From 74b89ef62f9fdf4117b2d9d8f1bb5ad9fb7b6418 Mon Sep 17 00:00:00 2001
From: Kevin Jablonski <kevjablonski@gmail.com>
Date: Tue, 11 Aug 2026 20:26:44 +0000
Subject: [PATCH 1/3] chore: update to latest internal changes

Signed-off-by: Kevin Jablonski <kevjablonski@gmail.com>
---
 components/Export.vue                    |  17 +-
 db/models/nessusReportItem.ts            |   6 +
 server/api/boundaries/nessus.get.ts      | 169 ++++++---
 server/utils/excelExport/excel.ts        |  23 ++
 server/utils/excelExport/nessusExport.ts | 464 +++++++++++++++++++----
 types/nessus.ts                          |  19 +
 6 files changed, 568 insertions(+), 130 deletions(-)
 create mode 100644 server/utils/excelExport/excel.ts

diff --git a/components/Export.vue b/components/Export.vue
index 80da8f7..48e7d4d 100644
--- a/components/Export.vue
+++ b/components/Export.vue
@@ -373,6 +373,7 @@
 
 <script setup lang="ts">
 import { Dialog, DialogPanel, DialogTitle, TransitionChild, TransitionRoot } from "@headlessui/vue";
+import { NessusCsvHeaders } from "~/types/nessus";
 
 const props = defineProps({
   boundaryId: {
@@ -525,11 +526,23 @@ const ssaDownload = async () => {
 };
 
 const nessusDownload = async () => {
-  const { data: currentUser } = await useFetch("/api/auth/currentUser");
+  const selectedHeaders = [
+    NessusCsvHeaders.PluginId,
+    NessusCsvHeaders.CVE,
+    NessusCsvHeaders.CvssV2,
+    NessusCsvHeaders.CvssV3,
+    NessusCsvHeaders.Risk,
+    NessusCsvHeaders.Host,
+    NessusCsvHeaders.Protocol,
+    NessusCsvHeaders.Port,
+    NessusCsvHeaders.Name,
+    NessusCsvHeaders.Description,
+    NessusCsvHeaders.PluginOutput,
+  ] as const;
 
   const queryParams = new URLSearchParams();
   queryParams.append("BoundaryId", boundaryId);
-  queryParams.append("userEmail", currentUser.value.email);
+  queryParams.append("selectedHeaders", selectedHeaders);
   await fetch(`/api/boundaries/nessus?${queryParams}`, {
     method: "GET",
     headers: { "Content-Type": "application/json" },
diff --git a/db/models/nessusReportItem.ts b/db/models/nessusReportItem.ts
index 7f0b6ca..8362fcd 100644
--- a/db/models/nessusReportItem.ts
+++ b/db/models/nessusReportItem.ts
@@ -7,6 +7,7 @@ import {
   type CreationOptional,
   type ForeignKey,
   type NonAttribute,
+  Association,
 } from "sequelize";
 import type { NessusPlugin } from "./nessusPlugin";
 import type { NessusReport } from "./nessusReport";
@@ -49,6 +50,11 @@ export class NessusReportItem extends Model<
   declare lastUpdate: CreationOptional<string>;
   declare creationDate: CreationOptional<string>;
   declare NessusReport?: NonAttribute<NessusReport>;
+  declare NessusPlugin?: NonAttribute<NessusPlugin>;
+
+  declare static associations: {
+    NessusPlugin: Association<NessusReportItem, NessusPlugin>;
+  };
 }
 
 NessusReportItem.init(
diff --git a/server/api/boundaries/nessus.get.ts b/server/api/boundaries/nessus.get.ts
index 39de71d..5c62999 100644
--- a/server/api/boundaries/nessus.get.ts
+++ b/server/api/boundaries/nessus.get.ts
@@ -1,67 +1,130 @@
 import { Readable } from "node:stream";
 import { sendStream } from "h3";
 import { generateNessusCsv } from "../../utils/excelExport/nessusExport";
-import { NessusOverride } from "~/db/models/nessusOverride";
 import { NessusPlugin } from "~/db/models/nessusPlugin";
 import { NessusReport } from "~/db/models/nessusReport";
 import { NessusReportItem } from "~/db/models/nessusReportItem";
-import { Boundary, BoundaryInterface, System } from "~/db/models";
-import { NessusPluginTypes } from "~/types/nessus";
+import { Boundary, System } from "~/db/models";
+import { NessusCsvHeaders, type HeaderLabel } from "~/types/nessus";
+import { Cve } from "~/db/models/cve";
+import { NessusOverride } from "~/db/models/nessusOverride";
 
