Upload character-level XSS detector

README.md

@@ -0,0 +1,143 @@
+---
+license: mit
+pipeline_tag: text-classification
+tags:
+- security
+- xss
+- cross-site-scripting
+- web-security
+- character-level
+- pytorch
+- safetensors
+---
+
+# Character-level XSS detector
+
+A small neural network (1,959,361 parameters) that scores how likely a
+string is a cross-site scripting (XSS) payload. It reads raw characters after
+undoing URL and HTML encoding, so `%3Cscript%3E`, `&lt;script&gt;` and `<ScRiPt>`
+look the same to it. It was trained from random weights; no pretrained model or
+tokenizer is involved.
+
+Use it to triage inputs: request parameters, form fields, log lines, user-supplied
+HTML. A high score means "looks like an injection payload". It does not prove that
+a payload would execute, and a low score does not prove an input is safe. Keep
+context-aware output encoding and a Content Security Policy in place regardless.
+
+## Quick start
+
+```bash
+pip install torch numpy safetensors huggingface_hub
+```
+
+```python
+from huggingface_hub import hf_hub_download
+import importlib.util
+
+path = hf_hub_download("hareramray325/websec", "xss_detector.py")
+spec = importlib.util.spec_from_file_location("xss_detector", path)
+xss_detector = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(xss_detector)
+
+detector = xss_detector.XSSDetector.from_pretrained("hareramray325/websec")
+detector.predict(["<img src=x onerror=alert(1)>", "<b>hello</b>"])
+# [{'text': '<img src=x onerror=alert(1)>', 'score': ..., 'is_xss': True},
+#  {'text': '<b>hello</b>', 'score': ..., 'is_xss': False}]
+```
+
+`xss_detector.py` is plain Python in this repository; read it before running it.
+The weights are in `model.safetensors`, so loading them executes no code.
+`detector.score(texts)` returns calibrated probabilities; `predict` applies the
+threshold 0.7278, tuned on validation data for 0.1% false alarms.
+Pick your own threshold if your traffic differs.
+
+## How it works
+
+1. **Normalise:** URL-decode and HTML-unescape up to 3 times, drop NUL bytes,
+   collapse whitespace, lowercase.
+2. **Window:** inputs longer than 1000 characters are split into windows with a
+   stride of 500; the highest window score counts, so padding a payload with
+   harmless text does not hide it.
+3. **Network:** one token per character (code points 0-255 each have their own token;
+   every other character shares one), convolutions over 1, 3, 5 and 7 characters, two
+   stride-2 convolutions, 4 Transformer encoder blocks (width 192, 8 heads), and a
+   head over max- and mean-pooled features.
+4. **Calibrate:** logits are divided by a temperature of 1.676 fitted on
+   validation data.
+
+Trained for 12 epochs (epoch 9 kept) on an NVIDIA RTX 5050 laptop GPU in about
+4 minutes, with AdamW, a cosine learning-rate schedule and an averaged copy of
+the weights.
+
+## Training data
+
+| Source | Used for | License |
+|---|---|---|
+| [Mereani & Howe XSS dataset](https://github.com/fmereani/Cross-Site-Scripting-XSS) | XSS attack URLs and payloads; benign URLs, JavaScript and text | MIT |
+| Generated benign samples | Everyday HTML, URLs, code and prose that a naive model mistakes for attacks | Created for this model |
+| Benign copies of attack URLs | Same sites and parameter names with the payload replaced | Derived from Mereani |
+
+After normalising, exact duplicates and texts with conflicting labels were removed,
+leaving 68,258 rows, split 70/15/15 into training, validation and test.
+During training, each epoch adds varied copies of training attacks (real actions
+such as cookie theft or redirects in place of `alert(1)`, other event handlers,
+payloads placed inside ordinary text, URLs or JSON), template-built attacks, and
+benign look-alikes (prose and code that mention `onclick`, `<script>` or cookies).
+Site names in URLs are swapped in both classes so that no domain predicts a label.
+Validation and test rows are never varied.
+
+The public [web-attacks-long](https://huggingface.co/datasets/shengqin/web-attacks-long) dataset
+was deliberately left out because it states no license. Every training row comes from
+an MIT-licensed source or was generated for this model.
