diff --git a/MANIFEST.in b/MANIFEST.in
index dcce35f..5d3a814 100644
--- a/MANIFEST.in
+++ b/MANIFEST.in
@@ -2,6 +2,6 @@ include LICENSE
include README.md
include requirements.txt
include .env.example
-recursive-include docksec/templates *.html
+recursive-include docksec/templates *
recursive-include tests *
global-exclude *.py[cod] __pycache__ *.so .DS_Store
diff --git a/docksec/config.py b/docksec/config.py
index b693f06..212877a 100644
--- a/docksec/config.py
+++ b/docksec/config.py
@@ -73,17 +73,14 @@ def get_html_template() -> str:
"""
Load the HTML report template from the templates directory.
"""
- template_path = os.path.join(TEMPLATES_DIR, "report_template.html")
- try:
- if os.path.exists(template_path):
+ template_path = os.path.join(TEMPLATES_DIR, "report.html.j2")
+ if os.path.exists(template_path):
+ try:
with open(template_path, 'r', encoding='utf-8') as f:
return f.read()
- else:
- # Fallback for when running from a location where templates might not be correctly linked
- # This is a safety measure
- return "Docker Security Report
Template missing at " + template_path + "
"
- except Exception as e:
- return f"Error
{str(e)}
"
+ except Exception as e:
+ return f"Error
{str(e)}
"
+ return "Docker Security Report
Template missing in " + TEMPLATES_DIR + "
"
# For backward compatibility with existing code that imports html_template
diff --git a/docksec/report_generator.py b/docksec/report_generator.py
index 6c82928..49376f3 100644
--- a/docksec/report_generator.py
+++ b/docksec/report_generator.py
@@ -21,8 +21,9 @@
from typing import Dict, List, Optional
from docksec import output
-from docksec.config import RESULTS_DIR, get_html_template
+from docksec.config import RESULTS_DIR, TEMPLATES_DIR
from docksec.utils import get_custom_logger
+from jinja2 import Environment, FileSystemLoader, select_autoescape
# fpdf2 emits a UserWarning at import time when the legacy PyFPDF package shares
# the same module namespace. It is environmental noise that is not actionable
@@ -701,12 +702,31 @@ def generate_html_report(self, results: Dict) -> str:
logger.info(f"Generating HTML report: {output_file}")
try:
- template_vars = self._prepare_html_template_vars(results)
+ vulnerabilities = results.get("json_data", [])
+ scan_mode = results.get("scan_mode", "full")
+ severity_counts = self._count_by_severity(vulnerabilities)
- # Replace placeholders in template
- html_content = get_html_template()
- for key, value in template_vars.items():
- html_content = html_content.replace(f"{{{{{key}}}}}", str(value))
+ env = Environment(
+ loader=FileSystemLoader(TEMPLATES_DIR),
+ autoescape=select_autoescape(["html", "htm", "xml", "j2"]),
+ )
+ template = env.get_template("report.html.j2")
+ html_content = template.render(
+ image_name=self.image_name,
+ scan_mode=scan_mode.replace("_", " ").title(),
+ scan_mode_title=f"{scan_mode.replace('_', ' ').title()} Scan",
+ dockerfile_path=results.get("dockerfile_path", "N/A"),
+ scan_date=results.get("timestamp", ""),
+ analysis_score=self.analysis_score,
+ image_info=results.get("image_info"),
+ config_analysis=results.get("config_analysis"),
+ ai_findings=results.get("ai_findings"),
+ dockerfile_scan=results.get("dockerfile_scan", {"skipped": True}),
+ vulnerabilities=vulnerabilities,
+ severity_counts=severity_counts,
+ suppressed_count=results.get("suppressed_count"),
+ ignore_file=results.get("ignore_file"),
+ )
# Save the HTML file
with open(output_file, "w", encoding="utf-8") as f:
@@ -844,355 +864,6 @@ def generate_markdown_report(self, results: Dict) -> str:
output.error(f"Failed to save Markdown report: {e}")
return ""
- def _prepare_html_template_vars(self, results: Dict) -> Dict[str, str]:
- """
- Prepare variables for HTML template replacement.
-
- Args:
- results: Scan results dictionary
-
- Returns:
- Dictionary of template variables
- """
- vulnerabilities = results.get("json_data", [])
- scan_mode = results.get("scan_mode", "full")
-
- template_vars = {
- "IMAGE_NAME": self.image_name,
- "SCAN_MODE": scan_mode.replace("_", " ").title(),
- "SCAN_MODE_TITLE": f"{scan_mode.replace('_', ' ').title()} Scan",
- "DOCKERFILE_PATH": results.get("dockerfile_path", "N/A"),
- "SCAN_DATE": results.get("timestamp", ""),
- "ANALYSIS_SCORE": (
- str(self.analysis_score) if self.analysis_score else "N/A"
- ),
- }
-
- # Security Score Section (rating bands match the terminal summary in
- # docksec.output._score_band)
- score_rating_html = ""
- if self.analysis_score is not None:
- score = float(self.analysis_score)
- if score >= 90:
- rating, rating_class = "Excellent", "rating-excellent"
- elif score >= 70:
- rating, rating_class = "Good", "rating-good"
- elif score >= 50:
- rating, rating_class = "Fair", "rating-fair"
- else:
- rating, rating_class = "Poor", "rating-poor"
- score_rating_html = f'{rating}
'
-
- template_vars["SECURITY_SCORE_SECTION"] = f"""
-
-
Security Score
-
-
Overall Security Score
-
{self.analysis_score if self.analysis_score is not None else 'N/A'}/100
- {score_rating_html}
-
-
-
Image Information
-
-
-
-
Created
-
{image_info.get('created', 'N/A')[:19]}
-
-
-
Architecture
-
{image_info.get('architecture', 'N/A')}
-
-
-
OS
-
{image_info.get('os', 'N/A')}
-
-
-
Configuration Analysis
'
- )
-
- # High risk issues
- if config_analysis.get("high_risk"):
- config_html += '
High-Risk Issues
'
- for issue in config_analysis["high_risk"]:
- config_html += f"- {self._escape_html(issue)}
"
- config_html += "
"
-
- # Medium risk issues
- if config_analysis.get("medium_risk"):
- config_html += '
Medium-Risk Issues
'
- for issue in config_analysis["medium_risk"]:
- config_html += f"- {self._escape_html(issue)}
"
- config_html += "
"
-
- # Low risk issues
- if config_analysis.get("low_risk"):
- config_html += '
Low-Risk Issues
'
- for issue in config_analysis["low_risk"]:
- config_html += f"- {self._escape_html(issue)}
"
- config_html += "
"
-
- config_html += "
No Dockerfile linting issues found
'
- )
- else:
- dockerfile_output = results["dockerfile_scan"].get("output", "")
- dockerfile_content = f'{self._escape_html(dockerfile_output[:2000])}'
- if len(dockerfile_output) > 2000:
- dockerfile_content += (
- "Output truncated for display...
"
- )
-
- template_vars["DOCKERFILE_SECTION"] = f"""
-
-
Dockerfile Scan Results
- {dockerfile_content}
-
- """
- else:
- template_vars["DOCKERFILE_SECTION"] = ""
-
- # Vulnerability Summary
- if not vulnerabilities:
- no_issues_html = 'No vulnerabilities found
'
- suppressed = results.get("suppressed_count")
- if suppressed:
- ignore_file = self._escape_html(str(results.get("ignore_file", "")))
- no_issues_html += (
- f"Waived: {suppressed} triaged finding(s) "
- f"suppressed via ignore file {ignore_file}
"
- )
- template_vars["VULNERABILITY_SUMMARY"] = no_issues_html
- template_vars["DETAILED_VULNERABILITIES_SECTION"] = ""
- else:
- severity_counts = self._count_by_severity(vulnerabilities)
-
- severity_html = f"""
-
-
-
{severity_counts.get('CRITICAL', 0)}
-
Critical
-
-
-
{severity_counts.get('HIGH', 0)}
-
High
-
-
-
{severity_counts.get('MEDIUM', 0)}
-
Medium
-
-
-
{severity_counts.get('LOW', 0)}
-
Low
-
-
Total vulnerabilities: {len(vulnerabilities)}
- """
-
- fixable = sum(1 for v in vulnerabilities if v.get("FixedVersion"))
- if fixable:
- severity_html += (
- f"Fix available: {fixable} of "
- f"{len(vulnerabilities)} findings have a fixed version upstream
"
- )
- suppressed = results.get("suppressed_count")
- if suppressed:
- ignore_file = self._escape_html(str(results.get("ignore_file", "")))
- severity_html += (
- f"Waived: {suppressed} triaged finding(s) "
- f"suppressed via ignore file {ignore_file}
"
- )
-
- template_vars["VULNERABILITY_SUMMARY"] = severity_html
-
- # Detailed vulnerabilities table
- table_html = """
-
-
Detailed Vulnerabilities
-
- """
-
- if len(vulnerabilities) > 50:
- table_html += f'
Showing 50 of {len(vulnerabilities)} vulnerabilities. See CSV/JSON for complete list.
'
-
- table_html += "
'
- f"
{self._escape_html(heading)} ({len(items)})
"
- f'
'
- f"
AI Dockerfile Analysis
'
- '
' + "".join(blocks) + "
@@ -391,54 +400,243 @@
Scan Information
Image Name
-
{{IMAGE_NAME}}
+
{{ image_name }}
Scan Mode
-
{{SCAN_MODE}}
+
{{ scan_mode }}
Dockerfile Path
-
{{DOCKERFILE_PATH}}
+
{{ dockerfile_path }}
Scan Date
-
{{SCAN_DATE}}
+
{{ scan_date }}
Analysis Score
-
{{ANALYSIS_SCORE}}
+
{{ analysis_score if analysis_score is not none else 'N/A' }}
+
Security Score
+
+
Overall Security Score
+
{{ analysis_score if analysis_score is not none else 'N/A' }}/100
+ {% if analysis_score is not none %}
+ {% set score = analysis_score | float %}
+ {% if score >= 90 %}
+
Excellent
+ {% elif score >= 70 %}
+
Good
+ {% elif score >= 50 %}
+
Fair
+ {% else %}
+
Poor
+ {% endif %}
+ {% endif %}
+
+
+
Image Information
+
+
+
Size
+
{{ (image_info.size / 1048576) | round(2) if image_info.get('size') else 'N/A' }} MB
+
+
+
Created
+
{{ image_info.get('created', 'N/A')[:19] }}
+
+
+
Architecture
+
{{ image_info.get('architecture', 'N/A') }}
+
+
+
OS
+
{{ image_info.get('os', 'N/A') }}
+
+
+
+
Configuration Analysis
+
+ {% if config_analysis.get('high_risk') %}
+
+
High-Risk Issues
+
+ {% for issue in config_analysis.high_risk %}
+ - {{ issue }}
+ {% endfor %}
+
+
+ {% endif %}
+ {% if config_analysis.get('medium_risk') %}
+
+
Medium-Risk Issues
+
+ {% for issue in config_analysis.medium_risk %}
+ - {{ issue }}
+ {% endfor %}
+
+
+ {% endif %}
+ {% if config_analysis.get('low_risk') %}
+
+
Low-Risk Issues
+
+ {% for issue in config_analysis.low_risk %}
+ - {{ issue }}
+ {% endfor %}
+
+
+ {% endif %}
+
+
+
AI Dockerfile Analysis
+
+ {% for key, heading, list_class in [
+ ('vulnerabilities', 'Vulnerabilities', 'high'),
+ ('security_risks', 'Security Risks', 'high'),
+ ('exposed_credentials', 'Exposed Credentials', 'high'),
+ ('best_practices', 'Best Practices', 'medium'),
+ ('remediation', 'Remediation Steps', 'low')
+ ] %}
+ {% if ai_findings.get(key) %}
+
+
{{ heading }} ({{ ai_findings[key] | length }})
+
+ {% for item in ai_findings[key] %}
+ - {{ item }}
+ {% endfor %}
+
+
+ {% endif %}
+ {% endfor %}
+
+
+
Dockerfile Scan Results
+ {% if dockerfile_scan.get('success') %}
+
No Dockerfile linting issues found
+ {% else %}
+ {% set df_output = dockerfile_scan.get('output', '') %}
+
{{ df_output[:2000] }}
+ {% if df_output | length > 2000 %}
+
Output truncated for display...
+ {% endif %}
+ {% endif %}
+
Vulnerability Summary
- {{VULNERABILITY_SUMMARY}}
+ {% if not vulnerabilities %}
+
No vulnerabilities found
+ {% if suppressed_count %}
+
Waived: {{ suppressed_count }} triaged finding(s) suppressed via ignore file {{ ignore_file }}
+ {% endif %}
+ {% else %}
+
+
+
{{ severity_counts.get('CRITICAL', 0) }}
+
Critical
+
+
+
{{ severity_counts.get('HIGH', 0) }}
+
High
+
+
+
{{ severity_counts.get('MEDIUM', 0) }}
+
Medium
+
+
+
{{ severity_counts.get('LOW', 0) }}
+
Low
+
+
+
Total vulnerabilities: {{ vulnerabilities | length }}
+ {% set fixable = vulnerabilities | selectattr('FixedVersion', 'defined') | selectattr('FixedVersion') | list | length %}
+ {% if fixable > 0 %}
+
Fix available: {{ fixable }} of {{ vulnerabilities | length }} findings have a fixed version upstream
+ {% endif %}
+ {% if suppressed_count %}
+
Waived: {{ suppressed_count }} triaged finding(s) suppressed via ignore file {{ ignore_file }}
+ {% endif %}
+ {% endif %}
+ {% if vulnerabilities %}
- {{DETAILED_VULNERABILITIES_SECTION}}
+
+
Detailed Vulnerabilities
+
+ {% if vulnerabilities | length > 50 %}
+
Showing 50 of {{ vulnerabilities | length }} vulnerabilities. See CSV/JSON for complete list.
+ {% endif %}
+
diff --git a/requirements.txt b/requirements.txt
index 70f46fc..ac466ae 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -4,6 +4,7 @@ python-dotenv>=1.0,<2
colorama>=0.4.6,<1
rich>=13.0,<16
fpdf2>=2.8,<3
+jinja2>=3.1.0
ruamel.yaml>=0.18.6
setuptools>=82.0.1
diff --git a/setup.py b/setup.py
index 2ff958c..c2c489a 100644
--- a/setup.py
+++ b/setup.py
@@ -33,6 +33,7 @@
"fpdf2>=2.8,<3",
"setuptools>=65.0.0",
"ruamel.yaml>=0.18.6",
+ "jinja2>=3.1.0",
],
extras_require={
"dev": [
@@ -60,6 +61,6 @@
],
include_package_data=True,
package_data={
- 'docksec': ['templates/*.html'],
+ 'docksec': ['templates/*'],
},
)
diff --git a/tests/test_config.py b/tests/test_config.py
index 75a949a..31469f5 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -169,6 +169,24 @@ def test_get_html_template(self):
self.assertIn("