Website Security Audit Report

// Create a direct HTML template with improved styling const auditData = items[0].json.auditData; function formatConfigurationIssues() { if (!auditData.configOutput || auditData.configOutput.trim() === '') { return '

No specific configuration issues detected.

'; } try { const config = auditData.configOutput.trim(); let html = ''; const renderedKeys = new Set(); const renderBlock = (title, description, impact, recommendation) => `

${title}

${description ? `

${description}

` : ''} ${impact ? `

Impact: ${impact}

` : ''} ${recommendation ? `

Recommendation:

${recommendation}

` : ''}

`; const sections = config.split(/(?=^###\s+)/gm).filter(Boolean); for (const section of sections) { const sectionTitleMatch = section.match(/^###\s+(.*)/); const sectionTitle = sectionTitleMatch?.[1]?.trim() || 'Unnamed Section'; const sectionKey = sectionTitle.toLowerCase(); // Skip "no issues found" sections if (/no issues? (found|were found)/i.test(section)) continue; const lines = section.split(/\n+/).filter(line => line.trim() !== ''); let currentTitle = ''; let description = ''; let impact = ''; let recommendation = ''; for (let i = 0; i < lines.length; i++) { const line = lines[i].trim(); // Start of a new numbered or bolded issue const numberedTitle = line.match(/^\d+\.\s+\*\*(.*?)\*\*/); const bulletTitle = line.match(/^\*\*(.*?)\*\*/); if (numberedTitle || (!currentTitle && bulletTitle)) { // Flush last block if (currentTitle && !renderedKeys.has(`${sectionKey}::${currentTitle.toLowerCase()}`)) { html += renderBlock(currentTitle, description, impact, recommendation); renderedKeys.add(`${sectionKey}::${currentTitle.toLowerCase()}`); } currentTitle = (numberedTitle || bulletTitle)[1].trim(); description = ''; impact = ''; recommendation = ''; continue; } const valueMatch = line.match(/- \*\*Value:\*\*\s*`?(.*?)`?$/i); const presentMatch = line.match(/- \*\*Present\?\*\*.*?(Yes|No)/i); const descMatch = line.match(/- \*\*Description:\*\*\s*(.*)/i); const impactMatch = line.match(/- \*\*(?:Impact|Security Implication|Potential Impact):\*\*\s*(.*)/i); const recMatch = line.match(/```(?:\w*)?\n([\s\S]*?)```/i); if (descMatch) { description = descMatch[1].trim(); } else if (valueMatch || presentMatch) { const present = presentMatch?.[1]?.trim() || 'Unknown'; const value = valueMatch?.[1]?.trim() || '[Not provided]'; description = `This header is ${present.toLowerCase()}. Value: ${value}.`; } if (impactMatch) { impact = impactMatch[1].trim(); } if (recMatch) { recommendation = recMatch[1].trim(); } } // Final block in section if (currentTitle && !renderedKeys.has(`${sectionKey}::${currentTitle.toLowerCase()}`)) { html += renderBlock(currentTitle, description, impact, recommendation); renderedKeys.add(`${sectionKey}::${currentTitle.toLowerCase()}`); } } return html || '

No configuration issues detected.

'; } catch (e) { console.error('Error in formatConfigurationIssues:', e); return `

Error processing configuration issues: ${e.message}

`; } } // Create header badge HTML function createHeaderBadge(headerName, isWarning = false) { const isPresent = auditData.headerStatus && auditData.headerStatus[headerName] && auditData.headerStatus[headerName].present; const color = isWarning && isPresent ? "#F39C12" : (isPresent ? "#27AE60" : "#E74C3C"); const icon = isPresent ? "✓" : "✗"; return `${icon} ${headerName}`; } // Format warnings section function formatWarningsSection() { if (!auditData.warningCount || auditData.warningCount === 0 || !auditData.headerStatus) { return '

No warnings detected.

'; } const csp = Object.entries(auditData.headerStatus).find(([k]) => k.toLowerCase() === 'content-security-policy'); const hsts = Object.entries(auditData.headerStatus).find(([k]) => k.toLowerCase() === 'strict-transport-security'); const xss = Object.entries(auditData.headerStatus).find(([k]) => k.toLowerCase() === 'x-xss-protection'); let warnings = ''; if (csp && csp[1].value && csp[1].value.includes('unsafe-inline')) { warnings += `

Content-Security-Policy: unsafe-inline

The use of 'unsafe-inline' allows potentially malicious scripts to execute.

`; } if (hsts && hsts[1].value) { const match = hsts[1].value.match(/max-age=(\d+)/); const age = match ? parseInt(match[1]) : 0; if (age < 2592000) { warnings += `

Strict-Transport-Security

max-age is too low (${age}). Should be at least 2592000 (30 days).

