HTML/CSS

CHANGELOG.md

@@ -10,6 +10,27 @@ release tag.
 
 ## [Unreleased]
 
+## [1.1.0] – 2026-08-20
+
+### Added
+
+- **Markup/standards analysis** (`scanner/markup.py`): new category in the
+  `--analyze` report that checks the delivered start page against the most common
+  HTML standard violations – doctype/quirks mode, unclosed and stray tags, invalid
+  nesting (block elements inside `<p>`), obsolete elements/attributes, duplicate
+  `id` attributes, duplicate attributes per tag, position of the charset
+  declaration and unescaped `&` in text.
+  - Runs **entirely locally**: neither the target URL nor the markup is sent to an
+    external validator, matching the opsec stance of the CVE lookup.
+  - Rated **WARN at worst, never FAIL** – markup violations are code quality, not a
+    defect. WCAG 2.2 removed success criterion 4.1.1 "Parsing", so the check lives
+    in the analysis report rather than the legal/accessibility report.
+  - Elements with optional end tags (`<li>`, `<td>`, `<tr>`, `<p>` …) are closed
+    implicitly, so valid shorthand markup produces no false positives.
+  - CSS is deliberately not checked.
+- FAQ entry for the **"Website analysis"** option (`--analyze`), which was
+  previously undocumented in `--faq` and the web UI help panel.
+
 ## [1.0.0] – 2026-08-16
 
 First tagged release. A defensive, non-destructive web vulnerability scanner for
@@ -55,5 +76,6 @@ First tagged release. A defensive, non-destructive web vulnerability scanner for
 - Mandatory authorization confirmation before every scan (CLI prompt / web-UI
   checkbox).
 
-[Unreleased]: https://github.com/twgnr/web-vulnerability-scanner/compare/v1.0.0...HEAD
+[Unreleased]: https://github.com/twgnr/web-vulnerability-scanner/compare/v1.1.0...HEAD
+[1.1.0]: https://github.com/twgnr/web-vulnerability-scanner/releases/tag/v1.1.0
 [1.0.0]: https://github.com/twgnr/web-vulnerability-scanner/releases/tag/v1.0.0

README.md

@@ -95,7 +95,7 @@ python scan.py "https://localhost:8443/app?q=test" --insecure
 | `--evidence FILE` | Save an audit-ready **evidence bundle** (findings + verification + controls + remediation + drift) as JSON |
 | `--history-dir DIR` | Different base folder for history/remediation (default: `%LOCALAPPDATA%/web-vuln-scanner`) |
 | `--no-tech`    | Disable technology detection (tech stack overview) (on by default) |
-| `--analyze`    | Additional website analysis: performance, SEO, DNS/email, availability & trackers/privacy |
+| `--analyze`    | Additional website analysis: performance, SEO, HTML markup conformance, DNS/email, availability & trackers/privacy |
 | `--mxtools`    | DNS/registrar checks (records, SPF/DMARC/DKIM/MTA-STS/BIMI/TLS-RPT, RDAP, DNSBL, SMTP) |
 | `--json FILE`  | Additionally save findings as JSON |
 | `--yes`        | Skip the authorization prompt |
@@ -638,7 +638,7 @@ python scan.py "https://my-app.com/" --legal
 > reviewed legally/professionally. The automatic accessibility check covers only a
 > part of WCAG (contrasts, focus order, screen-reader flow require manual review).
 
-## Website analysis (performance/SEO/DNS/hygiene)
+## Website analysis (performance/SEO/markup/DNS/hygiene)
 
 Via `--analyze` (CLI) or the **"Website analysis"** checkbox (web UI) – beyond pure
 security – a separate report (tab **"Analysis"**) is added, grouped by:
@@ -648,6 +648,10 @@ security – a separate report (tab **"Analysis"**) is added, grouped by:
 - **SEO** (deep): title/description quality, H1/headings, `canonical`, indexability,
   Open Graph/Twitter Cards, **structured data (JSON-LD)**, `hreflang`, alt-text coverage,
   viewport/lang/charset, `robots.txt`/`sitemap.xml`.
+- **Markup/standards**: HTML conformance against the most common violations – doctype/
+  quirks mode, unclosed and stray tags, invalid nesting (block elements inside `<p>`),
+  obsolete elements/attributes (`<font>`, `<center>`, `bgcolor` …), duplicate `id`
+  attributes, position of the charset declaration and unescaped `&` in text.
 - **DNS/email** (deep): **DNSSEC**, **CAA**, MX, **SPF/DMARC policy strength**, **MTA-STS**
   (needs `dnspython`).
 - **Availability & privacy**: redirect chains, **HTTP→HTTPS**, **www canonicalization**, 404
@@ -657,6 +661,16 @@ security – a separate report (tab **"Analysis"**) is added, grouped by:
 Rated as **PASS/WARN/FAIL/INFO**, heuristic (without a headless browser), included in
 the HTML and JSON export.
 