 export default defineEventHandler(async (event) => {
-  const body = await getQuery(event);
-  const checkResult = await userCheck(event, undefined, body.BoundaryId?.toString(), undefined);
-  if (checkResult.BoundaryRoleId) {
-    const boundary = await Boundary.findOne({ where: { id: body.BoundaryId } });
-    if (!boundary) {
-      throw createError({
-        statusCode: 400,
-        statusMessage: `No Existing Boundary with specified ID found: \n` + body.BoundaryId,
-      });
-    }
-    const systems = await System.findAll({ where: { BoundaryId: body.BoundaryId } });
-    var reports: NessusReport[] = [];
-    for (const system of systems) {
-      console.log("Getting export for system", system.id);
-      const report = await NessusReport.findOne({
-        where: { SystemId: system.id },
-        include: [
-          {
-            model: NessusReportItem,
-            include: [
-              {
-                model: NessusPlugin,
-              },
-            ],
-          },
-        ],
-      });
-      if (report != null) {
-        reports.push(report);
-      } else {
-        console.log("No report data for system", system.id);
-      }
-    }
-    const nessusCSV = await generateNessusCsv(body.BoundaryId, reports);
-    
-    const csvString = nessusCSV.map((row) => row.join(",")).join("\n");
-    const myBuffer = Buffer.from(csvString, "utf-8");
-    const stream = new Readable();
-    stream.push(myBuffer);
-    stream.push(null);
-
-    var fileName = "Boundary_" + boundary.name.replaceAll(" ", "") + "_NessusExport.csv";
-    setResponseHeader(event, "Content-Disposition", 'attachment; filename="' + fileName + '"');
-    setResponseHeader(event, "Content-Type", "application/octet-stream");
-    logger.info({
-      service: "Boundary",
-      message: `${body.userEmail} Downloaded Nessus Data for boundary ID: ${body.BoundaryId}`,
+  const query = getQuery(event);
+
+  if (!query.BoundaryId) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: `BoundaryId required.`,
     });
-    return sendStream(event, stream);
-  } else {
+  }
+
+  const BoundaryId = parseInt(query.BoundaryId?.toString(), 10);
+
+  if (isNaN(BoundaryId)) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: `Invalid BoundaryId ${query.BoundaryId}`,
+    });
+  }
+
+  const checkResult = await userCheck(event, undefined, query.BoundaryId?.toString(), undefined);
+
+  if (!checkResult.BoundaryRoleId) {
     throw createError({
-      statusCode: 401,
+      statusCode: 403,
       statusMessage: "Insufficient Permissions.",
     });
   }
+  if (!query.selectedHeaders) {
+    throw createError({
+      statusCode: 400,
+      statusMessage: `No headers selected.`,
+    });
+  }
+
+  const values = Object.values(NessusCsvHeaders);
+  const selectedHeaders = query.selectedHeaders
+    .toString()
+    .split(",")
+    .map((header) => header.trim())
+    .filter((header): header is HeaderLabel => values.includes(header as HeaderLabel));
+
+  const factorOverrides = query.factorOverrides?.toString().toLowerCase() !== "false";
+
+  const boundary = await Boundary.findByPk(BoundaryId);
+  if (!boundary) {
+    throw createError({
+      statusCode: 404,
+      statusMessage: `No Existing Boundary with specified ID found: \n` + BoundaryId,
+    });
+  }
+
+  const overrideLookup: { [id: number]: NessusOverride[][] } = {};
+
+  const systems = await System.findAll({ where: { BoundaryId } });
+  const reports: NessusReport[] = [];
+  for (const system of systems) {
+    logger.info({
+      service: "Boundary Nessus Get",
+      message: `Getting nessus export content for: ${system.id} from boundary ${BoundaryId}.`,
+    });
+    const report = await NessusReport.findOne({
+      where: { SystemId: system.id },
+      include: [
+        {
+          model: NessusReportItem,
+          include: [