`; } } if (xss && !xss[1].present) { warnings += `

Missing X-XSS-Protection

This header enables the browser's XSS filter. Lack of it increases XSS risks.

`; } if (!warnings) { warnings = `

${auditData.warningCount} warnings detected

See the Configuration Issues section below for more info.

`; } return warnings; } function formatLongValue(value) { if (!value || typeof value !== 'string') return '[empty]'; // Convert URLs into clickable links value = value.replace(/(https?:\/\/[^\s]+)/g, '$1'); // Add line breaks after commas or semicolons for readability if (value.length > 100) { value = value.replace(/([,;])\s*/g, '$1
'); } return value; } function formatDetailedRawHeaders() { const allHeaders = []; const seen = new Set(); const addHeader = (name, value) => { const key = name.toLowerCase(); if (seen.has(key)) return; seen.add(key); const status = Object.entries(auditData.headerStatus || {}).find( ([k]) => k.toLowerCase() === name.toLowerCase() ); const present = status ? status[1].present : !!value; allHeaders.push({ name: name.trim(), present, value: value || '[empty]' }); }; Object.entries(auditData.originalHeaders || {}).forEach(([key, value]) => { if (key) addHeader(key, value); }); const securityHeaders = [ 'content-security-policy', 'strict-transport-security', 'x-content-type-options', 'x-frame-options', 'referrer-policy', 'permissions-policy', 'x-xss-protection' ]; const isWarningHeader = (name, value) => { const lower = name.toLowerCase(); if (lower === 'strict-transport-security') { const match = value.match(/max-age=(\d+)/); return match && parseInt(match[1]) < 2592000; } if (lower === 'content-security-policy') return value.includes("'unsafe-inline'"); return false; }; const tableRows = allHeaders.map(header => { const isSecurity = securityHeaders.includes(header.name.toLowerCase()); const warning = isSecurity && isWarningHeader(header.name, header.value); const missing = isSecurity && !header.present; let bgColor = '#F8F9FA'; let textColor = '#333'; if (isSecurity) { if (missing) { bgColor = '#FFEBEE'; textColor = '#C62828'; } else if (warning) { bgColor = '#FFF9C4'; textColor = '#F57F17'; } else { bgColor = '#E8F5E9'; textColor = '#2E7D32'; } } return ` ${header.name} ${header.present ? 'present' : 'absent'} ${formatLongValue(header.value)} `; }).join(''); return ` ${tableRows}

Header	Status	Value

`; } // Format additional information section function formatAdditionalInfo() { const headers = [ { name: 'access-control-allow-origin', description: 'This is a very lax CORS policy. Such a policy should only be used on a public CDN.' }, { name: 'strict-transport-security', description: 'HTTP Strict Transport Security is an excellent feature to support on your site and strengthens your implementation of TLS by getting the User Agent to enforce the use of HTTPS.' }, { name: 'content-security-policy', description: 'Content Security Policy is an effective measure to protect your site from XSS attacks. By whitelisting sources of approved content, you can prevent the browser from loading malicious assets. Analyse this policy in more detail. You can sign up for a free account on Report URI to collect reports about problems on your site.' }, { name: 'permissions-policy', description: 'Permissions Policy is a new header that allows a site to control which features and APIs can be used in the browser.' }, { name: 'referrer-policy', description: 'Referrer Policy is a new header that allows a site to control how much information the browser includes with navigations away from a document and should be set by all sites.' }, { name: 'x-content-type-options', description: 'X-Content-Type-Options stops a browser from trying to MIME-sniff the content type and forces it to stick with the declared content-type. The only valid value for this header is "X-Content-Type-Options: nosniff".' }, { name: 'x-frame-options', description: 'X-Frame-Options tells the browser whether you want to allow your site to be framed or not. By preventing a browser from framing your site you can defend against attacks like clickjacking.' }, { name: 'report-to', description: 'Report-To enables the Reporting API. This allows a website to collect reports from the browser about various errors that may occur. You can sign up for a free account on Report URI to collect these reports.' }, { name: 'nel', description: 'Network Error Logging is a new header that instructs the browser to send reports during various network or application errors. You can sign up for a free account on Report URI to collect these reports.' }, { name: 'server', description: 'Server value has been changed. Typically you will see values like "Microsoft-IIS/8.0" or "nginx 1.7.2".' } ]; let rows = ''; for (const header of headers) { const isSecurityHeader = ['content-security-policy', 'strict-transport-security', 'x-content-type-options', 'x-frame-options', 'referrer-policy', 'permissions-policy'].includes(header.name); const headerColor = isSecurityHeader ? '#27AE60' : '#3498DB'; rows += ` ${header.name} ${header.description} `; } return ` ${rows}