+
+## Evaluation
+
+Both columns use the same data and splits. The linear baseline is character TF-IDF
+with logistic regression, trained on the same training rows, at its own
+validation-tuned threshold.
+
+| Measurement | This model | Linear baseline |
+|---|---|---|
+| Held-out attacks caught | 2,131 / 2,155 (98.9%) | 2,126 (98.7%) |
+| Held-out false alarms | 6 / 8,084 (0.07%) | 11 (0.14%) |
+| Held-out detection at exactly 0.1% false alarms | 98.9% | 98.0% |
+| External attacks caught (SecLists) | 7,712 / 7,896 (97.7%) | 7,604 (96.3%) |
+| External attacks matching no training-pool row | 7,282 / 7,460 (97.6%) | 7,176 (96.2%) |
+| External benign false alarms (WikiText, OpenAssistant) | 5 / 6,993 | 0 |
+| Hand-written challenge attacks caught | 60 / 60 | 58 |
+| Hand-written challenge false alarms | 0 / 80 | 0 |
+
+**External benchmark:** 7,896 payloads from nine
+[SecLists](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing/XSS) lists (MIT) and
+6,993 paragraphs and messages from WikiText and OpenAssistant. Nothing was trained or
+tuned on it. Many SecLists payloads also occur in the training sources, so the row
+counting only lines that match no row of the training pool is the stricter one.
+
+**Challenge set:** 140 hand-written strings. Its past mistakes guided the training-time
+variation, so treat it as a regression check, not an independent test. Missed: none
+
+## Limitations
+
+- **Unfamiliar benign text raises false alarms.** Benign training text is mostly URLs,
+  JavaScript, reviews and generated HTML. Measure the false-alarm rate on your own
+  traffic and adjust the threshold before blocking anything.
+- **Programming help text is the riskiest benign input.** 5 of 1,994 OpenAssistant
+  messages were flagged (mostly answers that mix prose and code blocks), against
+  0 of 4,999 Wikipedia paragraphs.
+- **Injected markup counts as an attack.** `<iframe src=...>`, `<script src=...>` and
+  `<form>` in an *input* are scored high, as the training data labels them. Do not
+  run it over whole web pages.
+- **Non-Latin text is coarse.** Every character above code point 255 is one token, so
+  Cyrillic, Devanagari or Chinese text looks alike. One external false alarm was a
+  Russian-language message.
+- **A score is evidence, not proof.** It does not know where the input is written
+  (HTML body, attribute, script, URL), which decides whether it can execute.
+- **Exact deduplication only.** Related payload families can sit in both training
+  and test data, so held-out numbers are optimistic. The external benchmark is the
+  better estimate.
+
+## Intended use
+
+Defensive: triaging inputs and logs, flagging suspicious values for review, and
+measuring how well a filter copes with encoded payloads. It is not a web application
+firewall on its own, and it was not built or evaluated for generating payloads.

config.json

@@ -0,0 +1,22 @@
+{
+  "architecture": "xss_char_cnn_transformer",
+  "format_version": 1,
+  "tokenizer": "codepoints_v1",
+  "network": {
+    "max_length": 1000,
+    "embed_dim": 128,
+    "width": 192,
+    "layers": 4,
+    "heads": 8
+  },
+  "threshold": 0.7277562894695883,
+  "temperature": 1.6763814589384218,
+  "window": 1000,
+  "stride": 500,
+  "max_decode_rounds": 3,
+  "labels": {
+    "0": "benign",
+    "1": "xss"
+  },
+  "initialization": "random_weights"
+}

metrics.json

@@ -0,0 +1,273 @@
+{
+  "model": {
+    "kind": "char_cnn_transformer",
+    "initialization": "random_weights",
+    "parameters": 1959361,
+    "config": {
+      "max_length": 1000,
+      "embed_dim": 128,
+      "width": 192,
+      "layers": 4,
+      "heads": 8,
+      "dropout": 0.1
+    },
+    "device": "cuda",
+    "epochs": 12,
+    "best_epoch": 9,
+    "batch_size": 128,
+    "learning_rate": 0.0006,
+    "seed": 42,
+    "temperature": 1.6764,
+    "training_seconds": 261.2,
+    "torch_version": "2.11.0+cu128"
