fix css overflow issue - reports by paulOsinski · Pull Request #14666 · DefectDojo/django-DefectDojo

paulOsinski · 2026-04-08T18:31:13Z

Summary

PDF reports have a text wrapping bug where multi-line finding fields (description, mitigation, impact, steps to reproduce, etc.) overflow past page margins and get cut off when printed to PDF. This is especially common with findings imported from tools like BugCrowd CSV, which embed <pre> tags in the field data.

Root cause (two issues):

Missing overflow-wrap: The pre CSS in report_base.html had word-break: normal but no overflow-wrap: break-word, so long unbroken strings (URLs, tokens, encoded data) would not wrap at the container boundary.
Nested <pre> tags: All 7 PDF report templates wrapped markdown_render output in <pre> tags. When imported finding data already contained <pre> tags (e.g. <pre data-language="plain">), this produced nested <pre><pre>...</pre></pre> elements. The inner <pre> could pick up default browser styles (overflow: auto, scrollbars) that override the report CSS, causing content to clip or scroll instead of wrapping.

Fix:

Replaced <pre> wrappers around all markdown_render calls with <div class="report-field"> across all 7 PDF report templates — eliminates the nesting problem
Added .report-field and .report-field pre CSS rules with overflow-wrap: break-word — ensures long strings wrap at margins, even when the data itself contains <pre> tags
Left <pre class="raw_request"> tags untouched — those correctly wrap raw request/response data that isn't markdown-rendered
Add a unit test

dryrunsecurity · 2026-04-08T18:34:26Z

This pull request modifies multiple PDF/report templates (several dojo/templates/dojo/*.html files), triggering configured-codepaths alerts for sensitive edits and introducing numerous uses of a custom markdown_render filter to render user-controllable fields directly into HTML; if markdown_render emits unsanitized or marked-safe HTML this change can enable cross-site scripting (XSS) in generated HTML/PDF outputs. Review the markdown_render implementation or add proper sanitization/escaping and ensure allowed authors are configured for sensitive paths.

🔴 Configured Codepaths Edit in dojo/templates/dojo/finding_pdf_report.html (drs_2ad160a8)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/product_endpoint_pdf_report.html (drs_c2492f16)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/product_pdf_report.html (drs_b28c6b92)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/report_base.html (drs_552c2afa)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/product_type_pdf_report.html (drs_3e6a03bc)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/test_pdf_report.html (drs_ef1f66b1)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/endpoint_pdf_report.html (drs_1dd5ffcb)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/engagement_pdf_report.html (drs_c034bf91)

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/finding_pdf_report.html (drs_0cbf1c3a)

Vulnerability	Potential Cross-Site Scripting
Description	Templates call a custom filter 'markdown_render' to render fields (e.g., finding.description). If that filter returns raw HTML without proper sanitization or escaping, user-controlled content can reach the HTML sink unescaped and lead to XSS.

django-DefectDojo/dojo/templates/dojo/finding_pdf_report.html

Lines 185 to 188 in 21aab02

    
               <div class="report-field">{{ finding.impact|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if finding.steps_to_reproduce %}

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/test_pdf_report.html (drs_7cfe8c47)

Vulnerability	Potential Cross-Site Scripting
Description	Custom template filter `markdown_render` is applied to several finding fields before inserting into the HTML template. If that filter emits raw HTML without sanitization (common for markdown renderers), user-controlled data can reach the rendering sink unsanitized, causing XSS in the generated HTML/PDF output.

django-DefectDojo/dojo/templates/dojo/test_pdf_report.html

Lines 332 to 335 in 21aab02

    
           <div class="report-field">{{ finding.description|markdown_render }}</div> 
        
           {% if finding.mitigation %} 
        
               <h6>Mitigation</h6>

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/finding_pdf_report.html (drs_dd34b381)

Vulnerability	Potential Cross-Site Scripting
Description	Templates render several finding fields using a custom template filter 'markdown_render'. If that filter converts markdown to HTML and marks the result safe without proper sanitization, user-controlled content can reach the HTML sink as raw HTML, leading to XSS. The patch adds many instances of "{{ ... markdown_render }}" inside divs which are HTML rendering sinks.

