From 5254ca52fb1d6622411cc927a9f60ca879deda87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E5=85=AC=E6=98=8E?= <83812544+Ed1s0nZ@users.noreply.github.com> Date: Fri, 3 Jul 2026 10:46:04 +0800 Subject: [PATCH] Add files via upload --- web/static/css/style.css | 32 ++++++++++++++ web/static/i18n/en-US.json | 34 ++++++++++----- web/static/i18n/zh-CN.json | 34 ++++++++++----- web/static/js/vulnerability.js | 78 +++++++++++++++++++++++++++------- web/templates/index.html | 36 ++++++++++------ 5 files changed, 164 insertions(+), 50 deletions(-) diff --git a/web/static/css/style.css b/web/static/css/style.css index 31bcd3b7..d48d02e8 100644 --- a/web/static/css/style.css +++ b/web/static/css/style.css @@ -21370,6 +21370,13 @@ tr.mcp-stats-tool-row[data-tool-name]:focus-visible { flex: 1; } +.vulnerability-repro { + display: flex; + flex-direction: column; + gap: 12px; +} + +.vulnerability-section, .vulnerability-proof, .vulnerability-impact, .vulnerability-recommendation { @@ -21381,6 +21388,10 @@ tr.mcp-stats-tool-row[data-tool-name]:focus-visible { line-height: 1.6; } +.vulnerability-section:first-child { + margin-top: 0; +} + .vulnerability-proof pre { margin-top: 8px; padding: 12px; @@ -21394,6 +21405,27 @@ tr.mcp-stats-tool-row[data-tool-name]:focus-visible { word-wrap: break-word; } +.vulnerability-section-body { + margin-top: 8px; + color: var(--text-primary); + white-space: pre-wrap; + overflow-wrap: anywhere; +} + +.vulnerability-section-body--code { + margin-top: 8px; + padding: 12px; + background: var(--bg-primary); + border: 1px solid var(--border-color); + border-radius: 4px; + overflow-x: auto; + font-size: 0.8rem; + font-family: 'Monaco', 'Menlo', 'Ubuntu Mono', monospace; + white-space: pre-wrap; + word-wrap: break-word; +} + +.vulnerability-section strong, .vulnerability-proof strong, .vulnerability-impact strong, .vulnerability-recommendation strong { diff --git a/web/static/i18n/en-US.json b/web/static/i18n/en-US.json index 5c2496e0..7903b27e 100644 --- a/web/static/i18n/en-US.json +++ b/web/static/i18n/en-US.json @@ -2027,7 +2027,7 @@ "exportNoResults": "No vulnerabilities match the current filters", "exportStarted": "Started downloading {{count}} file(s)", "exportFailed": "Export failed", - "saveRequiredFields": "Please fill in conversation ID, title, and severity", + "saveRequiredFields": "Please fill in conversation ID, title, description, severity, type, target, reproduction steps, evidence/POC, impact, and remediation", "saveFailed": "Save failed", "fetchFailed": "Failed to fetch vulnerability", "deleteFailed": "Delete failed", @@ -2046,9 +2046,12 @@ "detailTaskQueueId": "Task queue ID", "detailConversationTag": "Conversation tag", "detailTaskTag": "Task tag", - "detailProof": "Proof", + "detailPreconditions": "Preconditions", + "detailReproductionSteps": "Reproduction steps", + "detailEvidence": "Evidence / POC", "detailImpact": "Impact", "detailRecommendation": "Remediation", + "detailRetestNotes": "Retest method", "downloadOkTitle": "Downloaded", "exportFailedMessage": "Export failed", "downloadFailed": "Download failed" @@ -2800,9 +2803,9 @@ "taskTag": "Task tag", "taskTagPlaceholder": "e.g. batch scan Q2, retest", "title": "Title", - "titlePlaceholder": "Vulnerability title", + "titlePlaceholder": "/api/login is vulnerable to SQL injection", "description": "Description", - "descriptionPlaceholder": "Detailed description", + "descriptionPlaceholder": "Describe the summary, trigger point, observed abnormal behavior, and why it is exploitable.", "severity": "Severity", "pleaseSelect": "Please select", "severityCritical": "Critical", @@ -2819,13 +2822,19 @@ "type": "Vulnerability type", "typePlaceholder": "e.g. SQL injection, XSS, CSRF", "target": "Target", - "targetPlaceholder": "Affected target (URL, IP, etc.)", - "proof": "Proof (POC)", - "proofPlaceholder": "Proof: request/response, screenshots, etc.", + "targetPlaceholder": "Be specific: URL, IP:port, endpoint path, and parameter name.", + "preconditions": "Preconditions", + "preconditionsPlaceholder": "Login