+  },
+  "threshold": 0.7277562894695883,
+  "target_fpr": 0.001,
+  "rows": 68258,
+  "sources": [
+    "mereani",
+    "synthetic",
+    "twin_urls"
+  ],
+  "cleaning": {
+    "input_rows": 82341,
+    "empty_rows": 0,
+    "conflicting_texts": 0,
+    "duplicate_rows": 0,
+    "output_rows": 82341,
+    "excluded_sources": [
+      "webattacks"
+    ],
+    "excluded_source_rows": 14076,
+    "challenge_overlap_rows_removed": 7
+  },
+  "held_out_test": {
+    "samples": 10239,
+    "roc_auc": 0.99932,
+    "pr_auc": 0.99571,
+    "detection_at_1pct_false_alarms": 0.9963,
+    "detection_at_0.1pct_false_alarms": 0.9889,
+    "threshold": 0.7278,
+    "detection_rate": 0.9889,
+    "false_alarm_rate": 0.0007,
+    "precision": 0.9972,
+    "confusion": {
+      "tp": 2131,
+      "fp": 6,
+      "fn": 24,
+      "tn": 8078
+    },
+    "by_source": {
+      "mereani": {
+        "attacks": 2155,
+        "caught": 2131,
+        "benign": 4210,
+        "false_alarms": 4
+      },
+      "synthetic": {
+        "attacks": 0,
+        "caught": 0,
+        "benign": 1860,
+        "false_alarms": 0
+      },
+      "twin_urls": {
+        "attacks": 0,
+        "caught": 0,
+        "benign": 2014,
+        "false_alarms": 2
+      }
+    }
+  },
+  "challenge_set": {
+    "attacks": 60,
+    "caught": 60,
+    "missed": [],
+    "benign": 80,
+    "false_alarms": []
+  },
+  "external_benchmark": {
+    "attack_sources": {
+      "seclists_brutelogic": {
+        "attacks": 101,
+        "caught": 89,
+        "unseen_attacks": 99,
+        "unseen_caught": 87
+      },
+      "seclists_jhaddix": {
+        "attacks": 106,
+        "caught": 90,
+        "unseen_attacks": 64,
+        "unseen_caught": 49
+      },
+      "seclists_mario": {
+        "attacks": 137,
+        "caught": 119,
+        "unseen_attacks": 135,
+        "unseen_caught": 119
+      },
+      "seclists_ofjaaah": {
+        "attacks": 198,
+        "caught": 172,
+        "unseen_attacks": 197,
+        "unseen_caught": 171
+      },
+      "seclists_payloadbox": {
+        "attacks": 1213,
+        "caught": 1104,
+        "unseen_attacks": 880,
+        "unseen_caught": 774
+      },
+      "seclists_polyglots": {
+        "attacks": 13,
+        "caught": 13,
+        "unseen_attacks": 13,
+        "unseen_caught": 13
+      },
+      "seclists_portswigger": {
+        "attacks": 6042,
+        "caught": 6042,
+        "unseen_attacks": 6041,
+        "unseen_caught": 6041
+      },
+      "seclists_rsnake": {
+        "attacks": 66,
+        "caught": 63,
+        "unseen_attacks": 12,
+        "unseen_caught": 9
+      },
+      "seclists_somdev": {
+        "attacks": 20,
+        "caught": 20,
+        "unseen_attacks": 19,
+        "unseen_caught": 19
+      }
+    },
+    "benign_sources": {
+      "oasst": {
+        "benign": 1994,
+        "false_alarms": 5
+      },
+      "wikitext": {
+        "benign": 4999,
+        "false_alarms": 0
+      }
+    },
+    "attacks": 7896,
+    "caught": 7712,
+    "unseen_attacks": 7460,
+    "unseen_caught": 7282,
+    "benign": 6993,
+    "false_alarms": 5,
+    "false_alarm_examples": [
+      "to connect to an ftp server in python, you can use the built-in ftplib module. here is an example function that connects to an ftp server: ``` import ftplib def ftp_connect(host, username, password): ",
+      "try this instead: import torch from transformers import berttokenizer, bertmodel # load the bert tokenizer tokenizer = berttokenizer.from_pretrained('bert-base-uncased') # encode a text input input_id",
+      "to create a frame by frame animation in react.js, you can follow these steps: 1. create a new react component for your animation. you can use the usestate hook to keep track of the current frame index",
