Scan reports in HTML are downloaded in WebUI
@jess-tech-lab is already working on this.
Since Mar 2, 2026.
- Dominant language
- Python
- Stars
- 5.6k
- Forks
- 1.2k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 16
Description
Summary
Currently, when using the WebUI, clicking the link for a completed scan result triggers an automatic download of the HTML file. While having the file locally is useful for archiving, it would improve the user experience if the report rendered directly in the browser.
Steps to Reproduce
In WebUI, click any scan result e.g. https://127.0.0.1:8080/results/get?id=2, the result in HTML is downloaded
I expected scan results in HTML are viewable in the browser window of WebUI
Suggested Fix
The API in nettacker/api/engine.py can change text/plain to text/html and attachment to inline at least for HTML files.
I am curious if the current "force download" behavior was a deliberate design choice to mitigate security risks, such as preventing potential Cross-Site Scripting (XSS). We might implement a secure rendering method like a sandboxed iframe or strict Content-Security-Policy headers to balance safety with a smoother UI.
I would love to contribute a fix for this if the maintainers agree this is a worthwhile improvement. Please let me know if you would like me to submit a PR.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.