Bug Report: API Crash on CSV Scan Result Downloads

Start in nettacker/api/engine.py at get_results_csv around line 438 and compare its report filename handling with get_results_json around line 414. Reproduce with the API server and the /results/get_csv request using a scan ID, then verify that an absolute report path is preserved and the endpoint no longer returns a 500 error.

Nettacker API CSV Download Crash – Bug Report

Summary

The API crashes with a FileNotFoundError when attempting to download scan results as CSV via the /results/get_csv endpoint.
This occurs because the backend logic incorrectly manipulates the report file path, stripping the leading slash from absolute paths and converting them into invalid relative paths. The system then attempts to open this invalid path for writing, causing the crash.

---

Steps to Reproduce

1. Start the API server:

python3 nettacker.py --start-api

2. Perform a scan to generate a report (or use an existing scan ID).

3. Access the CSV download link directly (or via the UI if visible):

https://127.0.0.1:5000/results/get_csv?id=<SCAN_ID>&key=<API_KEY>

Result: The server returns a 500 Internal Server Error.

Note: The JSON endpoint /results/get_json uses similar logic but does not crash because it does not attempt to write the file, it only streams the content.

---

CURL Reproduction

curl -k "https://127.0.0.1:5000/results/get_csv?id=<SCAN_ID>&key=<API_KEY>"

---

Error Log

Traceback (most recent call last):
  File "/home/janpreet/Desktop/GSOC/OWASP/Fork/Nettacker/venv/lib/python3.13/site-packages/flask/app.py", line 1511, in wsgi_app
    response = self.full_dispatch_request()
  File "/home/janpreet/Desktop/GSOC/OWASP/Fork/Nettacker/venv/lib/python3.13/site-packages/flask/app.py", line 919, in full_dispatch_request
    rv = self.handle_user_exception(e)
  File "/home/janpreet/Desktop/GSOC/OWASP/Fork/Nettacker/venv/lib/python3.13/site-packages/flask/app.py", line 917, in full_dispatch_request
    rv = self.dispatch_request()
  File "/home/janpreet/Desktop/GSOC/OWASP/Fork/Nettacker/venv/lib/python3.13/site-packages/flask/app.py", line 902, in dispatch_request
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)  # type: ignore[no-any-return]
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^
  File "/home/janpreet/Desktop/GSOC/OWASP/Fork/Nettacker/nettacker/api/engine.py", line 440, in get_results_csv
    dict_writer = csv.DictWriter(report_path_filename, fieldnames=keys, quoting=csv.QUOTE_ALL)
     ^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: 'home/janpreet/Desktop/GSOC/OWASP/Fork/Nettacker/.nettacker/data/results/results_2026_01_27_11_42_13_obhgjntdch.csv'

---

Root Cause

Location:
Lines 414 (JSON) and 438 (CSV) in nettacker/api/engine.py

The code uses unsafe string manipulation to change the file extension.

Current Code (Buggy)

filename = ".".join(scan_details.report_path_filename.split(".")[:-1])[1:] + ".csv"

Breakdown

If scan_details.report_path_filename is an absolute path, for example:

/home/user/report.html

Processing steps:

split(".")[:-1]  -> ['/home/user/report']
join(...)         -> /home/user/report
[1:] (slice)     -> home/user/report   # Leading slash removed

Final result:

home/user/report.csv

This becomes a relative path instead of an absolute one. Since this path does not exist in the current working directory, the following call fails for CSV:

open(filename, "w")

---

Suggested Fix

Use os.path.splitext for robust and safe file path handling.

Recommended Patch

Apply this fix in:

• get_results_csv

import os

# Replace filename generation with:
filename = os.path.splitext(scan_details.report_path_filename)[0] + ".csv"

This preserves the full absolute path and safely changes only the file extension.

---

Environment

• OS: Linux (Kali / Ubuntu)
• Python Version: 3.13
• Nettacker Version: 0.4.0