GhostManager / Ghostwriter

The SpecterOps project management and reporting engine
https://ghostwriter.wiki
BSD 3-Clause "New" or "Revised" License
1.23k stars 174 forks source link

`modules.reportwriter.richtext.plain_text.py` data-gw-evidence not replaced in output #462

Closed domwhewell-sage closed 2 weeks ago

domwhewell-sage commented 2 weeks ago

Describe the bug When generating a XLSX document any evidence {{.X}} should be being replaced with <See Report for Evidence File: X> Caption \u2013 X

However the get() to obtain the evidence ID from the evidences dictionary currently returns a NoneType

def _build_html_str(node, evidences, out: StringIO):
    if node.name is None:
        text = strip_text_whitespace(node)
        out.write(text)
        return

    if node.name == "span" and "data-gw-evidence" in node.attrs:
        evidence = evidences.get(node.attrs["data-gw-evidence"])
        if evidence is not None:
            out.write(
                f"\n<See Report for Evidence File: {evidence['friendly_name']}>\nCaption \u2013 {evidence['caption']}"
            )
            return

The node.attrs["data-gw-evidence"] will be a string (At least it has been in my testing) and it needs to be converted to <class 'int'> to match the dictionary key

To Reproduce Steps to reproduce the behavior:

  1. Create a report with a finding that references an evidence file
  2. Generate that report as an XLSX document
  3. You will see instead of referencing the report "See Report for Evidence File..." the evidence reference has been replaced with whitespace

Expected Behavior The evidence variable gets populated and the XLSX report contains "<See Report for Evidence File:...."

Server Specs: