search

dfir-iris / iris-web

Collaborative Incident Response platform
GNU Lesser General Public License v3.0
1.05k stars 169 forks source link

Markdown in docx reports not visible #341

Open laciKE opened 10 months ago

laciKE commented 10 months ago

Describe the bug Docx reports with markdown content processes by |markdown processor is not displayed in the generated docx document.

When examining ooxml content (word/document.xml), the content is there, but it is not displayed when document is opened in LibreOffice nor MicrosoftS365 Word (online editor).

To Reproduce Steps to reproduce the behavior:

  1. Follow https://docs.dfir-iris.org/getting_started/ and install DFIR-IRIS v2.3.5 with docker-compose
  2. Put some markdown content into case description of Initial Demo
  3. Import investigation report template from https://docs.dfir-iris.org/operations/example_reports/iris_report_template.docx
  4. Generate report
  5. Open docx file in LibreOffice/MS365 Word - markdown content is not visible
  6. Test again: put {{ case.description|markdown }} and {{ case.description }} into the docx template. Now, the "raw markdown" content is displayed, but not the content processed with the |markdown processor
  7. Unzip docx and see word/document.xml - processed case description is there, but it is not displayed in the Word

Expected behavior To see rendered markdown content in docx reports.

Screenshots

Desktop (please complete the following information):

Additional context It seems that even the markdown content is not properly displayed even for older releases of DFIR-IRIS (tested with v2.3.3)

Exported case:

{"status": "success", "message": "", "data": {"case": {"review_status_id": null, "case_uuid": "e6d103cd-33d2-4680-9087-63ba548c829a", "user_id": 1, "reviewer_id": null, "state_id": null, "alerts": [], "review_status": null, "custom_attributes": null, "name": "#1 - Initial Demo", "severity_id": null, "client_id": 1, "classification_id": null, "modification_history": null, "severity": null, "reviewer": null, "user": {"user_name": "administrator", "user_login": "administrator", "user_email": "administrator@localhost", "id": 1}, "close_date": null, "soc_id": "soc_id_demo", "case_id": 1, "owner_id": 1, "client": {"client_uuid": "cc1b7d96-96da-4497-bc5b-ed955a7cf455", "customer_name": "IrisInitialClient", "customer_sla": null, "customer_description": null, "custom_attributes": null, "customer_id": 1, "last_update_date": "2023-12-02T08:18:46.633199", "creation_date": "2023-12-02T08:18:46.633199"}, "closing_note": null, "tags": [], "initial_date": "2023-12-02T08:18:46.648419", "state": null, "classification": null, "owner": {"user_name": "administrator", "user_login": "administrator", "user_email": "administrator@localhost", "id": 1}, "description": "This is a demonstration.\n\nMarkdown examples: **bold** *italic*\n\n- **bold item**\n- *italic item*\n- normal item", "status_name": "unknown", "status_id": 0, "open_date": "2023-12-02", "protagonists": []}, "evidences": [], "timeline": [], "iocs": [], "assets": [], "tasks": [], "comments": [], "notes": [], "export_date": "2023-12-02T09:22:43.475834"}}
SanketBaraiya commented 6 months ago

Hi @whikernel any updates on this? Facing the same issue with docx report template.

SanketBaraiya commented 3 months ago

Hi @laciKE @whikernel any updates on this??