minvws / nl-kat-coordination

OpenKAT scans networks, finds vulnerabilities and creates accessible reports. It integrates the most widely used network tools and scanning software into a modular framework, accesses external databases such as shodan, and combines the information from all these sources into clear reports. It also includes lots of cat hair.
https://openkat.nl
European Union Public License 1.2
127 stars 58 forks source link

wrong encoding links to background info in report leads to 404-pages #3500

Closed tzijlmans closed 1 month ago

tzijlmans commented 2 months ago

Please add bug, the name of any relevant modules (e.g. rocky), and any other relevant labels to your issue.

Describe the bug In a finding report in PDF-format the user can click on a link to get more background info about the finding. The linktext is correct, the href is wrong and ends in a 404. For example: https://developer.mozilla.org/en%7B-%7DUS/docs/Web/HTTP/CSP which must be https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP.

Same applies for these links: https://developer.mozilla.org/en%7B-%7DUS/docs/Web/HTTP/Headers/Strict%7B-%7DTransport%7B-%7DSecurity https://developer.mozilla.org/en%7B-%7DUS/docs/Web/HTTP/Headers/Permissions%7B-%7DPolicy https://developer.mozilla.org/en%7B-%7DUS/docs/Web/HTTP/Headers/X%7B-%7DDNS%7B-%7DPrefetch%7B-%7DControl https://owasp.org/www%7B-%7Dproject%7B-%7Dsecure%7B-%7Dheaders/#div{-}headers

Those where the findings in one report.

To Reproduce General behaviour/info, nothing local so i presume any download of a findings report. I did not check other MDN links

  1. Go to '...'
  2. Click on '....'
  3. Scroll down to '....'
  4. See error

Expected behavior is opening the correct webpage, preferable in a new tab but that is probably a new ticket.

Screenshots If applicable, add screenshots to help explain your problem.

OpenKAT version 1.16

Desktop (please complete the following information if relevant):

Additional context Add any other context about the problem here.

underdarknl commented 2 months ago

@tzijlmans thank you for pointing this out. It looks like we are doing some double url-encoding there. we'll investigate.

underdarknl commented 2 months ago

Confirmed by Kennisnet