Appearance
Report Template
Generated HTML reports are fully self-contained single files with inline CSS and JavaScript. They require no external dependencies and work offline in any modern browser, which makes them safe to email, archive, or host behind the portal share link.
The template is implemented in scripts/report_template.sh, a 3,200+ line Bash script that emits HTML/CSS/JS fragments. scripts/generate_report.sh assembles them:
bash
# generate_html_report <session.json> <report.html> [config.conf]
./scripts/generate_report.sh session_results.json report.html ~/netvuln-tool/configs/acme_corp.confgenerate_report.sh reads the session JSON (client, scope, assessor, timing, summary counts, findings, hosts) and, when a config is supplied, overlays branding and metadata from it before rendering.
Export Toolbar
The report includes a toolbar for exporting data in multiple formats:
| Button | Function | Output |
|---|---|---|
| Print / PDF | Opens the browser print dialog | PDF via print-to-PDF |
| Export CSV | Downloads findings as CSV | netvuln_findings_<date>.csv |
| Export JSON | Downloads the raw session data | session_results.json |
The toolbar is hidden when printing. CSV export columns are ID, Severity, Host, Port, Finding, Description.
Interactive Features
- Findings search: a text input filters findings by IP, domain, CVE, or keyword alongside severity filter buttons.
- Host links: host IPs/domains in the findings table are clickable and scroll to (and auto-expand) the matching host-detail section.
- Expand / collapse all: bulk toggles for host-detail sections.
- Pagination: long findings lists page client-side.
- Module timing summary: per-module and per-phase runtime in a grid, with total pipeline runtime.
- MAC address and hop distance: network-layer details in host-detail sections when nmap detects them.
- Domain / DNS details: a dedicated section for full DNS records (A, AAAA, MX, NS, TXT, SOA, CNAME, PTR, SRV, CAA, DMARC, SPF).
- CVE descriptions: real descriptions fetched from cve.org rather than generic placeholders, linked back to cve.org.
- Topology view: the network-topology visualization with subnet grouping and per-host risk grades.
- Pipeline log: an embedded, searchable, collapsible log; when expanded it is included in PDF/print exports.
- Readable timestamps: start/end times formatted as MM-DD-YY with the time on a separate line.
Client-Side Testing
The template JavaScript (34 embedded functions) is tested independently with vitest and jsdom: 143 tests across 7 files in tests/client/. The suites extract the JS from the Bash heredoc and exercise it in jsdom:
| File | Coverage |
|---|---|
report-registry.test.mjs | Feature-registry initialization |
report-tabs.test.mjs | Tab-system navigation |
report-filters.test.mjs | Filter and search interactions |
report-pagination.test.mjs | Pagination logic |
report-exports.test.mjs | CSV / JSON export behavior |
report-topology.test.mjs | Topology rendering |
report-misc.test.mjs | Host expansion, log display, risk visualization, remediation views, notes |
Run them with npm run test:client.
White-Labeling
Reports support config-driven branding through CSS custom-property overrides emitted by rt_brand_overrides() (primary color, subtitle, footer). This is portal-transparent: the portal stores and serves the report HTML unchanged. See White-Labeling and Report Configuration.
Developer Notes
Known gotcha
The loadScheduleWidget() function contains doc.write('...</body></html>'), which puts a </body> string inside a JavaScript string literal. When injecting content before the real </body>, always use lastIndexOf('</body>') + substring(). Never use String.replace('</body>', ...), which matches the first (wrong) occurrence and corrupts the report.
Because the file is large and load-bearing, cosmetic changes should be mirrored to the demo page and, when needed, re-pushed to existing portal sessions via scripts/refresh_reports.sh. See the report-template and report-sync workflows in the repository tooling.
Related
- Session Data: the JSON the template renders.
- Scoring Methodology: how the risk grade and score shown in the report are computed.
- API Contract: the report-HTML structure shared with the portal share page.