Analyse: Skript nur für aktive Websites, leeres Skript sonst, siteKey in der Skript-URL

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

runner/src/analytics-inject.js

@@ -17,7 +17,7 @@ export const isValidBase = (b) => typeof b === 'string' && /^https:\/\/[^\s"'<>]
 
 export function scriptTag(analytics, baseUrl) {
   // Attributwerte nur aus geprüften Eingaben (Regex), daher ohne Maskierung sicher.
-  return `<script data-wk-analytics src="${baseUrl}w.js" data-site="${analytics.siteKey}" data-color="${analytics.color}" defer></script>`;
+  return `<script data-wk-analytics src="${baseUrl}w.js?s=${analytics.siteKey}" data-site="${analytics.siteKey}" data-color="${analytics.color}" defer></script>`;
 }
 
 // Spannen, in denen Marker nichts zu suchen haben: Kommentare, script, style, textarea, template (ohne Verschachtelungs-Logik).

runner/test/analytics-inject.test.js

@@ -11,7 +11,7 @@ import { createJobs } from '../src/jobs.js';
 const BASE = 'https://project.webklar.com/a/';
 const KEY = 'abcdef0123456789abcd';
 const A = (o = {}) => ({ siteKey: KEY, color: '#2b6cb0', privacy: { company: 'Muster GmbH', address: 'Weg 1, 12345 Ort', email: 'info@muster.de' }, ...o });
-const TAG = `<script data-wk-analytics src="${BASE}w.js" data-site="${KEY}" data-color="#2b6cb0" defer></script>`;
+const TAG = `<script data-wk-analytics src="${BASE}w.js?s=${KEY}" data-site="${KEY}" data-color="#2b6cb0" defer></script>`;
 const dir = () => mkdtempSync(join(tmpdir(), 'inj-'));
 const put = (d, f, c) => { mkdirSync(join(d, f, '..'), { recursive: true }); writeFileSync(join(d, f), c); };
 const get = (d, f) => readFileSync(join(d, f), 'utf8');