`; } function formatSecurityGrade() { const gradeColors = { 'A+': '#27AE60', 'A': '#27AE60', 'A-': '#27AE60', 'B+': '#3498DB', 'B': '#3498DB', 'B-': '#3498DB', 'C+': '#F39C12', 'C': '#F39C12', 'C-': '#F39C12', 'D+': '#E74C3C', 'D': '#E74C3C', 'D-': '#E74C3C', 'F': '#E74C3C' }; return `

${auditData.grade}

`; } function formatCriticalVulnerabilities() { if (!auditData.vulnOutput || auditData.vulnOutput.trim() === '') { return '

No vulnerabilities detected.

'; } try { const vuln = auditData.vulnOutput.trim(); let html = ''; const renderedTitles = new Set(); // Match sections like ## Category (e.g., ## Critical Vulnerabilities) const categories = vuln.split(/(?=^##\s+)/gm).filter(Boolean); for (const categoryBlock of categories) { const categoryMatch = categoryBlock.match(/^##\s+(.*)/); const categoryTitle = categoryMatch?.[1]?.trim() || 'Uncategorized'; // Find numbered items: 1. **Title** const vulns = categoryBlock.split(/(?=^\d+\.\s+\*\*)/gm).filter(Boolean); for (const vulnBlock of vulns) { const titleMatch = vulnBlock.match(/^\d+\.\s+\*\*(.*?)\*\*/); const title = titleMatch?.[1]?.trim() || 'Unnamed Vulnerability'; const key = `${categoryTitle}::${title}`.toLowerCase(); if (renderedTitles.has(key)) continue; const descriptionMatch = vulnBlock.match(/\*\*Description\*\*:?\s*([\s\S]*?)(?=\n\*\*|\n$)/i); const impactMatch = vulnBlock.match(/\*\*(?:Impact|Potential Impact)\*\*:?\s*([\s\S]*?)(?=\n\*\*|\n$)/i); const recommendationMatch = vulnBlock.match(/\*\*(?:Recommendation|Mitigation|Fix)\*\*:?\s*([\s\S]*?)(?=\n\*\*|\n$)/i); const description = descriptionMatch?.[1]?.trim() || ''; const impact = impactMatch?.[1]?.trim() || ''; const recommendation = recommendationMatch?.[1]?.trim() || ''; if (description || impact || recommendation) { html += `

${title}

${description ? `

${description}

` : ''} ${impact ? `

Impact: ${impact}

` : ''} ${recommendation ? `

Recommendation: ${recommendation}

` : ''}

`; renderedTitles.add(key); } } } return html || '

No vulnerabilities parsed from output.

'; } catch (e) { console.error('Error in formatCriticalVulnerabilities:', e); return `

Error processing vulnerabilities: ${e.message}

`; } } // Generate all security header badges function generateAllHeaderBadges() { // Only include the necessary security headers const securityHeaders = [ 'Content-Security-Policy', 'Strict-Transport-Security', 'X-Content-Type-Options', 'X-Frame-Options', 'Referrer-Policy', 'Permissions-Policy' ]; let badges = ''; securityHeaders.forEach(header => { const isWarning = header === 'Strict-Transport-Security' && auditData.headerStatus?.[header]?.value && parseInt(auditData.headerStatus[header].value.match(/max-age=(\d+)/)?.[1] || 0) < 2592000; badges += createHeaderBadge(header, isWarning); }); return badges; } const html = ` Website Security Audit Report

Security Report Summary

${formatSecurityGrade()}

Site:	${auditData.url}
Report Time:	${auditData.timestamp}
Headers:	${generateAllHeaderBadges()}
Critical Issues:	${auditData.criticalCount \|\| 0}
Warnings:	${auditData.warningCount \|\| 0}

Warnings

${formatWarningsSection()}

Raw Headers

${formatDetailedRawHeaders()}

Security Findings

Vulnerabilities

${formatCriticalVulnerabilities()}

Configuration Issues

${formatConfigurationIssues()}

Additional Information

${formatAdditionalInfo()}

Implementation Guide

This report highlights security issues detected through client-side analysis. For a comprehensive security assessment, consider engaging a professional penetration tester.

To implement the fixes above:

Work with your development team to address each issue in order of criticality
Retest after implementing each fix
Consider implementing a web application firewall for additional protection

This report was automatically generated and represents an automated assessment of publicly accessible aspects of your website. For a more comprehensive security assessment, consider engaging with a professional security consultant.

`; return [{ json: { ...items[0].json, emailHtml: html } }];

Dale Dunlop

WebSecScan: AI-Powered Website Security Auditor