state, permissions, account, headers/cookies, required data, environment/version; write none if not needed.", + "reproductionSteps": "Reproduction steps", + "reproductionStepsPlaceholder": "Number the steps and include entry point, parameter, payload, command, and observation point.", + "evidence": "Evidence / POC", + "evidencePlaceholder": "Raw request/response, curl/tool command, screenshot notes, logs, DNSLog/callback records, database results, file paths, timestamps, etc.", "impact": "Impact", - "impactPlaceholder": "Impact description", + "impactPlaceholder": "Describe the verified real-world impact, such as which data can be read or changed.", "recommendation": "Recommendation", - "recommendationPlaceholder": "Remediation" + "recommendationPlaceholder": "Write the concrete fix and retest criteria.", + "retestNotes": "Retest method", + "retestNotesPlaceholder": "How to verify the fix, including expected status code, error message, or access-control result." }, "vulnerabilityMd": { "headingBasic": "Basic information", @@ -2842,9 +2851,12 @@ "labelCreated": "Created at", "labelUpdated": "Updated at", "headingDescription": "Description", - "headingProof": "Proof (POC)", + "headingPreconditions": "Preconditions", + "headingReproductionSteps": "Reproduction steps", + "headingEvidence": "Evidence / POC", "headingImpact": "Impact", - "headingRecommendation": "Remediation" + "headingRecommendation": "Remediation", + "headingRetestNotes": "Retest method" }, "roleModal": { "addRole": "Add role", diff --git a/web/static/i18n/zh-CN.json b/web/static/i18n/zh-CN.json index 1765967c..9df82203 100644 --- a/web/static/i18n/zh-CN.json +++ b/web/static/i18n/zh-CN.json @@ -2015,7 +2015,7 @@ "exportNoResults": "当前筛选条件下无可导出漏洞", "exportStarted": "已开始下载 {{count}} 份报告", "exportFailed": "导出失败", - "saveRequiredFields": "请填写必填字段：会话ID、标题和严重程度", + "saveRequiredFields": "请填写必填字段：会话ID、标题、描述、严重程度、漏洞类型、目标、复现步骤、证据/POC、影响和修复建议", "saveFailed": "保存失败", "fetchFailed": "获取漏洞失败", "deleteFailed": "删除失败", @@ -2034,9 +2034,12 @@ "detailTaskQueueId": "任务队列ID", "detailConversationTag": "对话标签", "detailTaskTag": "任务标签", - "detailProof": "证明", + "detailPreconditions": "前置条件", + "detailReproductionSteps": "复现步骤", + "detailEvidence": "证据 / POC", "detailImpact": "影响", "detailRecommendation": "修复建议", + "detailRetestNotes": "复测方式", "downloadOkTitle": "下载成功", "exportFailedMessage": "导出失败", "downloadFailed": "下载失败" @@ -2788,9 +2791,9 @@ "taskTag": "任务标签", "taskTagPlaceholder": "如：批量扫描Q2、专项复测", "title": "标题", - "titlePlaceholder": "漏洞标题", + "titlePlaceholder": "/api/login 存在 SQL 注入", "description": "描述", - "descriptionPlaceholder": "漏洞详细描述", + "descriptionPlaceholder": "说明漏洞摘要、触发点、异常现象和为什么可被利用。", "severity": "严重程度", "pleaseSelect": "请选择", "severityCritical": "严重", @@ -2807,13 +2810,19 @@ "type": "漏洞类型", "typePlaceholder": "如：SQL注入、XSS、CSRF等", "target": "目标", - "targetPlaceholder": "受影响的目标（URL、IP地址等）", - "proof": "证明（POC）", - "proofPlaceholder": "漏洞证明，如请求/响应、截图等", + "targetPlaceholder": "精确到 URL/IP:端口/接口路径/参数名", + "preconditions": "前置条件", + "preconditionsPlaceholder": "登录状态、权限、账号、Header/Cookie、特定数据、环境/版本；无则写无。", + "reproductionSteps": "复现步骤", + "reproductionStepsPlaceholder": "按 1/2/3 编号，写清入口、参数、payload、执行命令、观察点。", + "evidence": "证据 / POC", + "evidencePlaceholder": "原始请求/响应、curl/工具命令、截图说明、日志、DNSLog/回连记录、数据库结果、文件路径、时间戳等。", "impact": "影响", - "impactPlaceholder": "漏洞影响说明", + "impactPlaceholder": "结合已验证事实说明实际影响，例如越权读取哪些数据。", "recommendation": "修复建议", - "recommendationPlaceholder": "修复建议" + "recommendationPlaceholder": "写具体修复点和复测标准。", + "retestNotes": "复测方式", + "retestNotesPlaceholder": "修复后如何验证漏洞已关闭，包括应返回的状态码、错误信息或访问控制结果。" }, "vulnerabilityMd": { "headingBasic": "基本信息", @@ -2830,9 +2839,12 @@ "labelCreated": "创建时间", "labelUpdated": "更新时间", "headingDescription": "描述", - "headingProof": "证明（POC）", + "headingPreconditions": "前置条件", + "headingReproductionSteps": "复现步骤", + "headingEvidence": "证据 / POC", "headingImpact": "影响", - "headingRecommendation": "修复建议" + "headingRecommendation": "修复建议", + "headingRetestNotes": "复测方式" }, "roleModal": { "addRole": "添加角色", diff --git a/web/static/js/vulnerability.js b/web/static/js/vulnerability.js index 45470539..402682e3 100644 --- a/web/static/js/vulnerability.js +++ b/web/static/js/vulnerability.js @@ -1303,9 +1303,14 @@ function renderVulnerabilities(vulnerabilities, renderOptions) { ${vuln.conversation_tag ? vulnDetailField(vulnT('vulnerabilityPage.detailConversationTag'), vuln.conversation_tag, false) : ''} ${vuln.task_tag ? vulnDetailField(vulnT('vulnerabilityPage.detailTaskTag'), vuln.task_tag, false) : ''} - ${vuln.proof ? `
${escapeHtml(vulnT('vulnerabilityPage.detailProof'))}:
${escapeHtml(vuln.proof)}
` : ''} - ${vuln.impact ? `
${escapeHtml(vulnT('vulnerabilityPage.detailImpact'))}: ${escapeHtml(vuln.impact)}
` : ''} - ${vuln.recommendation ? `
${escapeHtml(vulnT('vulnerabilityPage.detailRecommendation'))}: ${escapeHtml(vuln.recommendation)}
` : ''} +
+ ${vulnNarrativeSection(vulnT('vulnerabilityPage.detailPreconditions'), vuln.preconditions)} + ${vulnNarrativeSection(vulnT('vulnerabilityPage.detailReproductionSteps'), vuln.reproduction_steps)} + ${vulnNarrativeSection(vulnT('vulnerabilityPage.detailEvidence'), vuln.evidence, { code: true })} + ${vulnNarrativeSection(vulnT('vulnerabilityPage.detailImpact'), vuln.impact)} + ${vulnNarrativeSection(vulnT('vulnerabilityPage.detailRecommendation'), vuln.recommendation)} + ${vulnNarrativeSection(vulnT('vulnerabilityPage.detailRetestNotes'), vuln.retest_notes)} +
@@ -1467,9 +1472,12 @@ async function showAddVulnerabilityModal() { document.getElementById('vulnerability-status').value = 'open'; document.getElementById('vulnerability-type').value = ''; document.getElementById('vulnerability-target').value = ''; - document.getElementById('vulnerability-proof').value = ''; + document.getElementById('vulnerability-preconditions').value = ''; + document.getElementById('vulnerability-reproduction-steps').value = ''; + document.getElementById('vulnerability-evidence').value = ''; document.getElementById('vulnerability-impact').value = ''; document.getElementById('vulnerability-recommendation').value = ''; + document.getElementById('vulnerability-retest-notes').value = ''; openAppModal('vulnerability-modal'); } @@ -1493,9 +1501,12 @@ async function editVulnerability(id) { document.getElementById('vulnerability-status').value = vuln.status || 'open'; document.getElementById('vulnerability-type').value = vuln.type || ''; document.getElementById('vulnerability-target').value = vuln.target || ''; - document.getElementById('vulnerability-proof').value = vuln.proof || ''; + document.getElementById('vulnerability-preconditions').value = vuln.preconditions || ''; + document.getElementById('vulnerability-reproduction-steps').value = vuln.reproduction_steps || ''; + document.getElementById('vulnerability-evidence').value = vuln.evidence || ''; document.getElementById('vulnerability-impact').value = vuln.impact || ''; document.getElementById('vulnerability-recommendation').value = vuln.recommendation || ''; + document.getElementById('vulnerability-retest-notes').value = vuln.retest_notes || ''; await populateVulnerabilityModalProjectSelect(vuln.project_id || ''); document.getElementById('vulnerability-title')?.focus(); }); @@ -1510,9 +1521,16 @@ async function editVulnerability(id) { async function saveVulnerability() { const conversationId = document.getElementById('vulnerability-conversation-id').value.trim(); const title = document.getElementById('vulnerability-title').value.trim(); + const description = document.getElementById('vulnerability-description').value.trim(); const severity = document.getElementById('vulnerability-severity').value; + const type = document.getElementById('vulnerability-type').value.trim(); + const target = document.getElementById('vulnerability-target').value.trim(); + const reproductionSteps = document.getElementById('vulnerability-reproduction-steps').value.trim(); + const evidence = document.getElementById('vulnerability-evidence').value.trim(); + const