Add report API formats (#15148)

* Add report API formats

* polish-reports

Author: samiat4911

dojo/api_v2/serializers.py

@@ -998,10 +998,22 @@ class Meta:
 
 
 class ReportGenerateOptionSerializer(serializers.Serializer):
+    REPORT_TYPE_CHOICES = (
+        ("JSON", "JSON"),
+        ("HTML", "HTML"),
+        ("CSV", "CSV"),
+        ("Excel", "Excel"),
+    )
+
     include_finding_notes = serializers.BooleanField(default=False)
     include_finding_images = serializers.BooleanField(default=False)
     include_executive_summary = serializers.BooleanField(default=False)
     include_table_of_contents = serializers.BooleanField(default=False)
+    report_type = serializers.ChoiceField(
+        choices=REPORT_TYPE_CHOICES,
+        default="JSON",
+        help_text="Format for the generated report.",
+    )
 
 
 class ExecutiveSummarySerializer(serializers.Serializer):

dojo/api_v2/views.py

@@ -8,6 +8,7 @@
 from django.core.exceptions import ValidationError
 from django.db import IntegrityError
 from django.db.models.query import QuerySet as DjangoQuerySet
+from django.shortcuts import render
 from django.utils import timezone
 from django_filters.rest_framework import DjangoFilterBackend
 from drf_spectacular.renderers import OpenApiJsonRenderer2
@@ -35,10 +36,12 @@
 from dojo.authorization import api_permissions as permissions
 from dojo.authorization.authorization import user_has_permission_or_403
 from dojo.endpoint.ui.views import get_endpoint_ids
+from dojo.engagement.queries import get_authorized_engagements
 from dojo.filters import (
     ApiAppAnalysisFilter,
     ApiDojoMetaFilter,
 )
+from dojo.finding.queries import get_authorized_findings
 from dojo.finding.ui.filters import (
     ReportFindingFilter,
     ReportFindingFilterWithoutObjectLookups,
@@ -69,6 +72,8 @@
     get_authorized_products,
 )
 from dojo.reports.ui.views import (
+    CSVExportView,
+    ExcelExportView,
     prefetch_related_findings_for_report,
     report_url_resolver,
 )
@@ -525,8 +530,8 @@ def perform_create(self, serializer):
             pghistory.context(test_id=test_id_from_response)
 
 
-from dojo.note_type.api.views import NoteTypeViewSet  # noqa: E402, F401 -- re-export; urls.py imports by name
-from dojo.notes.api.views import NotesViewSet  # noqa: E402, F401 -- re-export; urls.py imports by name
+from dojo.note_type.api.views import NoteTypeViewSet  # noqa: E402, F401
+from dojo.notes.api.views import NotesViewSet  # noqa: E402, F401
 
 
 def report_generate(request, obj, options):
@@ -537,6 +542,9 @@ def report_generate(request, obj, options):
     test = None
     endpoint = None
     endpoints = None
+    report_context = {}
+    report_template = None
+    report_title = "Generate Report"
 
     include_finding_notes = False
     include_finding_images = False
@@ -560,14 +568,16 @@ def report_generate(request, obj, options):
 
     if type(obj).__name__ == "Product_Type":
         product_type = obj
+        report_template = "dojo/product_type_pdf_report.html"
+        report_title = labels.ORG_REPORT_LABEL
 
         report_name = labels.ORG_REPORT_WITH_NAME_TITLE % {"name": str(product_type)}
 
         findings = report_finding_filter_class(
             request.GET,
             prod_type=product_type,
             queryset=prefetch_related_findings_for_report(
-                Finding.objects.filter(
+                get_authorized_findings("view").filter(
                     test__engagement__product__prod_type=product_type,
                 ),
             ),
@@ -586,9 +596,26 @@ def report_generate(request, obj, options):
         months_between = (r.years * 12) + r.months
         # include current month
         months_between += 1
+        report_context = {
+            "products": get_authorized_products("view").filter(
+                prod_type=product_type,
+                engagement__test__finding__in=findings.qs,
+            ).distinct(),
+            "engagements": get_authorized_engagements("view").filter(
+                product__prod_type=product_type,
+                test__finding__in=findings.qs,
+            ).distinct(),
+            "tests": get_authorized_tests("view").filter(
+                engagement__product__prod_type=product_type,
+                finding__in=findings.qs,
+            ).distinct(),
+            "months_between": months_between,
+        }
 
     elif type(obj).__name__ == "Product":
         product = obj
+        report_template = "dojo/product_pdf_report.html"
+        report_title = labels.ASSET_REPORT_LABEL
 
         report_name = labels.ASSET_REPORT_WITH_NAME_TITLE % {"name": str(product)}
 
@@ -606,6 +633,8 @@ def report_generate(request, obj, options):
 
