OWASP / OWASP/Nettacker

Scan reports in HTML are downloaded in WebUI

Open
#1,316 6 comments 0 reactions 1 assignee View on GitHub

@jess-tech-lab is already working on this.

Since Mar 2, 2026.

Dominant language
Python
Stars
5.6k
Forks
1.2k
Avg merge
1d 21h
Merged PRs (30d)
16

Description

Summary

Currently, when using the WebUI, clicking the link for a completed scan result triggers an automatic download of the HTML file. While having the file locally is useful for archiving, it would improve the user experience if the report rendered directly in the browser.

Steps to Reproduce

In WebUI, click any scan result e.g. https://127.0.0.1:8080/results/get?id=2, the result in HTML is downloaded

Image

I expected scan results in HTML are viewable in the browser window of WebUI

Image

Suggested Fix

The API in nettacker/api/engine.py can change text/plain to text/html and attachment to inline at least for HTML files.

https://github.com/OWASP/Nettacker/blob/ed9c8cad306fdf96b26b54175c30ab218bb84851/nettacker/api/engine.py#L373-L376

https://github.com/OWASP/Nettacker/blob/ed9c8cad306fdf96b26b54175c30ab218bb84851/nettacker/api/engine.py#L393-L394

I am curious if the current "force download" behavior was a deliberate design choice to mitigate security risks, such as preventing potential Cross-Site Scripting (XSS). We might implement a secure rendering method like a sandboxed iframe or strict Content-Security-Policy headers to balance safety with a smoother UI.

I would love to contribute a fix for this if the maintainers agree this is a worthwhile improvement. Please let me know if you would like me to submit a PR.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.