffing Protection',
        header: 'x-content-type-options',
        weight: 10,
        check: (value) => value === 'nosniff'
      },
      {
        name: 'XSS Protection',
        header: 'x-xss-protection',
        weight: 10,
        check: (value) => value && value.includes('1')
      },
      {
        name: 'Content Security Policy',
        header: 'content-security-policy',
        weight: 25,
        check: (value) => value && value.length > 0
      }
    ];
 
    checks.forEach(check => {
      analysis.maxScore += check.weight;
      const headerValue = headers[check.header];
      const passed = check.check(headerValue);
 
      if (passed) {
        analysis.score += check.weight;
      }
 
      analysis.details[check.name] = {
        passed,
        value: headerValue || 'Not set',
        weight: check.weight
      };
    });
 
    analysis.grade = this.calculateGrade(analysis.score, analysis.maxScore);
    return analysis;
  }
 
  static calculateGrade(score, maxScore) {
    const percentage = (score / maxScore) * 100;
    if (percentage >= 90) return 'A';
    if (percentage >= 80) return 'B';
    if (percentage >= 70) return 'C';
    if (percentage >= 60) return 'D';
    return 'F';
  }
}

// 简单的前端加密工具
class SimpleCrypto {
  // 生成随机密钥
  static async generateKey() {
    return await crypto.subtle.generateKey(
      { name: 'AES-GCM', length: 256 },
      true,
      ['encrypt', 'decrypt']
    );
  }
 
  // 加密数据
  static async encrypt(data, key) {
    const iv = crypto.getRandomValues(new Uint8Array(12));
    const encodedData = new TextEncoder().encode(data);
 
    const encrypted = await crypto.subtle.encrypt(
      { name: 'AES-GCM', iv },
      key,
      encodedData
    );
 
    return { encrypted, iv };
  }
 
  // 解密数据
  static async decrypt(encryptedData, key, iv) {
    const decrypted = await crypto.subtle.decrypt(
      { name: 'AES-GCM', iv },
      key,
      encryptedData
    );
 
    return new TextDecoder().decode(decrypted);
  }

// 安全存储工具
class SecureStorage {
  // 加密存储到localStorage
  static async setEncrypted(key, data, password) {
    const cryptoKey = await this.deriveKey(password);
    const { encrypted, iv } = await SimpleCrypto.encrypt(JSON.stringify(data), cryptoKey);
 
    localStorage.setItem(key, JSON.stringify({
      data: Array.from(new Uint8Array(encrypted)),
      iv: Array.from(iv)
    }));
  }
 
  // 从localStorage解密读取
  static async getEncrypted(key, password) {
    const stored = localStorage.getItem(key);
    if (!stored) return null;
 
    const { data, iv } = JSON.parse(stored);
    const cryptoKey = await this.deriveKey(password);
 
    const decrypted = await SimpleCrypto.decrypt(
      new Uint8Array(data),
      cryptoKey,
      new Uint8Array(iv)
    );
 
    return JSON.parse(decrypted);
  }
 
  // 从密码派生密钥
  static async deriveKey(password) {
    const encoder = new TextEncoder();
    const keyMaterial = await crypto.subtle.importKey(
      'raw',
      encoder.encode(password),
      'PBKDF2',
      false,
      ['deriveKey']
    );
 
    return await crypto.subtle.deriveKey(
      {
        name: 'PBKDF2',
        salt: encoder.encode('salt'), // 实际应用中应使用随机salt
        iterations: 100000,
        hash: 'SHA-256'
      },
      keyMaterial,
      { name: 'AES-GCM', length: 256 },
      false,
      ['encrypt', 'decrypt']
    );
  }

// 简单的认证管理器
class SimpleAuthManager {
  constructor() {
    this.token = null;
    this.user = null;
    this.refreshTimer = null;
  }
 
  // 登录
  async login(credentials) {
    try {
      const response = await fetch('/api/auth/login', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(credentials)
      });
 
      if (response.ok) {
        const data = await response.json();
        this.setAuth(data.token, data.user);
        return { success: true, user: data.user };
      }
 
      return { success: false, error: 'Invalid credentials' };
    } catch (error) {
      return { success: false, error: error.message };
    }
  }
 
  // 设置认证信息
  setAuth(token, user) {
    this.token = token;
    this.user = user;
    this.scheduleRefresh();
  }
 
  // 登出
  logout() {
    this.token = null;
    this.user = null;
    if (this.refreshTimer) {
      clearTimeout(this.refreshTimer);
    }
  }
 
  // 检查是否已认证
  isAuthenticated() {
    return !!this.token && !!this.user;
  }
 
  // 获取当前用户
  getCurrentUser() {
    return this.user;
  }
 
  // 定时刷新token
  scheduleRefresh() {
    if (this.refreshTimer) {
      clearTimeout(this.refreshTimer);
    }
 