+      "\u044f \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u0430\u0442\u044c \u043e \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u0433\u0440\u0435 \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c \"the witcher 3: \u0434\u0438\u043a\u0430\u044f \u043e\u0445\u043e\u0442\u0430\". \u044d\u0442\u043e \u0440\u043e\u043b\u0435\u0432\u0430\u044f \u0438\u0433\u0440\u0430 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u043c\u0438\u0440\u043e\u043c, \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d\u043d\u0430\u044f \u043f\u043e\u043b\u044c\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0435\u0439 cd projekt red. \u0438\u0433\u0440\u043e\u043a \u0438\u0433\u0440\u0430\u0435\u0442 \u0437\u0430 \u0433\u043b\u0430\u0432\u043d\u043e\u0433\u043e \u0433\u0435\u0440\u043e",
+      "there are several libraries available to help you work with websockets in javascript, each with varying levels of abstraction. if you're looking for the simplest and highest level of abstraction, you "
+    ]
+  },
+  "linear_baseline": {
+    "held_out_test": {
+      "samples": 10239,
+      "roc_auc": 0.99981,
+      "pr_auc": 0.99941,
+      "detection_at_1pct_false_alarms": 0.9968,
+      "detection_at_0.1pct_false_alarms": 0.9796,
+      "threshold": 0.6494,
+      "detection_rate": 0.9865,
+      "false_alarm_rate": 0.0014,
+      "precision": 0.9949,
+      "confusion": {
+        "tp": 2126,
+        "fp": 11,
+        "fn": 29,
+        "tn": 8073
+      }
+    },
+    "challenge_set": {
+      "attacks": 60,
+      "caught": 58,
+      "missed": [
+        "<a href=\"#\" onclick=\"fetch('/api/delete-account',{method:'POST'})\">Free gift</a>",
+        "<p onmouseenter=$.post('/settings/email',{email:'a@attacker.example'})>Great article</p>"
+      ],
+      "benign": 80,
+      "false_alarms": []
+    },
+    "external_benchmark": {
+      "attack_sources": {
+        "seclists_brutelogic": {
+          "attacks": 101,
+          "caught": 89,
+          "unseen_attacks": 99,
+          "unseen_caught": 87
+        },
+        "seclists_jhaddix": {
+          "attacks": 106,
+          "caught": 99,
+          "unseen_attacks": 64,
+          "unseen_caught": 58
+        },
+        "seclists_mario": {
+          "attacks": 137,
+          "caught": 120,
+          "unseen_attacks": 135,
+          "unseen_caught": 119
+        },
+        "seclists_ofjaaah": {
+          "attacks": 198,
+          "caught": 168,
+          "unseen_attacks": 197,
+          "unseen_caught": 167
+        },
+        "seclists_payloadbox": {
+          "attacks": 1213,
+          "caught": 1152,
+          "unseen_attacks": 880,
+          "unseen_caught": 825
+        },
+        "seclists_polyglots": {
+          "attacks": 13,
+          "caught": 13,
+          "unseen_attacks": 13,
+          "unseen_caught": 13
+        },
+        "seclists_portswigger": {
+          "attacks": 6042,
+          "caught": 5885,
+          "unseen_attacks": 6041,
+          "unseen_caught": 5884
+        },
+        "seclists_rsnake": {
+          "attacks": 66,
+          "caught": 62,
+          "unseen_attacks": 12,
+          "unseen_caught": 8
+        },
+        "seclists_somdev": {
+          "attacks": 20,
+          "caught": 16,
+          "unseen_attacks": 19,
+          "unseen_caught": 15
+        }
+      },
+      "benign_sources": {
+        "oasst": {
+          "benign": 1994,
+          "false_alarms": 0
+        },
+        "wikitext": {
+          "benign": 4999,
+          "false_alarms": 0
+        }
+      },
+      "attacks": 7896,
+      "caught": 7604,
+      "unseen_attacks": 7460,
+      "unseen_caught": 7176,
+      "benign": 6993,
+      "false_alarms": 0,
+      "false_alarm_examples": []
+    }
+  }
+}

model.safetensors

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f8b64f013d75878e2546d8fdd957abd8226e7add8a30693598aa018927060298
+size 7843860

xss_detector.py

@@ -0,0 +1,152 @@
+"""Standalone loader for the character-level XSS detector.