impact = document.getElementById('vulnerability-impact').value.trim(); + const recommendation = document.getElementById('vulnerability-recommendation').value.trim(); - if (!conversationId || !title || !severity) { + if (!conversationId || !title || !description || !severity || !type || !target || !reproductionSteps || !evidence || !impact || !recommendation) { alert(vulnT('vulnerabilityPage.saveRequiredFields')); return; } @@ -1525,14 +1543,17 @@ async function saveVulnerability() { conversation_tag: document.getElementById('vulnerability-conversation-tag').value.trim(), task_tag: document.getElementById('vulnerability-task-tag').value.trim(), title: title, - description: document.getElementById('vulnerability-description').value.trim(), + description: description, severity: severity, status: document.getElementById('vulnerability-status').value, - type: document.getElementById('vulnerability-type').value.trim(), - target: document.getElementById('vulnerability-target').value.trim(), - proof: document.getElementById('vulnerability-proof').value.trim(), - impact: document.getElementById('vulnerability-impact').value.trim(), - recommendation: document.getElementById('vulnerability-recommendation').value.trim() + type: type, + target: target, + preconditions: document.getElementById('vulnerability-preconditions').value.trim(), + reproduction_steps: reproductionSteps, + evidence: evidence, + impact: impact, + recommendation: recommendation, + retest_notes: document.getElementById('vulnerability-retest-notes').value.trim() }; try { @@ -1553,9 +1574,12 @@ async function saveVulnerability() { status: data.status, type: data.type, target: data.target, - proof: data.proof, + preconditions: data.preconditions, + reproduction_steps: data.reproduction_steps, + evidence: data.evidence, impact: data.impact, recommendation: data.recommendation, + retest_notes: data.retest_notes, }; } @@ -1864,6 +1888,17 @@ function vulnDetailField(label, value, asCode) { `; } +function vulnNarrativeSection(label, value, options) { + if (value === undefined || value === null || String(value).trim() === '') return ''; + const opts = options || {}; + const tag = opts.code ? 'pre' : 'div'; + const cls = opts.code ? 'vulnerability-section-body vulnerability-section-body--code' : 'vulnerability-section-body'; + return `
+${escapeHtml(label)} +<${tag} class="${cls}">${escapeHtml(String(value))} +
`; +} + // 将漏洞格式化为Markdown（章节标题随界面语言） function formatVulnerabilityAsMarkdown(vuln) { const severityText = vulnSeverityLabel(vuln.severity); @@ -1905,8 +1940,16 @@ function formatVulnerabilityAsMarkdown(vuln) { markdown += `## ${L('headingDescription')}\n\n${vuln.description}\n\n`; } - if (vuln.proof) { - markdown += `## ${L('headingProof')}\n\n\`\`\`\n${vuln.proof}\n\`\`\`\n\n`; + if (vuln.preconditions) { + markdown += `## ${L('headingPreconditions')}\n\n${vuln.preconditions}\n\n`; + } + + if (vuln.reproduction_steps) { + markdown += `## ${L('headingReproductionSteps')}\n\n${vuln.reproduction_steps}\n\n`; + } + + if (vuln.evidence) { + markdown += `## ${L('headingEvidence')}\n\n\`\`\`\n${vuln.evidence}\n\`\`\`\n\n`; } if (vuln.impact) { @@ -1917,6 +1960,10 @@ function formatVulnerabilityAsMarkdown(vuln) { markdown += `## ${L('headingRecommendation')}\n\n${vuln.recommendation}\n\n`; } + if (vuln.retest_notes) { + markdown += `## ${L('headingRetestNotes')}\n\n${vuln.retest_notes}\n\n`; + } + return markdown; } @@ -2194,4 +2241,3 @@ window.setVulnerabilityIdFilter = setVulnerabilityIdFilter; window.bindVulnerabilityProject = bindVulnerabilityProject; window.buildVulnerabilityProjectOptionsHtml = buildVulnerabilityProjectOptionsHtml; window.changeVulnerabilityStatus = changeVulnerabilityStatus; - diff --git a/web/templates/index.html b/web/templates/index.html index d1b75915..a21497c4 100644 --- a/web/templates/index.html +++ b/web/templates/index.html @@ -4385,11 +4385,11 @@
- +
- - + +
@@ -4413,24 +4413,36 @@
- +
- - + +
- - + +
- - + +
- - + + +
+
+ + +
+
+ + +
+
+ +