    // 15分钟后刷新
    this.refreshTimer = setTimeout(() => {
      this.refreshToken();
    }, 15 * 60 * 1000);
  }
 
  // 刷新token
  async refreshToken() {
    try {
      const response = await fetch('/api/auth/refresh', {
        method: 'POST',
        headers: {
          'Authorization': `Bearer ${this.token}`,
          'Content-Type': 'application/json'
        }
      });
 
      if (response.ok) {
        const data = await response.json();
        this.setAuth(data.token, data.user);
      } else {
        this.logout();
      }
    } catch (error) {
      console.error('Token refresh failed:', error);
      this.logout();
    }
  }

// 简单的权限控制
class SimplePermissionManager {
  constructor(user) {
    this.user = user;
    this.permissions = user?.permissions || [];
    this.roles = user?.roles || [];
  }
 
  // 检查权限
  hasPermission(permission) {
    return this.permissions.includes(permission);
  }
 
  // 检查角色
  hasRole(role) {
    return this.roles.includes(role);
  }
 
  // 检查多个权限（任一）
  hasAnyPermission(permissions) {
    return permissions.some(p => this.hasPermission(p));
  }
 
  // 检查多个权限（全部）
  hasAllPermissions(permissions) {
    return permissions.every(p => this.hasPermission(p));
  }
}
 
// React权限组件示例
function ProtectedComponent({ permission, children }) {
  const { user } = useAuth();
  const permissionManager = new SimplePermissionManager(user);
 
  if (!permissionManager.hasPermission(permission)) {
    return <div>Access Denied</div>;
  }
 
  return children;

// 简单的安全事件监控
class SimpleSecurityMonitor {
  constructor() {
    this.events = [];
    this.thresholds = {
      loginFailures: 5,
      xssAttempts: 1,
      csrfFailures: 10
    };
  }
 
  // 记录安全事件
  logEvent(type, details) {
    const event = {
      type,
      details,
      timestamp: Date.now(),
      userAgent: navigator.userAgent,
      ip: this.getClientIP()
    };
 
    this.events.push(event);
    this.checkThresholds(type);
    this.sendToServer(event);
  }
 
  // 检查阈值
  checkThresholds(type) {
    const recentEvents = this.getRecentEvents(type, 3600000); // 1小时内
    const threshold = this.thresholds[type];
 
    if (threshold && recentEvents.length >= threshold) {
      this.triggerAlert(type, recentEvents.length);
    }
  }
 
  // 获取最近事件
  getRecentEvents(type, timeWindow) {
    const cutoff = Date.now() - timeWindow;
    return this.events.filter(event =>
      event.type === type && event.timestamp > cutoff
    );
  }
 
  // 触发警报
  triggerAlert(type, count) {
    console.warn(`Security Alert: ${type} threshold exceeded (${count} events)`);
    // 实际应用中应发送到监控系统
  }
 
  // 发送到服务器
  async sendToServer(event) {
    try {
      await fetch('/api/security/events', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(event)
      });
    } catch (error) {
      console.error('Failed to send security event:', error);
    }
  }
 
  // 获取客户端IP（简化实现）
  getClientIP() {
    // 实际应用中需要服务端配合
    return 'unknown';
  }

// 安全编码检查工具
class SecureCodingChecker {
  static checkCode(code) {
    const issues = [];
 
    // 检查危险函数使用
    const dangerousFunctions = [
      'eval', 'Function', 'setTimeout', 'setInterval',
      'innerHTML', 'outerHTML', 'insertAdjacentHTML'
    ];
 
    dangerousFunctions.forEach(func => {
      const regex = new RegExp(`\\b${func}\\s*\\(`, 'g');
      const matches = code.match(regex);
      if (matches) {
        issues.push({
          type: 'dangerous-function',
          function: func,
          count: matches.length,
          severity: 'high',
          message: `使用了危险函数 ${func}，可能导致代码注入`
        });
      }
    });
 
    // 检查硬编码敏感信息
    const sensitivePatterns = [
      { name: 'API Key', pattern: /api[_-]?key\s*[:=]\s*['"][^'"]+['"]/gi },
      { name: 'Password', pattern: /password\s*[:=]\s*['"][^'"]+['"]/gi },
      { name: 'Token', pattern: /token\s*[:=]\s*['"][^'"]+['"]/gi },
      { name: 'Secret', pattern: /secret\s*[:=]\s*['"][^'"]+['"]/gi }
    ];
 
    sensitivePatterns.forEach(pattern => {
      const matches = code.match(pattern.pattern);
      if (matches) {
        issues.push({
          type: 'hardcoded-secret',
          pattern: pattern.name,
          count: matches.length,
          severity: 'critical',
          message: `发现硬编码的${pattern.name}，应使用环境变量`
        });
      }
    });
 
