CervantesSec / cervantes

Cervantes is an open-source, collaborative platform designed specifically for pentesters and red teams. It serves as a comprehensive management tool, streamlining the organization of projects, clients, vulnerabilities, and reports in a single, centralized location.
https://www.cervantessec.org/
Apache License 2.0
277 stars 41 forks source link

Docx report issues #51

Open EmiliaChovancova opened 1 month ago

EmiliaChovancova commented 1 month ago

Reports generated in docx format are not reflecting original formatting. These are the issues found in tables and images.

Tables

HTML downloaded report (working): html_dowloaded_report

Docx format report - not working :(

doxc_report_downloaded

Steps to reproduce

  1. Create a simple table - for example like this:
    <table style="border-collapse: collapse; width: 60%; height: 44.7812px; margin-left: auto; margin-right: auto;"><colgroup><col style="width: 33.7296%;"><col style="width: 32.9883%;"><col style="width: 33.2662%;"></colgroup>
    <thead>
    <tr style="border-bottom: 1px solid rgba(169, 169, 169, 1); border-top: 1px solid rgba(169, 169, 169, 1); height: 22.3906px;">
    <th style="color: rgba(238, 0, 0, 1); height: 22.3906px; text-align: left;"><span style="font-size: 10pt;">A</span></th>
    <th style="color: rgba(238, 0, 0, 1); height: 22.3906px; text-align: left;"><span style="font-size: 10pt;">B</span></th>
    <th style="color: rgba(238, 0, 0, 1); height: 22.3906px; text-align: left;"><span style="font-size: 10pt;">C</span></th>
    </tr>
    </thead>
    <tbody>
    <tr style="height: 22.3906px;">
    <td style="height: 22.3906px;"><span style="font-size: 10pt;">D</span></td>
    <td style="height: 22.3906px;"><span style="font-size: 10pt;">E</span></td>
    <td style="height: 22.3906px;"><span style="font-size: 10pt;">F</span></td>
    </tr>
    </tbody>
    </table>
  2. Generate and download a docx report.

Images

Preview in Cervantes, downloaded HTML report or external HTML editors are working correctly: preview_cervantes

But again, the docx report is not working :( image is on the left side of the page even though the parameters were set to the right side:

DOCXreportDownloaded

Steps to reproduce

  1. Insert an image to the component
  2. Adjust the html code to for example:
    <p style="page-break-inside: avoid; margin-bottom: 0.14in; page-break-after: avoid; position: relative;"><img style="float: right; margin: 0 0 15px 15px;" src="blob:https://SourceOfTheImage" width="338" height="310"></span></p>
mesquidar commented 1 month ago

Hi @EmiliaChovancova thanks for reporting this issue I will take it a look and I will let you know :)

Thank you Best regards

mesquidar commented 1 month ago

Hi @EmiliaChovancova I found the issue it's a known bug on a library used to convert the html code to openxml format I did a downgrade of the library until it's fixed in the nexts days :)

I created a dev image if you want to test it before to commit the changes

git clone https://github.com/CervantesSec/docker.git
docker-compose -p cervantes -f docker-compose-dev.yml up -d

Thank you :) Best regards

EmiliaChovancova commented 3 weeks ago

Hi @mesquidar, It looks like the functionality is still not working. The library that is used to convert the html to xml declares that it supports “margin”, but even after you downgraded the library the image is still not exactly, where it is supposed to be. I would create an issue with the library as it is not a cervantes bug but the html2openxml library, wdyt?

EmiliaChovancova commented 2 weeks ago

Hi @mesquidar, wdyt about my proposal? Thank you :)

mesquidar commented 2 weeks ago

Hi @EmiliaChovancova sorry I didn't saw your message. Yes sure you can open an issue if you want

I updated the library to new version that dev released and I am making some tests

I created a new dev image if you want to test i too

Thank you :)

EmiliaChovancova commented 2 weeks ago

Hi @mesquidar, thank you, it looks like the updated version is struggling with images in headers and footers. If the template contains an image in header or a footer the docx report cannot be generated and downloaded. Here is the log output:

System.NullReferenceException: Object reference not set to an instance of an object. at HtmlToOpenXml.Expressions.ImageExpressionBase.<>c.<IncrementDrawingObjId>b__5_0(HeaderPart f) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/Image/ImageExpressionBase.cs:line 90 at System.Linq.Enumerable.SelectManySingleSelectorIterator`2.MoveNext() at HtmlToOpenXml.Expressions.ImageExpressionBase.IncrementDrawingObjId(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/Image/ImageExpressionBase.cs:line 93 at HtmlToOpenXml.Expressions.ImageExpression.CreateDrawing(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/Image/ImageExpression.cs:line 60 at HtmlToOpenXml.Expressions.ImageExpressionBase.Interpret(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/Image/ImageExpressionBase.cs:line 31 at HtmlToOpenXml.Expressions.BlockElementExpression.ComposeChildren(ParsingContext context, IEnumerable`1 childNodes, ParagraphProperties paragraphProperties, Action`1 preAction, Action`1 postAction) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/BlockElementExpression.cs:line 266 at HtmlToOpenXml.Expressions.BlockElementExpression.Interpret(ParsingContext context, IEnumerable`1 childNodes) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/BlockElementExpression.cs:line 53 at HtmlToOpenXml.Expressions.PhrasingElementExpression.Interpret(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/PhrasingElementExpression.cs:line 41 at HtmlToOpenXml.Expressions.BlockElementExpression.Interpret(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/BlockElementExpression.cs:line 35 at HtmlToOpenXml.Expressions.BlockElementExpression.ComposeChildren(ParsingContext context, IEnumerable`1 childNodes, ParagraphProperties paragraphProperties, Action`1 preAction, Action`1 postAction) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/BlockElementExpression.cs:line 266 at HtmlToOpenXml.Expressions.BlockElementExpression.Interpret(ParsingContext context, IEnumerable`1 childNodes) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/BlockElementExpression.cs:line 53 at HtmlToOpenXml.Expressions.PhrasingElementExpression.Interpret(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/PhrasingElementExpression.cs:line 41 at HtmlToOpenXml.Expressions.BlockElementExpression.Interpret(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/BlockElementExpression.cs:line 35 at HtmlToOpenXml.Expressions.BodyExpression.Interpret(ParsingContext context) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/Expressions/BodyExpression.cs:line 31 at HtmlToOpenXml.HtmlConverter.Parse(String html, ParallelOptions parallelOptions) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/HtmlConverter.cs:line 106 at HtmlToOpenXml.HtmlConverter.Parse(String html) in /Users/olivier/Projects/html2openxml/src/Html2OpenXml/HtmlConverter.cs:line 66 at Cervantes.Web.Controllers.ReportController.DownloadReport(ReportDownloadModel model) in /src/Cervantes.Web/Controllers/ReportController.cs:line 1048

I'll go ahead and create an issue with the library.

Thank you :)

mesquidar commented 1 week ago

Hi @EmiliaChovancova I built a new dev image with new version of html2openxml 3.1.1 that @onizet released

If you want to test it :)

Best regards

jstangle commented 1 week ago

Hi @mesquidar, thank you for the update. I just tested the latest release and it is not crashing. Unfortunately, the images in the header and footer of the HTML are not being displayed in the DOCX report. image

mesquidar commented 1 week ago

Hi @jstangle thanks for the feedback. Can you comment the issue in https://github.com/onizet/html2openxml/issues/159 so in this case @onizet can manage it

Thank you :)