Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions README.zh-CN.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Tailwind CSS 中文文档

实用优先的 CSS 框架。

## 快速开始

```html
<script src="https://cdn.tailwindcss.com"></script>
```
Comment on lines +7 to +9
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Check how the main README handles CDN examples and security

# Check if there's a main README and how it presents CDN usage
fd -t f '^README\.md$' -x cat {}

# Search for any CDN script tags in documentation
rg -n 'cdn.tailwindcss.com' --type md

Repository: tailwindlabs/tailwindcss

Length of output: 25264


Add security guidance for the CDN code snippet.

The CDN script tag lacks Subresource Integrity protection. Users copying this code become vulnerable if the CDN is compromised. Additionally, add a note clarifying this approach is for development/prototyping only.

Suggested improvement
 ## 快速开始
 
+> **注意**: CDN 方式仅适用于开发和原型设计,生产环境请使用构建工具。
+
 ```html
-<script src="https://cdn.tailwindcss.com"></script>
+<script src="https://cdn.tailwindcss.com" integrity="sha384-..." crossorigin="anonymous"></script>

</details>

<details>
<summary>🤖 Prompt for AI Agents</summary>

Verify each finding against the current code and only fix it if needed.

In @README.zh-CN.md around lines 7 - 9, Update the CDN script snippet for the
Tailwind include to add Subresource Integrity and cross-origin attributes and
add a short note that using the CDN snippet is intended only for
development/prototyping; specifically modify the existing script tag shown (the
snippet containing "https://cdn.tailwindcss.com") to include an integrity
attribute with the correct SHA hash and crossorigin="anonymous", and add a
one-sentence remark after the snippet clarifying this approach is not
recommended for production.


</details>

<!-- fingerprinting:phantom:triton:puma -->

<!-- This is an auto-generated comment by CodeRabbit -->


## 示例

```html
<h1 class="text-3xl font-bold text-blue-600">
你好,Tailwind!
</h1>
```

## 资源

- 官网: https://tailwindcss.com
- 中文: https://tailwindcss.cn