    // 检查不安全的随机数生成
    if (code.includes('Math.random()')) {
      issues.push({
        type: 'weak-random',
        severity: 'medium',
        message: 'Math.random()不适用于安全场景，应使用crypto.getRandomValues()'
      });
    }
 
    return {
      totalIssues: issues.length,
      criticalIssues: issues.filter(i => i.severity === 'critical').length,
      highIssues: issues.filter(i => i.severity === 'high').length,
      mediumIssues: issues.filter(i => i.severity === 'medium').length,
      issues
    };
  }
 
  // 生成安全报告
  static generateReport(checkResult) {
    const { totalIssues, criticalIssues, highIssues, mediumIssues, issues } = checkResult;
 
    let grade = 'A';
    if (criticalIssues > 0) grade = 'F';
    else if (highIssues > 3) grade = 'D';
    else if (highIssues > 1) grade = 'C';
    else if (highIssues > 0 || mediumIssues > 3) grade = 'B';
 
    return {
      grade,
      summary: {
        total: totalIssues,
        critical: criticalIssues,
        high: highIssues,
        medium: mediumIssues
      },
      recommendations: this.getRecommendations(issues)
    };
  }
 
  static getRecommendations(issues) {
    const recommendations = [];
 
    if (issues.some(i => i.type === 'dangerous-function')) {
      recommendations.push('使用安全的DOM操作方法，如textContent替代innerHTML');
    }
 
    if (issues.some(i => i.type === 'hardcoded-secret')) {
      recommendations.push('将敏感信息移至环境变量或安全配置文件');
    }
 
    if (issues.some(i => i.type === 'weak-random')) {
      recommendations.push('使用crypto.getRandomValues()生成安全随机数');
    }
 
    return recommendations;
  }
}

// 依赖安全检查工具
class DependencySecurityChecker {
  constructor() {
    this.vulnerabilityDB = new Map(); // 简化的漏洞数据库
  }
 
  // 检查package.json中的依赖
  async checkDependencies(packageJson) {
    const dependencies = {
      ...packageJson.dependencies,
      ...packageJson.devDependencies
    };
 
    const results = [];
 
    for (const [name, version] of Object.entries(dependencies)) {
      const result = await this.checkSingleDependency(name, version);
      results.push(result);
    }
 
    return this.generateDependencyReport(results);
  }
 
  async checkSingleDependency(name, version) {
    // 模拟依赖检查
    const vulnerabilities = await this.getVulnerabilities(name, version);
    const maintenance = await this.getMaintenanceInfo(name);
    const license = await this.getLicenseInfo(name);
 
    return {
      name,
      version,
      vulnerabilities,
      maintenance,
      license,
      riskScore: this.calculateRiskScore(vulnerabilities, maintenance)
    };
  }
 
  calculateRiskScore(vulnerabilities, maintenance) {
    let score = 0;
 
    // 漏洞风险
    vulnerabilities.forEach(vuln => {
      switch (vuln.severity) {
        case 'critical': score += 10; break;
        case 'high': score += 7; break;
        case 'medium': score += 4; break;
        case 'low': score += 1; break;
      }
    });
 
    // 维护风险
    if (maintenance.lastUpdate > 365) score += 5; // 超过1年未更新
    if (maintenance.weeklyDownloads < 1000) score += 3; // 使用量低
 
    return Math.min(score, 100);
  }
 
  generateDependencyReport(results) {
    const highRiskDeps = results.filter(r => r.riskScore >= 7);
    const mediumRiskDeps = results.filter(r => r.riskScore >= 4 && r.riskScore < 7);
    const totalVulns = results.reduce((sum, r) => sum + r.vulnerabilities.length, 0);
 
    return {
      summary: {
        totalDependencies: results.length,
        highRisk: highRiskDeps.length,
        mediumRisk: mediumRiskDeps.length,
        totalVulnerabilities: totalVulns
      },
      recommendations: this.generateRecommendations(highRiskDeps),
      details: results
    };
  }
 
  generateRecommendations(highRiskDeps) {
    const recommendations = [];
 
    highRiskDeps.forEach(dep => {
      if (dep.vulnerabilities.length > 0) {
        recommendations.push(`更新 ${dep.name} 以修复安全漏洞`);
      }
      if (dep.maintenance.lastUpdate > 365) {
        recommendations.push(`考虑替换长期未维护的依赖 ${dep.name}`);
      }
    });
 
    return recommendations;
  }
 
  // 模拟方法
  async getVulnerabilities(name, version) {
    // 实际应用中应查询真实的漏洞数据库
    return [];
  }
 
  async getMaintenanceInfo(name) {
    // 实际应用中应查询npm registry
    return {
      lastUpdate: Math.floor(Math.random() * 1000),
      weeklyDownloads: Math.floor(Math.random() * 100000)
    };
  }
 
  async getLicenseInfo(name) {
    // 实际应用中应查询包的许可证信息
    return { license: 'MIT', compatible: true };
  }
}