+
+Needs only torch, numpy and safetensors (plus huggingface_hub to download):
+
+    from xss_detector import XSSDetector
+    detector = XSSDetector.from_pretrained("<repo id or local folder>")
+    detector.predict(["<img src=x onerror=alert(1)>", "<b>hello</b>"])
+
+The weights are a safetensors file, so loading them runs no code from the download.
+"""
+from __future__ import annotations
+
+import html
+import json
+import math
+import re
+from pathlib import Path
+from urllib.parse import unquote
+
+import numpy as np
+import torch
+from safetensors.torch import load_file
+from torch import nn
+from torch.nn import functional as F
+
+PAD, OTHER, VOCAB = 0, 257, 258  # 1..256 are code points 0..255; OTHER is every later code point
+_WHITESPACE = re.compile(r"\s+")
+
+
+def normalize(text: str, rounds: int = 3) -> str:
+    """Undo URL and HTML encoding (up to `rounds` times), drop NUL bytes, squeeze whitespace, lowercase."""
+    text = str(text)
+    for _ in range(rounds):
+        decoded = html.unescape(unquote(text))
+        if decoded == text:
+            break
+        text = decoded
+    text = text.replace("\x00", "")
+    return _WHITESPACE.sub(" ", text).strip().lower()
+
+
+def windows(text: str, window: int, stride: int) -> list[str]:
+    """Overlapping windows of a normalised text. Each is scored; the highest score counts."""
+    if len(text) <= window:
+        return [text]
+    return [text[i : i + window] for i in range(0, len(text) - window + stride, stride)]
+
+
+def encode(text: str, max_length: int) -> np.ndarray:
+    points = np.frombuffer((text[:max_length] or " ").encode("utf-32-le", "surrogatepass"), dtype=np.uint32)
+    return np.where(points < 256, points + 1, OTHER).astype(np.int64)
+
+
+class XSSNet(nn.Module):
+    """Character embeddings -> convolutions over 1/3/5/7 characters -> 2 stride-2 convolutions -> Transformer encoder -> pooled head."""
+
+    def __init__(self, max_length: int, embed_dim: int, width: int, layers: int, heads: int, dropout: float = 0.0):
+        super().__init__()
+        self.max_length = max_length
+        self.embed = nn.Embedding(VOCAB, embed_dim, padding_idx=PAD)
+        self.convs = nn.ModuleList(nn.Conv1d(embed_dim, width // 4, k, padding=k // 2) for k in (1, 3, 5, 7))
+        self.down = nn.ModuleList(nn.Conv1d(width, width, 3, stride=2, padding=1) for _ in range(2))
+        self.position = nn.Embedding((max_length + 3) // 4, width)
+        layer = nn.TransformerEncoderLayer(width, heads, 3 * width, dropout, activation="gelu", batch_first=True, norm_first=True)
+        self.encoder = nn.TransformerEncoder(layer, layers, enable_nested_tensor=False)
+        self.norm = nn.LayerNorm(width)
+        self.head = nn.Sequential(nn.Linear(2 * width, width), nn.GELU(), nn.Dropout(dropout), nn.Linear(width, 1))
+
+    def forward(self, tokens: torch.Tensor) -> torch.Tensor:
+        """Logit per row; positive means XSS."""