django-DefectDojo/dojo/templates/dojo/finding_pdf_report.html

Lines 164 to 167 in 21aab02

    
           <div class="report-field">{{ finding.description|markdown_render }}</div> 
        
           {% if finding.mitigation %} 
        
               <h6>Mitigation</h6>

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/product_endpoint_pdf_report.html (drs_cb182a2f)

Vulnerability	Potential Cross-Site Scripting
Description	Templates were changed to render several finding fields using a custom filter `markdown_render`, which likely returns HTML. If that filter emits raw HTML without proper sanitization it bypasses Django's auto-escaping and can lead to XSS when rendering user-controllable finding fields.

django-DefectDojo/dojo/templates/dojo/product_endpoint_pdf_report.html

Lines 227 to 241 in 21aab02

    
           {% if finding.cvssv3 %} 
        
               <h6>CVSS v3</h6> 
        
               <div class="report-field">{{ finding.cvssv3|markdown_render }}</div> 
        
           {% endif %} 
        
           <h6>Description</h6> 
        
           <div class="report-field">{{ finding.description|markdown_render }}</div> 
        
           {% if finding.mitigation %} 
        
               <h6>Mitigation</h6> 
        
               <div class="report-field">{{ finding.mitigation|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if finding.get_report_requests %}

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/engagement_pdf_report.html (drs_01a24121)

Vulnerability	Potential Cross-Site Scripting
Description	Templates were modified to render several finding fields using a custom filter `markdown_render` (e.g. {{ finding.descriptionmarkdown_render }}). If markdown_render returns raw HTML without proper sanitization and marks it safe, user-controlled content could reach the rendered output as HTML, enabling XSS. Markdown-to-HTML renderers are a common XSS source unless they sanitize output (e.g., via Bleach/DOMPurify) or rely on a safe renderer.

django-DefectDojo/dojo/templates/dojo/engagement_pdf_report.html

Lines 320 to 323 in 21aab02

    
           <div class="report-field">{{ finding.description|markdown_render }}</div> 
        
           {% if finding.mitigation %} 
        
               <h6>Mitigation</h6>

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/engagement_pdf_report.html (drs_07e095d3)

Vulnerability	Potential Cross-Site Scripting
Description	Templates apply a custom filter 'markdown_render' to several user-supplied finding fields. If that filter outputs raw HTML or marks strings safe without sanitization it could bypass Django auto-escaping and introduce XSS. Verification requires inspecting the markdown_render implementation to confirm proper sanitization; the patch itself only shows template usage and CSS additions.

django-DefectDojo/dojo/templates/dojo/engagement_pdf_report.html

Lines 339 to 342 in 21aab02

    
           {% if finding.impact %} 
        
               <h6>Impact</h6> 
        
               <div class="report-field">{{ finding.impact|markdown_render }}</div> 
        
           {% endif %}

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/product_pdf_report.html (drs_e08a3ae1)

Vulnerability	Potential Cross-Site Scripting
Description	Templates call a custom filter 'markdown_render' and render its output directly into HTML (e.g., {{ finding.descriptionmarkdown_render }}). If that filter emits raw HTML or bypasses Django auto-escaping, user-controlled content can reach the rendering sink unsanitized, enabling XSS.

django-DefectDojo/dojo/templates/dojo/product_pdf_report.html

Lines 308 to 329 in 21aab02

    
           {% if finding.impact %} 
        
               <h6>Impact</h6> 
        
               <div class="report-field">{{ finding.impact|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if finding.steps_to_reproduce %} 
        
               <h6>Steps to Reproduce</h6> 
        
               <div class="report-field">{{ finding.steps_to_reproduce|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if finding.severity_justification %} 
        
               <h6>Severity Justification</h6> 
        
               <div class="report-field">{{ finding.severity_justification|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if finding.references %} 
        
               <h6>References</h6> 
        
               <div class="report-field">{{ finding.references|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if include_finding_images %}

🔴 Potential Cross-Site Scripting in dojo/templates/dojo/test_pdf_report.html (drs_fed525fe)