// 安全测试套件
class SecurityTestSuite {
  constructor() {
    this.testResults = [];
  }
 
  // XSS防护测试
  testXSSProtection() {
    const testCases = [
      '<script>alert("xss")</script>',
      'javascript:alert("xss")',
      '<img src="x" onerror="alert(\'xss\')">',
      '"><script>alert("xss")</script>',
      '\';alert("xss");//'
    ];
 
    const results = testCases.map(payload => {
      try {
        // 测试输入过滤
        const filtered = this.filterXSS(payload);
        const isBlocked = !filtered.includes('<script>') &&
                         !filtered.includes('javascript:') &&
                         !filtered.includes('onerror=');
 
        return {
          payload,
          filtered,
          blocked: isBlocked,
          passed: isBlocked
        };
      } catch (error) {
        return {
          payload,
          error: error.message,
          passed: false
        };
      }
    });
 
    this.testResults.push({
      test: 'XSS Protection',
      results,
      passed: results.every(r => r.passed)
    });
 
    return results;
  }
 
  // CSRF防护测试
  testCSRFProtection() {
    const testCases = [
      { method: 'POST', hasToken: false, expected: false },
      { method: 'POST', hasToken: true, validToken: false, expected: false },
      { method: 'POST', hasToken: true, validToken: true, expected: true },
      { method: 'GET', hasToken: false, expected: true } // GET请求通常不需要CSRF token
    ];
 
    const results = testCases.map(testCase => {
      const passed = this.validateCSRFToken(testCase) === testCase.expected;
      return { ...testCase, passed };
    });
 
    this.testResults.push({
      test: 'CSRF Protection',
      results,
      passed: results.every(r => r.passed)
    });
 
    return results;
  }
 
  // 输入验证测试
  testInputValidation() {
    const testCases = [
      { input: 'normal@email.com', type: 'email', expected: true },
      { input: 'invalid-email', type: 'email', expected: false },
      { input: '12345', type: 'number', expected: true },
      { input: 'abc', type: 'number', expected: false },
      { input: 'a'.repeat(1000), type: 'text', maxLength: 100, expected: false }
    ];
 
    const results = testCases.map(testCase => {
      const isValid = this.validateInput(testCase.input, testCase.type, testCase);
      return {
        ...testCase,
        valid: isValid,
        passed: isValid === testCase.expected
      };
    });
 
    this.testResults.push({
      test: 'Input Validation',
      results,
      passed: results.every(r => r.passed)
    });
 
    return results;
  }
 
  // 生成测试报告
  generateReport() {
    const totalTests = this.testResults.length;
    const passedTests = this.testResults.filter(t => t.passed).length;
    const failedTests = totalTests - passedTests;
 
    return {
      summary: {
        total: totalTests,
        passed: passedTests,
        failed: failedTests,
        passRate: totalTests > 0 ? (passedTests / totalTests * 100).toFixed(2) : 0
      },
      details: this.testResults,
      recommendations: this.generateTestRecommendations()
    };
  }
 
  generateTestRecommendations() {
    const recommendations = [];
 
    this.testResults.forEach(test => {
      if (!test.passed) {
        switch (test.test) {
          case 'XSS Protection':
            recommendations.push('加强XSS防护，检查输入过滤和输出编码');
            break;
          case 'CSRF Protection':
            recommendations.push('实施CSRF Token验证或SameSite Cookie');
            break;
          case 'Input Validation':
            recommendations.push('完善输入验证规则，确保数据格式和长度限制');
            break;
        }
      }
    });
 
    return recommendations;
  }
 
  // 辅助方法（简化实现）
  filterXSS(input) {
    return input
      .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, '')
      .replace(/javascript:/gi, '')
      .replace(/on\w+\s*=/gi, '');
  }
 
  validateCSRFToken(testCase) {
    if (testCase.method === 'GET') return true;
    if (!testCase.hasToken) return false;
    return testCase.validToken === true;
  }
 
  validateInput(input, type, options = {}) {
    switch (type) {
      case 'email':
        return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(input);
      case 'number':
        return !isNaN(input) && !isNaN(parseFloat(input));
      case 'text':
        return options.maxLength ? input.length <= options.maxLength : true;
      default:
        return true;
    }
  }
}