Function download_vulnerability_report

webapp_modern.py:6528–6555

Stream a vulnerability report file while preventing directory traversal. Supports per-network directories via ?network= query param so that download URLs returned by /api/vulnerability-intel can be followed directly when a network context is active. Falls back to the global vulnerabilit

(filename)

            try:
                os.makedirs(cred_results_dir, exist_ok=True)
                logger.debug(f"Ensured directory exists: {cred_results_dir}")
            except Exception as e:
                logger.warning(f"Could not create crackedpwd directory: {e}")

            if os.path.exists(cred_results_dir):
                cred_count = 0
                try:
                    # Get stable file list (excludes temporary/hidden files) - only CSV files for network storage
                    cred_files_found = []
                    for filename in sorted(os.listdir(cred_results_dir)):
                        if filename.endswith('.csv') and not filename.startswith('.') and not filename.endswith('.tmp'):
                            filepath = os.path.join(cred_results_dir, filename)
                            # Only count files that exist and aren't being written to
                            try:
                                stat_info = os.stat(filepath)
                                if stat_info.st_size > 0:  # Skip empty files
                                    cred_files_found.append(filename)
                            except (OSError, IOError):
                                continue  # Skip files that can't be accessed
                    
                    # Count credentials from stable file list
                    for filename in cred_files_found:
                        filepath = os.path.join(cred_results_dir, filename)
                        try:
                            # Use more robust file reading with retry for locked files
                            max_retries = 2
                            for attempt in range(max_retries):
                                try:
                                    with open(filepath, 'r', encoding='utf-8', errors='ignore') as f:
                                        lines = f.readlines()
                                        # Skip header row and count data rows only