Python桌面版CSP安全策略可视化生成器：Content-Security-Policy头部构建、指令可视化配置、实时预览策略效果、一键复制Header值

🖥️ 运行效果

🚀 实例简介

Content-Security-Policy (CSP) 是现代Web安全的核心防线，能有效防止XSS攻击、数据注入、点击劫持等安全威胁。但CSP头部语法复杂，手动编写容易出错。本工具提供可视化界面，让Web开发者无需记忆复杂语法，通过图形化配置快速生成符合安全标准的CSP头部。支持12项CSP指令可视化配置、4种安全预设模板（严格安全/宽松兼容/仅HTTPS/CDN友好）、快捷值按钮一键切换、实时安全评分（0-100分+A/B/C/D等级）、一键复制到剪贴板。适用场景：Web开发者配置网站安全策略、运维人员加固Nginx/Apache安全头、安全工程师审计和优化CSP配置、学习CSP语法和安全最佳实践。

💻 核心代码

# -*- coding: utf-8 -*-
"""
CSP安全策略可视化生成器
Content-Security-Policy头部构建工具，支持指令可视化配置、
实时预览策略效果、一键复制Header值。
"""
import tkinter as tk
from tkinter import ttk, messagebox
import platform

CHINESE_FONT = "WenQuanYi Zen Hei" if platform.system() == "Linux" else "Microsoft YaHei"

# CSP指令定义：指令名 -> (说明, 可选值列表)
CSP_DIRECTIVES = {
    "default-src": ("默认策略，未单独指定的资源类型使用此值", ["'self'", "'none'", "'unsafe-inline'", "'unsafe-eval'", "https:", "http:"]),
    "script-src": ("JavaScript来源控制", ["'self'", "'none'", "'unsafe-inline'", "'unsafe-eval'", "'strict-dynamic'", "https:", "http:"]),
    "style-src": ("CSS样式来源控制", ["'self'", "'none'", "'unsafe-inline'", "https:"]),
    "img-src": ("图片资源来源控制", ["'self'", "'none'", "data:", "https:", "http:", "blob:"]),
    "font-src": ("字体文件来源控制", ["'self'", "'none'", "data:", "https:"]),
    "connect-src": ("XHR/Fetch/WebSocket连接来源", ["'self'", "'none'", "https:", "wss:"]),
    "media-src": ("音频/视频来源控制", ["'self'", "'none'", "https:", "blob:"]),
    "object-src": ("插件(Flash/Java)来源", ["'self'", "'none'"]),
    "frame-src": ("iframe嵌入来源控制", ["'self'", "'none'", "https:"]),
    "frame-ancestors": ("允许被哪些页面嵌入(替代X-Frame-Options)", ["'self'", "'none'"]),
    "form-action": ("表单提交目标限制", ["'self'", "'none'"]),
    "base-uri": ("标签URL限制", ["'self'", "'none'"]),
}

# 预设模板
TEMPLATES = {
    "严格安全": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
    "宽松兼容": "default-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; style-src 'self' 'unsafe-inline' https:; img-src 'self' data: https: http:; font-src 'self' data: https:; connect-src 'self' https:; frame-ancestors 'self'",
    "仅HTTPS": "default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:",
    "CDN友好": "default-src 'self'; script-src 'self' https://cdn.example.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self' https://api.example.com",
}

class CSPGeneratorApp:
    def __init__(self, root):
        self.root = root
        self.root.title("CSP安全策略可视化生成器")
        self.root.geometry("900x650")
        self.root.configure(bg="#f5f5f5")
        
        # 各指令当前值
        self.directive_values = {}
        
        self._build_ui()
        self._apply_template("严格安全")
    
    def _build_ui(self):
        # 标题
        title_frame = tk.Frame(self.root, bg="#2c3e50", height=50)
        title_frame.pack(fill=tk.X)
        title_frame.pack_propagate(False)
        tk.Label(title_frame, text="🔒 CSP安全策略可视化生成器", 
                 font=(CHINESE_FONT, 18, "bold"), bg="#2c3e50", fg="white").pack(pady=10)
        
        # 模板选择区
        tpl_frame = tk.LabelFrame(self.root, text="📋 快速模板", font=(CHINESE_FONT, 11, "bold"),
                                   bg="#f5f5f5", padx=10, pady=5)
        tpl_frame.pack(fill=tk.X, padx=10, pady=(10, 5))
        
        for name in TEMPLATES:
            btn = tk.Button(tpl_frame, text=name, font=(CHINESE_FONT, 10),
                           bg="#3498db", fg="white", relief=tk.FLAT, padx=15, pady=3,
                           command=lambda n=name: self._apply_template(n))
            btn.pack(side=tk.LEFT, padx=5, pady=3)
        
        # 指令配置区（可滚动）
        canvas_frame = tk.Frame(self.root, bg="#f5f5f5")
        canvas_frame.pack(fill=tk.BOTH, expand=True, padx=10, pady=5)
        
        canvas = tk.Canvas(canvas_frame, bg="#f5f5f5", highlightthickness=0)
        scrollbar = ttk.Scrollbar(canvas_frame, orient=tk.VERTICAL, command=canvas.yview)
        self.directives_frame = tk.Frame(canvas, bg="#f5f5f5")
        
        self.directives_frame.bind("", 
                                    lambda e: canvas.configure(scrollregion=canvas.bbox("all")))
        canvas.create_window((0, 0), window=self.directives_frame, anchor=tk.NW)
        canvas.configure(yscrollcommand=scrollbar.set)

💡 适用场景

办公自动化、数据分析、快速原型开发