- API: add `POST /api/analyze_script` (app/blueprints/api.py)
- Fetch one external script to artifacts, run rules, return findings + snippet
- Uses new ExternalScriptFetcher (results_path aware) and job UUID
- Returns: { ok, final_url, status_code, bytes, truncated, sha256, artifact_path, findings[], snippet, snippet_len }
- TODO: document in openapi/openapi.yaml
- Fetcher: update `app/utils/external_fetch.py`
- Constructed with `results_path` (UUID dir); writes to `<results_path>/scripts/fetched/<index>.js`
- Loads settings via `get_settings()`, logs via std logging
- UI (results.html):
- Move “Analyze external script” action into **Content Snippet** column for external rows
- Clicking replaces button with `<details>` snippet, shows rule matches, and adds “open in viewer” link
- Robust fetch handler (checks JSON, shows errors); builds viewer URL from absolute artifact path
- Viewer:
- New route: `GET /view/artifact/<run_uuid>/<path:filename>` (app/blueprints/ui.py)
- New template: Monaco-based read-only code viewer (viewer.html)
- Removes SRI on loader to avoid integrity block; loads file via `raw_url` and detects language by extension
- Forms:
- Refactor `analyze_forms` to mirror scripts analysis:
- Uses rule engine (`category == "form"`) across regex/function rules
- Emits rows only when matches exist
- Includes `content_snippet`, `action`, `method`, `inputs`, `rules`
- Replace legacy plumbing (`flagged`, `flag_reasons`, `status`) in output
- Normalize form function rules to canonical returns `(bool, Optional[str])`:
- `form_action_missing`
- `form_http_on_https_page`
- `form_submits_to_different_host`
- Add minor hardening (lowercasing hosts, no-op actions, clearer reasons)
- CSS: add `.forms-table` to mirror `.scripts-table` (5 columns)
- Fixed table layout, widths per column, chip/snippet styling, responsive tweaks
- Misc:
- Fix “working outside app context” issue by avoiding `current_app` at import time (left storage logic inside routes)
- Add “View Source” link to open page source in viewer
Refs:
- Roadmap: mark “Source code viewer” done; keep TODO to add `/api/analyze_script` to OpenAPI
153 lines
3.6 KiB
HTML
153 lines
3.6 KiB
HTML
{% extends 'base.html' %}
|
|
{% block content %}
|
|
|
|
<!-- Analysis Form -->
|
|
<form id="analyze-form" method="post" action="{{ url_for('main.analyze') }}" class="card">
|
|
<h2>Analyze a URL</h2>
|
|
<label for="url">Enter a URL to analyze</label>
|
|
<input id="url" name="url" type="url" placeholder="https://example.com" required />
|
|
<button type="submit">Analyze</button>
|
|
</form>
|
|
|
|
<!-- Recent Results (optional; shown only if recent_results provided) -->
|
|
{% if recent_results %}
|
|
<div class="card" id="recent-results">
|
|
<h2>Recent Results</h2>
|
|
<table class="results-table">
|
|
<thead>
|
|
<tr>
|
|
<th>Timestamp</th>
|
|
<th>URL</th>
|
|
<th>UUID</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
{% for r in recent_results %}
|
|
<tr>
|
|
<td class="timestamp">
|
|
{% if r.timestamp %}
|
|
{{ r.timestamp }}
|
|
{% else %}
|
|
N/A
|
|
{% endif %}
|
|
</td>
|
|
<td class="url">
|
|
<a href="{{ url_for('main.view_result', run_uuid=r.uuid) }}">
|
|
{{ r.final_url or r.submitted_url }}
|
|
</a>
|
|
</td>
|
|
<td class="uuid">
|
|
<code id="uuid-{{ loop.index }}">{{ r.uuid }}</code>
|
|
<button
|
|
type="button"
|
|
class="copy-btn"
|
|
data-target="uuid-{{ loop.index }}">
|
|
📋
|
|
</button>
|
|
</td>
|
|
</tr>
|
|
{% endfor %}
|
|
</tbody>
|
|
</table>
|
|
|
|
</div>
|
|
{% endif %}
|
|
|
|
<!-- Spinner Modal -->
|
|
<div id="spinner-modal" style="
|
|
display:none;
|
|
opacity:0;
|
|
position:fixed;
|
|
top:0;
|
|
left:0;
|
|
width:100%;
|
|
height:100%;
|
|
background:rgba(0,0,0,0.7);
|
|
color:#fff;
|
|
font-size:1.5rem;
|
|
text-align:center;
|
|
padding-top:20%;
|
|
z-index:9999;
|
|
transition: opacity 0.3s ease;
|
|
">
|
|
<div>
|
|
<div class="loader" style="
|
|
border: 8px solid #f3f3f3;
|
|
border-top: 8px solid #1a2535;
|
|
border-radius: 50%;
|
|
width: 60px;
|
|
height: 60px;
|
|
animation: spin 1s linear infinite;
|
|
margin: 0 auto 1rem auto;
|
|
"></div>
|
|
Analyzing website…
|
|
</div>
|
|
</div>
|
|
|
|
<style>
|
|
@keyframes spin {
|
|
0% { transform: rotate(0deg); }
|
|
100% { transform: rotate(360deg); }
|
|
}
|
|
</style>
|
|
{% endblock %}
|
|
|
|
{% block page_js %}
|
|
|
|
<script>
|
|
const form = document.getElementById('analyze-form');
|
|
const modal = document.getElementById('spinner-modal');
|
|
|
|
function showModal() {
|
|
modal.style.display = 'block';
|
|
requestAnimationFrame(() => {
|
|
modal.style.opacity = '1';
|
|
});
|
|
}
|
|
|
|
function hideModal() {
|
|
modal.style.opacity = '0';
|
|
modal.addEventListener('transitionend', () => {
|
|
modal.style.display = 'none';
|
|
}, { once: true });
|
|
}
|
|
|
|
// Hide spinner on initial load / back navigation
|
|
window.addEventListener('pageshow', () => {
|
|
modal.style.opacity = '0';
|
|
modal.style.display = 'none';
|
|
});
|
|
|
|
form.addEventListener('submit', (e) => {
|
|
showModal();
|
|
// Prevent double submission
|
|
form.querySelector('button').disabled = true;
|
|
|
|
// Allow browser to render the modal before submitting
|
|
requestAnimationFrame(() => form.submit());
|
|
e.preventDefault();
|
|
});
|
|
</script>
|
|
|
|
<script>
|
|
document.addEventListener('DOMContentLoaded', () => {
|
|
const buttons = document.querySelectorAll('.copy-btn');
|
|
buttons.forEach(btn => {
|
|
btn.addEventListener('click', () => {
|
|
const targetId = btn.getAttribute('data-target');
|
|
const uuidText = document.getElementById(targetId).innerText;
|
|
|
|
navigator.clipboard.writeText(uuidText).then(() => {
|
|
// Give quick feedback
|
|
btn.textContent = '✅';
|
|
setTimeout(() => { btn.textContent = '📋'; }, 1500);
|
|
}).catch(err => {
|
|
console.error('Failed to copy UUID:', err);
|
|
});
|
|
});
|
|
});
|
|
});
|
|
</script>
|
|
|
|
{% endblock %}
|