+        mask = tokens != PAD
+        x = self.embed(tokens).transpose(1, 2)
+        x = torch.cat([F.gelu(conv(x)) for conv in self.convs], dim=1) * mask.unsqueeze(1)
+        for down in self.down:
+            mask = mask[:, ::2]
+            x = F.gelu(down(x)) * mask.unsqueeze(1)
+        x = x.transpose(1, 2)
+        x = x + self.position(torch.arange(x.size(1), device=x.device))
+        x = self.norm(self.encoder(x, src_key_padding_mask=~mask))
+        keep = mask.unsqueeze(-1)
+        highest = x.masked_fill(~keep, -1e4).amax(dim=1)
+        average = (x * keep).sum(dim=1) / keep.sum(dim=1)
+        return self.head(torch.cat([highest, average], dim=-1)).squeeze(-1)
+
+
+class XSSDetector:
+    def __init__(self, folder: str | Path, device: str | None = None, batch_size: int = 256):
+        folder = Path(folder)
+        self.config = json.loads((folder / "config.json").read_text(encoding="utf-8"))
+        if self.config.get("architecture") != "xss_char_cnn_transformer" or self.config.get("tokenizer") != "codepoints_v1":
+            raise ValueError("config.json does not describe this detector")
+        net = self.config["network"]
+        self.device = device or ("cuda" if torch.cuda.is_available() else "cpu")
+        self.model = XSSNet(net["max_length"], net["embed_dim"], net["width"], net["layers"], net["heads"])
+        self.model.load_state_dict(load_file(str(folder / "model.safetensors")))
+        self.model.to(self.device).eval()
+        self.threshold = float(self.config["threshold"])
+        self.temperature = float(self.config["temperature"])
+        if not (math.isfinite(self.temperature) and self.temperature > 0 and 0 <= self.threshold <= 1):
+            raise ValueError("invalid threshold or temperature in config.json")
+        self.batch_size = batch_size
+
+    @classmethod
+    def from_pretrained(cls, repo_or_folder: str, revision: str | None = None, device: str | None = None) -> "XSSDetector":
+        """A local folder, or a Hugging Face repo id (downloads only config.json and model.safetensors)."""
+        if Path(repo_or_folder).is_dir():
+            return cls(repo_or_folder, device)
+        from huggingface_hub import snapshot_download
+
+        folder = snapshot_download(repo_or_folder, revision=revision, allow_patterns=["config.json", "model.safetensors"])
+        return cls(folder, device)
+
+    @torch.inference_mode()
+    def _logits(self, chunks: list[str]) -> np.ndarray:
+        rows = [encode(chunk, self.model.max_length) for chunk in chunks]
+        order = np.argsort([len(row) for row in rows], kind="stable")
+        out = np.zeros(len(rows))
+        start = 0
+        while start < len(order):
+            longest = len(rows[order[min(start + self.batch_size, len(order)) - 1]])
+            picks = order[start : start + max(8, min(self.batch_size, self.batch_size * 250 // longest))]
+            tokens = np.zeros((len(picks), max(len(rows[i]) for i in picks)), dtype=np.int64)
+            for j, i in enumerate(picks):
+                tokens[j, : len(rows[i])] = rows[i]
+            out[picks] = self.model(torch.from_numpy(tokens).to(self.device)).double().cpu().numpy()
+            start += len(picks)
+        return out
+
+    def score(self, texts: list[str]) -> np.ndarray:
+        """Calibrated probability of XSS for each text (the highest over its windows)."""
+        chunks, owners = [], []
+        for i, text in enumerate(texts):
+            for chunk in windows(normalize(text, self.config["max_decode_rounds"]), self.config["window"], self.config["stride"]):
+                chunks.append(chunk)
+                owners.append(i)
+        out = np.zeros(len(texts))
+        if chunks:
+            z = np.clip(self._logits(chunks) / self.temperature, -50, 50)
+            np.maximum.at(out, owners, 1 / (1 + np.exp(-z)))
+        return out
+
+    def predict(self, texts: list[str]) -> list[dict]:
+        """[{"text", "score", "is_xss"}] using the threshold tuned for 0.1% false alarms on validation data."""
+        return [{"text": text, "score": round(float(s), 6), "is_xss": bool(s > self.threshold)} for text, s in zip(texts, self.score(texts))]
+
+
+if __name__ == "__main__":
+    import sys
+
+    detector = XSSDetector.from_pretrained(sys.argv[1] if len(sys.argv) > 1 else ".")
+    for row in detector.predict(sys.argv[2:] or ["<img src=x onerror=alert(1)>", "<b>hello</b>"]):
+        print(f"{'XSS   ' if row['is_xss'] else 'benign'}  {row['score']:.3f}  {row['text'][:100]}")