+            {
+              model: NessusPlugin,
+              include: [
+                {
+                  model: Cve,
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    });
+    if (report != null) {
+      reports.push(report);
+    } else {
+      logger.info({
+        service: "Boundary Nessus Get",
+        message: `No report data for system: ${system.id} to be exported in boundary ${BoundaryId} Nessus export.`,
+      });
+    }
+
+    const overrides = await NessusOverride.findAll({
+      where: {
+        SystemId: system.id,
+      },
+    });
+
+    if (Array.isArray(overrides)) {
+      overrideLookup[system.id] = [overrides];
+    }
+  }
+
+  const nessusCSV = await generateNessusCsv(
+    reports,
+    overrideLookup,
+    selectedHeaders,
+    factorOverrides,
+  );
+
+  const myBuffer = Buffer.from(nessusCSV, "utf-8");
+  const stream = new Readable();
+  stream.push(myBuffer);
+  stream.push(null);
+
+  const fileName = "Boundary_" + boundary.name.replaceAll(" ", "") + "_NessusExport.csv";
+  setResponseHeader(event, "Content-Disposition", 'attachment; filename="' + fileName + '"');
+  setResponseHeader(event, "Content-Type", "application/octet-stream");
+  logger.info({
+    service: "Boundary",
+    message: `${checkResult.user.email} Downloaded Nessus Data for boundary ID: ${query.BoundaryId}`,
+  });
+  return sendStream(event, stream);
 });
diff --git a/server/utils/excelExport/excel.ts b/server/utils/excelExport/excel.ts
new file mode 100644
index 0000000..f9b4bf2
--- /dev/null
+++ b/server/utils/excelExport/excel.ts
@@ -0,0 +1,23 @@
+export function limitExcelCell(input: string): string {
+  if (!input) return "";
+
+  let hasWrappingQuotes = false;
+
+  if (input.startsWith('"') && input.endsWith('"')) {
+    hasWrappingQuotes = true;
+    input = input.slice(1, -1); // remove first and last quote
+  }
+
+  let truncated = input.slice(0, 32767);
+
+  const lines = truncated.split("\n");
+  if (lines.length > 254) {
+    truncated = lines.slice(0, 254).join("\n");
+  }
+
+  if (hasWrappingQuotes) {
+    return `"${truncated}"`;
+  }
+
+  return truncated;
+}
diff --git a/server/utils/excelExport/nessusExport.ts b/server/utils/excelExport/nessusExport.ts
index 15018e5..4384061 100644
--- a/server/utils/excelExport/nessusExport.ts
+++ b/server/utils/excelExport/nessusExport.ts
@@ -1,107 +1,421 @@
-import ExcelJS from "exceljs";
+import { Protocol, System } from "../../../db/models";
+import { limitExcelCell } from "./excel";
+import { NessusOverride } from "~/db/models/nessusOverride";
 import { NessusReport } from "~/db/models/nessusReport";
 import { NessusReportItem } from "~/db/models/nessusReportItem";
-import { Boundary, Classification, Protocol, System } from "../../../db/models";
-import { INTEGER } from "sequelize";
-import { RowList } from "postgres";
-
-var ProtocolLookupTable: { [id: number] : string } = {};
-var sectionCurrent = -1
-type wordSeverity = "None" | "Low" | "Medium" | "High" | "Critical";
-type intSeverity = 0 | 1 | 2 | 3 | 4;
-const severityMap: Record<intSeverity, wordSeverity> = {
-  4: "Critical",
-  3: "High",
-  2: "Medium",
-  1: "Low",
-  0: "None",
+import { NessusCsvHeaders, HeaderLabel } from "~/types/nessus";
+
+type SourceData = { report: NessusReport; item: NessusReportItem };
+
+let protocolMap: Map<number, string> | null = null;
+
+async function preloadProtocolMap(): Promise<void> {
+  if (protocolMap) return;
+  const protocols = await Protocol.findAll({ attributes: ["id", "name"] });
+  protocolMap = new Map(protocols.map((p) => [p.id, p.name]));
+}
+
+function protocolFromId(id?: number | null): string {
+  if (!protocolMap || !id) return "";
+  return protocolMap.get(id) ?? "";
+}
+
+export type NessusSoftwareItem = {
+  name: string;
+  version: string;
+  pluginId: number;
+  systems: string[];
 };
 