+> **On the markup check:** it runs **entirely locally** – neither the target URL nor the
+> markup is sent to an external validator (same stance as the CVE lookup, which sends only
+> product and version). It is therefore not a full replacement for
+> [validator.w3.org](https://validator.w3.org/), and it deliberately never rates worse
+> than **WARN**: markup violations are code quality, not a defect – the vast majority of
+> sites do not validate cleanly, and browsers and screen readers cope. WCAG 2.2 removed
+> success criterion 4.1.1 "Parsing" for exactly that reason, which is why this lives in
+> the analysis report and **not** in the legal/accessibility report. CSS is not checked:
+> a real CSS validator is its own project, and a heuristic finds nothing that matters.
+
 **Real Core Web Vitals (optional, rendered):** in addition to `--analyze`,
 `--browser` (CLI) or the **"Headless browser"** checkbox enables a performance audit
 in Chromium (Playwright) and measures **LCP, CLS, FCP, TTFB, Load** as well as
@@ -890,6 +904,7 @@ scanner/
   techstack.py     # Technology detection (Wappalyzer style): server/language/framework/CMS/JS/CDN
   perf.py          # Analysis: performance (response time, compression, caching, page weight, render-blocking)
   seo.py           # Analysis: SEO (title/description, headings, canonical, OG, JSON-LD, hreflang, alt, sitemap)
+  markup.py        # Analysis: HTML markup conformance (doctype, tag structure, obsolete elements, duplicate ids)
   dnsinfo.py       # Analysis: DNS/email (DNSSEC, CAA, MX, SPF/DMARC policy, MTA-STS)
   hygiene.py       # Analysis: availability (redirects, HTTP->HTTPS, www, 404, well-known) + trackers/privacy
   browserperf.py   # Optional: rendered performance audit (Core Web Vitals via Playwright; --browser)

scan.py

@@ -23,7 +23,7 @@
                      jwt, pollution, pwmgr, traversal, verify, wordpress, xss, xxe)
 from scanner import cms, dotnet, java, python as pychk
 from scanner import techstack
-from scanner import perf, seo, dnsinfo, hygiene, browserperf, dnsreg
+from scanner import perf, seo, dnsinfo, hygiene, browserperf, dnsreg, markup
 from scanner import history, controls, remediation
 from scanner.utils import ScannerSession, SEVERITY_ORDER
 
@@ -624,6 +624,7 @@ def main() -> int:
         print("[*] Website-Analyse (Performance/SEO/DNS/Erreichbarkeit) ...")
         analysis_results = (perf.analyze(session, target, base_url, resp)
                             + seo.analyze(session, target, base_url, resp)
+                            + markup.analyze(session, target, base_url, resp)
                             + dnsinfo.analyze(session, target, base_url, resp)
                             + hygiene.analyze(session, target, base_url, resp))
         if args.browser:

scanner/__init__.py

@@ -1,3 +1,3 @@
 """web-vuln-scanner: defensiver Schwachstellen-Scanner fuer autorisierte Tests."""
 
-__version__ = "1.0.0"
+__version__ = "1.1.0"

scanner/faq.py

@@ -309,6 +309,17 @@
                   "Auth) ueber ALLE entdeckten Seiten ausgewertet und je Anforderung App-weit "
                   "aggregiert (schlimmster Status gewinnt, betroffene Seiten werden gelistet); "
                   "host-weite Kategorien (Architektur, Zugriffskontrolle, Krypto) laufen einmal."},
+        {"name": "Website-Analyse",
+         "expects": "Haekchen (CLI: --analyze).",
+         "means": "Erstellt ausserhalb der Sicherheit einen eigenen Analyse-Tab: Performance "
+                  "(Antwortzeit, Kompression, Caching, Seitengewicht), SEO (vertieft), "
+                  "MARKUP/STANDARDS (HTML-Konformitaet: Doctype/Quirks-Modus, nicht geschlossene "
+                  "und ueberzaehlige Tags, Block-Elemente in <p>, obsolete Elemente/Attribute, "
+                  "doppelte ids, Charset-Position, unmaskierte &-Zeichen), DNS/E-Mail sowie "
+                  "Erreichbarkeit & Tracker/Privacy. Die Markup-Pruefung laeuft rein lokal - "
+                  "es geht nichts an einen externen Validator; sie ist bewusst nie FAIL, weil "
+                  "Markup-Verstoesse Code-Qualitaet sind und kein Defekt (WCAG 2.2 hat das "
+                  "Kriterium 4.1.1 'Parsing' ersatzlos gestrichen)."},
         {"name": "SSRF-Callback",
          "expects": "Optionaler eigener OOB-Host, z.B. abc.oast.pro (interactsh/Burp-Collaborator). "
                     "Leer lassen, wenn keiner vorhanden.",