     elif type(obj).__name__ == "Engagement":
         engagement = obj
+        report_template = "dojo/engagement_pdf_report.html"
+        report_title = "Engagement Report"
         findings = report_finding_filter_class(
             request.GET,
             engagement=engagement,
@@ -623,6 +652,8 @@ def report_generate(request, obj, options):
 
     elif type(obj).__name__ == "Test":
         test = obj
+        report_template = "dojo/test_pdf_report.html"
+        report_title = "Test Report"
         findings = report_finding_filter_class(
             request.GET,
             engagement=test.engagement,
@@ -634,6 +665,8 @@ def report_generate(request, obj, options):
 
     elif type(obj).__name__ == "Endpoint":
         endpoint = obj
+        report_template = "dojo/endpoint_pdf_report.html"
+        report_title = "Endpoint Report"
         host = endpoint.host
         report_name = "Endpoint Report: " + host
         endpoints = Endpoint.objects.filter(
@@ -648,6 +681,8 @@ def report_generate(request, obj, options):
 
     elif isinstance(obj, DjangoQuerySet):
         # Support any Django QuerySet (including Tagulous CastTaggedQuerySet)
+        report_template = "dojo/finding_pdf_report.html"
+        report_title = "Finding Report"
         findings = report_finding_filter_class(
             request.GET,
             queryset=prefetch_related_findings_for_report(obj).distinct(),
@@ -670,12 +705,20 @@ def report_generate(request, obj, options):
         "endpoint": endpoint,
         "endpoints": endpoints,
         "findings": findings.qs.order_by("numerical_severity"),
+        "include_finding_notes": include_finding_notes,
+        "include_finding_images": include_finding_images,
+        "include_executive_summary": include_executive_summary,
         "include_table_of_contents": include_table_of_contents,
+        "include_disclaimer": get_system_setting("disclaimer_reports_forced", 0),
+        "disclaimer": get_system_setting("disclaimer_reports"),
         "user": user,
         "team_name": settings.TEAM_NAME,
-        "title": "Generate Report",
+        "title": report_title,
         "user_id": request.user.id,
         "host": report_url_resolver(request),
+        "host_view": False,
+        "context": report_context,
+        "report_template": report_template,
     }
 
     finding_notes = []
@@ -792,6 +835,43 @@ def report_generate(request, obj, options):
     return result
 
 
+def _report_findings_filename(obj, extension):
+    object_id = getattr(obj, "id", None)
+    if object_id is None:
+        return f"findings.{extension}"
+
+    object_type = type(obj).__name__.lower()
+    return f"{object_type}_{object_id}_findings.{extension}"
+
+
+def report_generate_response(request, obj, options):
+    report_type = options.get("report_type", "JSON")
+
+    if report_type not in {"CSV", "Excel", "HTML", "JSON"}:
+        msg = f"Unsupported report_type: {report_type}"
+        raise ValidationError(msg)
+
+    data = report_generate(request, obj, options)
+
+    if report_type == "JSON":
+        report = serializers.ReportGenerateSerializer(data)
+        return Response(report.data)
+
+    if report_type == "HTML":
+        return render(request, data["report_template"], data)
+
+    if report_type == "CSV":
+        return CSVExportView().build_response(
+            data["findings"],
+            filename=_report_findings_filename(obj, "csv"),
+        )
+
+    return ExcelExportView().build_response(
+        data["findings"],
+        filename=_report_findings_filename(obj, "xlsx"),
+    )
+
+
 class CeleryViewSet(viewsets.ViewSet):
     permission_classes = (permissions.IsSuperUser, DjangoModelPermissions)
     queryset = System_Settings.objects.none()

dojo/engagement/api/views.py

@@ -11,7 +11,7 @@
 
 from dojo.api_v2 import serializers as api_v2_serializers
 from dojo.api_v2.prefetch.prefetcher import _Prefetcher
-from dojo.api_v2.views import DojoModelViewSet, PrefetchDojoModelViewSet, report_generate, schema_with_prefetch
+from dojo.api_v2.views import DojoModelViewSet, PrefetchDojoModelViewSet, report_generate_response, schema_with_prefetch
 from dojo.authorization import api_permissions as permissions
 from dojo.celery_dispatch import dojo_dispatch_task
 from dojo.engagement.api.filters import ApiEngagementFilter
@@ -131,14 +131,13 @@ def generate_report(self, request, pk=None):
             options[
                 "include_table_of_contents"
             ] = report_options.validated_data["include_table_of_contents"]
+            options["report_type"] = report_options.validated_data["report_type"]
         else:
             return Response(
                 report_options.errors, status=status.HTTP_400_BAD_REQUEST,
             )
 
-        data = report_generate(request, engagement, options)
-        report = api_v2_serializers.ReportGenerateSerializer(data)
-        return Response(report.data)
+        return report_generate_response(request, engagement, options)
 