-function formatForCSV(raw: string): string {
+export type NessusParentObject = {
+  isComponent: boolean;
+  existingObjects: string[];
+};
+
+const columnGetters: Record<HeaderLabel, (ct: SourceData) => string> = {
+  [NessusCsvHeaders.PluginId]: ({ item }) => String(item.NessusPlugin?.pluginId ?? ""),
+  [NessusCsvHeaders.CVE]: (_ct) => "",
+  [NessusCsvHeaders.CvssV2]: ({ item }) => String(item.cvssTemporalScore ?? ""),
+  [NessusCsvHeaders.CvssV3]: ({ item }) => String(item.cvss3TemporalScore ?? ""),
+  [NessusCsvHeaders.Risk]: ({ item }) => String(item.NessusPlugin?.riskFactor ?? ""),
+  [NessusCsvHeaders.Host]: ({ report }) =>
+    String((report as any).host ?? (report as any).reportHostName ?? ""),
+  [NessusCsvHeaders.Protocol]: ({ item }) => String(protocolFromId((item as any).ProtocolId)),
+  [NessusCsvHeaders.Port]: ({ item }) => String(item.port ?? ""),
+  [NessusCsvHeaders.Name]: ({ item }) => String(item.NessusPlugin?.pluginName ?? ""),
+  [NessusCsvHeaders.Synopsis]: ({ item }) => String(item.NessusPlugin?.synopsis ?? ""),
+  [NessusCsvHeaders.Description]: ({ item }) =>
+    String(toCsvCell(item.NessusPlugin?.description) ?? ""),
+  [NessusCsvHeaders.Solution]: ({ item }) => String(item.NessusPlugin?.solution ?? ""),
+  [NessusCsvHeaders.SeeAlso]: ({ item }) => String((item.NessusPlugin as any)?.seeAlso ?? ""),
+  [NessusCsvHeaders.PluginOutput]: ({ item }) =>
+    String(toCsvCell(limitExcelCell(item.pluginOutput)) ?? ""),
+};
+
+function getCveList(item: NessusReportItem): string[] {
+  const arr = item.NessusPlugin?.Cves?.map((c) => String((c as any).cveId)) ?? [];
+  return arr.length ? arr : [""];
+}
+
+function toCsvCell(raw: string | undefined): string {
   if (!raw) {
-    return ""
+    return "";
+  }
+  let str = raw;
+  str = str.replace(/"/g, '""');
+  if (/[",\n]/.test(str)) {
+    str = `"${str}"`;
+  }
+  return str;
+}
+
+export async function generateNessusCsv(
+  reports: NessusReport[],
+  overrides: { [id: number]: NessusOverride[][] },
+  headers: readonly HeaderLabel[],
+  factorOverrides: boolean = true,
+): Promise<string> {
+  await preloadProtocolMap();
+
+  let csv = headers + "\r\n";
+
+  let cveCol = -1;
+  const nonCveHeaders: HeaderLabel[] = [];
+  for (let i = 0; i < headers.length; i++) {
+    if (headers[i] === NessusCsvHeaders.CVE) cveCol = i;
+    else nonCveHeaders.push(headers[i]);
+  }
+
+  const gettersForRun = nonCveHeaders.map((h) => columnGetters[h]);
+
+  for (let r = 0; r < reports.length; r++) {
+    const report = reports[r];
+    const items = report?.NessusReportItems ?? [];
+
+    for (let j = 0; j < items.length; j++) {
+      const item = items[j];
+      const ct: SourceData = { report, item };
+
+      const baseCells = new Array<string>(nonCveHeaders.length);
+      for (let i = 0; i < gettersForRun.length; i++) {
+        baseCells[i] = gettersForRun[i](ct);
+      }
+
+      const severityColIndex = nonCveHeaders.indexOf(NessusCsvHeaders.Risk);
+
+      const cves = getCveList(item);
+      for (let k = 0; k < cves.length; k++) {
+        const row = new Array<string>(headers.length);
+        let nonIdx = 0;
+
+        if (factorOverrides && item.severityOverride) {
+          const overriddenSeverity = severityFromOverride(item.severityOverride);
+          if (severityColIndex >= 0) {
+            baseCells[severityColIndex] = overriddenSeverity;
+          }
+        }
+
+        for (let col = 0; col < headers.length; col++) {
+          if (col === cveCol) {
+            row[col] = cves[k];
+          } else {
+            row[col] = baseCells[nonIdx++];
+          }
+        }
+
+        let skipped = false;
+
+        if (factorOverrides && overrides[report.SystemId]) {
+          for (const override of overrides[report.SystemId]) {
+            if (Array.isArray(override)) {
+              for (const sysOverride of override) {
+                if (sysOverride.NessusPluginId === item.NessusPluginId) {
+                  if (sysOverride.type.toLowerCase() === "status") {
+                    const cleanSysOverride = sysOverride?.value.toLowerCase();
+                    if (
+                      cleanSysOverride === "notafinding" ||
+                      cleanSysOverride === "notapplicable" ||
+                      cleanSysOverride === "not_a_finding" ||
+                      cleanSysOverride === "not_applicable"
+                    ) {
+                      skipped = true;
+                    }
+                  }
+                }
+              }
+            }
+          }
+        }
+
+        if (factorOverrides && item.statusOverride) {
+          const cleanStatusOverride = item.statusOverride?.toLowerCase();
+          if (
+            cleanStatusOverride === "notafinding" ||
+            cleanStatusOverride === "notapplicable" ||
+            cleanStatusOverride === "not_a_finding" ||
+            cleanStatusOverride === "not_applicable"
+          ) {
+            skipped = true;
+          }
+        }
+
+        if (!skipped) {
+          csv += row.join(",") + "\r\n";
+        }
+      }
+    }
+  }
+
+  return csv;
+}
+
+function getNames(longName: string): string[] {
+  const names: string[] = [];
+  const splitName = longName.split("-");
+  for (let i = splitName.length - 1; i >= 0; i--) {
+    let myName = "";
+    for (let j = 0; j <= i; j++) {
+      myName += splitName[j].replaceAll('"', "");
+      if (j < i) {
+        myName += "-";
+      }
+    }
+    names.push(myName);
   }
-  let str = raw
-  str = str.replace(/\\/g, '\\\\');
-  str = str.replace(/"/g, '""')
-  return `"${str}"`
+  return names;
 }
 
