Gh0st
/
Nettacker
mirror of https://github.com/OWASP/Nettacker.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

unicode encoding of special characters to avoid breaking WAF scans graph (#1096) 

* unicode encoding of special characters to avoid breaking the HTML graph

* rerun checks

* ruff

---------

Co-authored-by: Sam Stepanyan <sam.stepanyan@owasp.org>
This commit is contained in:
Achintya Jai 2025-08-09 02:49:03 +05:30 committed by GitHub
parent cab9b2c2fe
commit 7c36e44a67
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
nettacker/lib/graph/d3_tree_v1/engine.py
View File

@ -4,6 +4,15 @@ from nettacker.config import Config
from nettacker.core.messages import messages from nettacker.core.messages import messages
def escape_for_html_js(json_str: str) -> str:
"""
This is necessary because some payloads have HTML tags for XSS
as in waf.yaml, which break the HTML and output no graph. These are unicode escape
characters for the same
"""
return json_str.replace("<", "\\u003C").replace(">", "\\u003E").replace("&", "\\u0026")
def start(events): def start(events):
""" """
generate the d3_tree_v1_graph with events generate the d3_tree_v1_graph with events
@ -41,7 +50,7 @@ def start(events):
data = ( data = (
open(Config.path.web_static_dir / "report/d3_tree_v1.html") open(Config.path.web_static_dir / "report/d3_tree_v1.html")
.read() .read()
.replace("__data_will_locate_here__", json.dumps(d3_structure)) .replace("__data_will_locate_here__", escape_for_html_js(json.dumps(d3_structure)))
.replace("__title_to_replace__", messages("pentest_graphs")) .replace("__title_to_replace__", messages("pentest_graphs"))
.replace("__description_to_replace__", messages("graph_message")) .replace("__description_to_replace__", messages("graph_message"))
.replace("__html_title_to_replace__", messages("nettacker_report")) .replace("__html_title_to_replace__", messages("nettacker_report"))