     @extend_schema(
         methods=["GET"],

dojo/finding/api/views.py

@@ -33,7 +33,11 @@
 from dojo.api_v2 import (
     serializers as api_v2_serializers,
 )
-from dojo.api_v2.views import DojoModelViewSet, get_request_boolean, report_generate
+from dojo.api_v2.views import (
+    DojoModelViewSet,
+    get_request_boolean,
+    report_generate_response,
+)
 from dojo.authorization import api_permissions as permissions
 from dojo.finding.api.filters import ApiFindingFilter, ApiTemplateFindingFilter
 from dojo.finding.api.serializer import (
@@ -702,14 +706,13 @@ def generate_report(self, request):
             options[
                 "include_table_of_contents"
             ] = report_options.validated_data["include_table_of_contents"]
+            options["report_type"] = report_options.validated_data["report_type"]
         else:
             return Response(
                 report_options.errors, status=status.HTTP_400_BAD_REQUEST,
             )
 
-        data = report_generate(request, findings, options)
-        report = api_v2_serializers.ReportGenerateSerializer(data)
-        return Response(report.data)
+        return report_generate_response(request, findings, options)
 
     def _get_metadata(self, request, finding):
         metadata = DojoMeta.objects.filter(finding=finding)

dojo/product/api/views.py

@@ -8,7 +8,7 @@
 import dojo.api_v2.mixins as dojo_mixins
 from dojo.api_v2 import prefetch
 from dojo.api_v2 import serializers as api_v2_serializers
-from dojo.api_v2.views import PrefetchDojoModelViewSet, report_generate, schema_with_prefetch
+from dojo.api_v2.views import PrefetchDojoModelViewSet, report_generate_response, schema_with_prefetch
 from dojo.authorization import api_permissions as permissions
 from dojo.models import Endpoint, Product, Product_API_Scan_Configuration
 from dojo.product.api.filters import ApiProductFilter
@@ -120,11 +120,10 @@ def generate_report(self, request, pk=None):
             options[
                 "include_table_of_contents"
             ] = report_options.validated_data["include_table_of_contents"]
+            options["report_type"] = report_options.validated_data["report_type"]
         else:
             return Response(
                 report_options.errors, status=status.HTTP_400_BAD_REQUEST,
             )
 
-        data = report_generate(request, product, options)
-        report = api_v2_serializers.ReportGenerateSerializer(data)
-        return Response(report.data)
+        return report_generate_response(request, product, options)

dojo/reports/ui/views.py

@@ -71,6 +71,8 @@ def report_url_resolver(request):
     try:
         url_resolver = request.META["HTTP_X_FORWARDED_PROTO"] + "://" + request.META["HTTP_X_FORWARDED_FOR"]
     except:
+        if "HTTP_HOST" not in request.META:
+            return request.build_absolute_uri("/").rstrip("/")
         hostname = request.META["HTTP_HOST"]
         port_index = hostname.find(":")
         if port_index != -1:
@@ -846,8 +848,11 @@ def get(self, request):
         findings = prefetch_related_findings_for_report(findings)
         self.findings = findings
         findings = self.add_findings_data()
+        return self.build_response(findings)
+
+    def build_response(self, findings, filename="findings.csv"):
         response = HttpResponse(content_type="text/csv")
-        response["Content-Disposition"] = "attachment; filename=findings.csv"
+        response["Content-Disposition"] = f"attachment; filename={filename}"
         writer = csv.writer(response)
         allowed_attributes = get_attributes()
         excludes_list = get_excludes()
@@ -983,6 +988,9 @@ def get(self, request):
         findings = prefetch_related_findings_for_report(findings)
         self.findings = findings
         findings = self.add_findings_data()
+        return self.build_response(findings)
+
+    def build_response(self, findings, filename="findings.xlsx"):
         workbook = Workbook()
         workbook.iso_dates = True
         worksheet = workbook.active
@@ -1140,5 +1148,5 @@ def get(self, request):
             content=stream,
             content_type="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
         )
-        response["Content-Disposition"] = "attachment; filename=findings.xlsx"
+        response["Content-Disposition"] = f"attachment; filename={filename}"
         return response

dojo/test/api/views.py

@@ -8,7 +8,7 @@
 from rest_framework.response import Response
 
 from dojo.api_v2 import serializers as api_v2_serializers
-from dojo.api_v2.views import PrefetchDojoModelViewSet, report_generate
+from dojo.api_v2.views import PrefetchDojoModelViewSet, report_generate_response
 from dojo.authorization import api_permissions as permissions
 from dojo.models import (
     FileUpload,
@@ -110,14 +110,13 @@ def generate_report(self, request, pk=None):
             options[
                 "include_table_of_contents"
             ] = report_options.validated_data["include_table_of_contents"]
+            options["report_type"] = report_options.validated_data["report_type"]
         else:
             return Response(
                 report_options.errors, status=status.HTTP_400_BAD_REQUEST,
             )
 
-        data = report_generate(request, test, options)
-        report = api_v2_serializers.ReportGenerateSerializer(data)
-        return Response(report.data)
+        return report_generate_response(request, test, options)
 
     @extend_schema(
         methods=["GET"],