-function getProtocolByID(protocols: Protocol[], id: number): string {
-  if (ProtocolLookupTable.length != 0 && id in ProtocolLookupTable) {
-    return ProtocolLookupTable[id].value
+function addSoftwareSystem(
+  name: string,
+  version: string,
+  pluginId: number,
+  currentItems: NessusSoftwareItem[],
+  system: string,
+): [string[], boolean] {
+  const myItem = currentItems.find(
+    (nsi) =>
+      `${nsi.name}-${nsi.version}-${nsi.pluginId.toString()}` ===
+      `${name}-${version}-${pluginId.toString()}`,
+  );
+  if (myItem) {
+    const mySystems = myItem.systems;
+    if (!mySystems.includes(system)) {
+      mySystems.push(system);
+    }
+    return [mySystems, true];
   } else {
-    for (const protocol of protocols) {
-      if (protocol.id == id) {
-        ProtocolLookupTable[id] = { key: id, value: protocol.name };  
-        return protocol.name
+    return [[system], false];
+  }
+}
+
+export function getParent(
+  printName: string,
+  printVersion: string,
+  parentItem: string[],
+): NessusParentObject {
+  const newItem = printName.replaceAll('"', "") + "-" + printVersion.replaceAll('"', "");
+  if (parentItem === undefined) {
+    const blankNpo: NessusParentObject = {
+      isComponent: false,
+      existingObjects: [newItem],
+    };
+    return blankNpo;
+  }
+
+  const availableNames = getNames(printName);
+  let foundItem: boolean = false;
+  for (const testName of availableNames) {
+    const testVal = testName + "-" + printVersion.replaceAll('"', "");
+    const foundParent = parentItem.find((pi) => pi === testVal);
+    if (foundParent) {
+      foundItem = true;
+      break;
+    }
+  }
+
+  if (!foundItem) {
+    parentItem.push(newItem);
+  }
+
+  const npo: NessusParentObject = {
+    isComponent: foundItem,
+    existingObjects: parentItem,
+  };
+  return npo;
+}
+
+function formatOutput(
+  longString: string,
+  system: string,
+  pluginId: number,
+  currentItems: NessusSoftwareItem[],
+): NessusSoftwareItem[] {
+  const indices: number[] = [];
+  const softwareItems = currentItems;
+  if (pluginId === 178102) {
+    let index = longString.indexOf("\n - ");
+    while (index !== -1) {
+      indices.push(index);
+      index = longString.indexOf("\n - ", index + 1);
+    }
+    if (indices.length > 1) {
+      const splitDelimiter = /\n - /;
+      const splitted = longString.split(splitDelimiter);
+      for (const myVal of splitted) {
+        const softwareDetails = myVal.split("\n");
+        const mySoftware = softwareDetails[0].replace('"', '"');
+        if (mySoftware !== "") {
+          const myVersion = myVal
+            .split("All Possible Versions")[1]
+            .split("\n")[0]
+            .split(":")[1]
+            .trim()
+            .replace('"', '"');
+          const printName = '"' + mySoftware + '"';
+          const printVersion = '"' + myVersion + '"';
+          const theseSystems = addSoftwareSystem(
+            printName,
+            printVersion,
+            pluginId,
+            currentItems,
+            system,
+          );
+          if (!theseSystems[1]) {
+            const currentSWI: NessusSoftwareItem = {
+              name: printName,
+              version: printVersion,
+              systems: theseSystems[0],
+              pluginId,
+            };
+            softwareItems.push(currentSWI);
+          }
+        }
+      }
+    }
+  } else if (pluginId === 22869) {
+    const splitDelimiter = /\n/;
+    const splitted = longString.split(splitDelimiter);
+    for (const myVal of splitted) {
+      // Linux Plugin Used
+      const softwareDetails = myVal.split("|");
+      if (softwareDetails.length > 1) {
+        let mySoftware = myVal.trim().split(/\s+/)[0];
+        const myVersion = mySoftware
+          .replace(/-(\d+.*)$/, "###$1")
+          .split("###")[1]
+          .trim();
+        mySoftware = mySoftware.replace(myVersion, "").trim().replace(/-$/, "");
+        const printName = '"' + mySoftware + '"';
+        const printVersion = '"' + myVersion + '"';
+        const theseSystems = addSoftwareSystem(
+          printName,
+          printVersion,
+          pluginId,
+          currentItems,
+          system,
+        );
+        if (!theseSystems[1]) {
+          const currentSWI: NessusSoftwareItem = {
+            name: printName,
+            version: printVersion,
+            systems: theseSystems[0],
+            pluginId,
+          };
+          softwareItems.push(currentSWI);
+        }
+      } else if (myVal !== "") {
+        logger.info({
+          service: "Nessus Export: 22869 non compliant output",
+          message: `Non empty non compliant output found for plugin 22869: ${myVal}`,
+        });
       }
     }
   }
-  return ""
+
+  softwareItems.sort((a, b) => {
+    if (a.name < b.name) {
+      return -1;
+    }
+    if (a.name > b.name) {
+      return 1;
+    }
+    return 0;
+  });
+  return softwareItems;
 }
 