Vulnerability	Potential Cross-Site Scripting
Description	The templates were changed to render several finding fields using a custom filter `markdown_render`, which may produce HTML. If that filter returns raw HTML without sanitization, user-controlled finding fields could lead to XSS when inserted into the template. The patch shows multiple occurrences where fields are passed through `markdown_render` and placed directly into the DOM.

django-DefectDojo/dojo/templates/dojo/test_pdf_report.html

Lines 351 to 354 in 21aab02

    
           {% if finding.impact %} 
        
               <h6>Impact</h6> 
        
               <div class="report-field">{{ finding.impact|markdown_render }}</div> 
        
           {% endif %}

🟠 Potential Cross-Site Scripting in dojo/templates/dojo/endpoint_pdf_report.html (drs_ee4b7708)

Vulnerability	Potential Cross-Site Scripting
Description	Templates pass finding fields through a custom template filter 'markdown_render' which could render HTML. If that filter returns unsanitized HTML, user-controlled content can reach the rendered output and cause XSS.

django-DefectDojo/dojo/templates/dojo/endpoint_pdf_report.html

Lines 206 to 209 in 21aab02

    
               <div class="report-field">{{ finding.impact|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if finding.steps_to_reproduce %}

🟠 Potential Cross-Site Scripting in dojo/templates/dojo/product_type_pdf_report.html (drs_d09a6783)

Vulnerability	Potential Cross-Site Scripting
Description	Templates were changed to render multiple finding fields through a custom filter 'markdown_render' inside without evidence in this patch that the filter escapes or sanitizes HTML. If markdown_render returns raw HTML, user-controlled text could reach the HTML rendering sink unsafely, causing XSS.

django-DefectDojo/dojo/templates/dojo/product_type_pdf_report.html

Lines 240 to 243 in 21aab02

    
               <div class="report-field">{{ finding.impact|markdown_render }}</div> 
        
           {% endif %} 
        
           {% if finding.steps_to_reproduce %}

🟠 Potential Cross-Site Scripting in dojo/templates/dojo/product_type_pdf_report.html (drs_d7cface4)

Vulnerability	Potential Cross-Site Scripting
Description	The templates apply a custom filter markdown_render to multiple user-visible fields. If markdown_render returns HTML marked safe without sanitization, user input could reach the rendered HTML unescaped and cause XSS. I inspected the patch and searched the repository for templatetag implementations to find markdown_render but couldn't locate its definition in the checked files, so I cannot confirm a safe implementation is present.

django-DefectDojo/dojo/templates/dojo/product_type_pdf_report.html

Lines 219 to 222 in 21aab02

    
           <div class="report-field">{{ finding.description|markdown_render }}</div> 
        
           {% if finding.mitigation %} 
        
               <h6>Mitigation</h6>

We've notified @mtesauro.

Comment to provide feedback on these findings.

Report false positive: @dryrunsecurity fp [FINDING ID] [FEEDBACK]
Report low-impact: @dryrunsecurity nit [FINDING ID] [FEEDBACK]

Example: @dryrunsecurity fp drs_90eda195 This code is not user-facing

All finding details can be found in the DryRun Security Dashboard.

paulOsinski added 2 commits April 8, 2026 14:14

add unit test

5c47b14

replace <pre> wrappers and update CSS on reports

21aab02

paulOsinski requested review from Maffooch and mtesauro as code owners April 8, 2026 18:31

github-actions bot added unittests ui labels Apr 8, 2026

paulOsinski changed the title ~~add unit test~~ fix css overflow issue Apr 8, 2026

paulOsinski changed the title ~~fix css overflow issue~~ fix css overflow issue - reports Apr 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix css overflow issue - reports#14666

fix css overflow issue - reports#14666
paulOsinski wants to merge 2 commits intoDefectDojo:bugfixfrom
paulOsinski:report-css-fix

paulOsinski commented Apr 8, 2026 •

edited

Loading

Uh oh!

dryrunsecurity bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

paulOsinski commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Root cause (two issues):

Fix:

Uh oh!

dryrunsecurity bot commented Apr 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

paulOsinski commented Apr 8, 2026 •

edited

Loading