-export async function generateNessusCsv(
-  boundaryId: number,
-  reports: NessusReport[],
-): Promise<any[][]> {
-
-  const headers: string[] = [
-    "Plugin ID",
-    "CVE",
-    "CVSS v2.0",
-    "Risk",
-    "Host",
-    "Protocol",
-    "Port",
-    "Name",
-    "Synopsis",
-    "Description",
-    "Solution",
-    "See Also",
-    "Plugin Output",
-  ];
-
-  let csvContent: string[][] = []
-  csvContent.push(Array(13).fill("")); // for headers
-  for (const report of reports) {
-    for (const row of report.NessusReportItems) {
-      csvContent.push(Array(13).fill(""));
+function getSystemsPrint(systems: string[]): string {
+  let returnString = '"';
+  let sysCt = 0;
+  for (const myStr of systems) {
+    returnString += myStr;
+    sysCt++;
+    if (sysCt < systems.length) {
+      returnString += ", ";
     }
   }
+  returnString += '"';
+  return returnString;
+}
+
+export async function generateNessusSW(
+  boundaryId: number,
+  reports: NessusReport[],
+): Promise<string[][]> {
+  const headers: string[] = ["Name", "Version", "Systems", "Plugin ID", "Component"];
+
+  const csvContent: string[][] = [];
+  csvContent.push(Array(headers.length).fill("")); // for headers
 
-  let csvRow = 0
-  let csvColumn = 0
+  let csvRow = 0;
+  let csvColumn = 0;
   for (const h of headers) {
     csvContent[csvRow][csvColumn] = h;
     csvColumn++;
   }
   csvRow++;
 
-  const Protocols = await Protocol.findAll({})
+  const loadedSystems = await System.findAll({
+    where: {
+      BoundaryId: boundaryId,
+    },
+  });
+
+  let ReportedSoftware: NessusSoftwareItem[] = [];
+
   for (const report of reports) {
+    if (!report.NessusReportItems) continue;
     for (const row of report.NessusReportItems) {
-      // csvContent[csvRow][0] = row.NessusPluginId.toString()
-      csvContent[csvRow][0] = row.NessusPlugin.pluginId.toString()
-      csvContent[csvRow][1] = ""
-      csvContent[csvRow][2] = ""
-      csvContent[csvRow][3] = formatForCSV(row.severityOverride || row.NessusPlugin.riskFactor)
-      csvContent[csvRow][4] = formatForCSV(report.reportHostName)
-      csvContent[csvRow][5] = getProtocolByID(Protocols, row.ProtocolId)
-      csvContent[csvRow][6] = (row.port == 0 ? "" : row.port)
-      csvContent[csvRow][7] = formatForCSV(row.NessusPlugin.pluginName)
-      csvContent[csvRow][8] = formatForCSV(row.NessusPlugin.synopsis)
-      csvContent[csvRow][9] = formatForCSV(row.NessusPlugin.description)
-      csvContent[csvRow][10] = formatForCSV(row.NessusPlugin.solution)
-      csvContent[csvRow][11] = ""
-      csvContent[csvRow][12] = formatForCSV(row.pluginOutput)
-      csvRow++
+      // Other potential pluginIds to be consider commented here: 20811, 22869, 97993, 178102
+      if (row.NessusPlugin && (row.NessusPlugin.pluginId === 22869 || row.NessusPlugin.pluginId === 178102)) {
+        const mySystem = loadedSystems.find((sys) => sys.id === report.SystemId);
+        if (mySystem) {
+          ReportedSoftware = formatOutput(
+            row.pluginOutput,
+            mySystem.name,
+            row.NessusPlugin.pluginId,
+            ReportedSoftware,
+          );
+        }
+      }
     }
   }
 
-  interface BoundaryWithClassification extends Boundary {
-    Classification?: Classification;
+  let parentItem: string[] = [];
+  for (const sw of ReportedSoftware) {
+    // this is where we check for parent
+    const parentTestComponent = getParent(sw.name, sw.version, parentItem);
+    parentItem = parentTestComponent.existingObjects;
+
+    csvContent.push(Array(headers.length).fill("")); // for headers
+    csvContent[csvRow][0] = sw.name;
+    csvContent[csvRow][1] = sw.version;
+    csvContent[csvRow][2] = getSystemsPrint(sw.systems);
+    csvContent[csvRow][3] = sw.pluginId.toString();
+    csvContent[csvRow][4] = parentTestComponent.isComponent.toString();
+    csvRow++;
   }
 
+  // Finished SW Export
   return csvContent;
 }
diff --git a/types/nessus.ts b/types/nessus.ts
index cc0fe31..a8e7a05 100644
--- a/types/nessus.ts
+++ b/types/nessus.ts
@@ -18,3 +18,22 @@ export enum NessusPluginTypes {
   Remote = "remote",
   Summary = "summary",
 }
+
+export const NessusCsvHeaders = {
+  PluginId: "Plugin ID",
+  CVE: "CVE",
+  CvssV2: "CVSS v2.0 Base Score",
+  CvssV3: "CVSS v3_0 Base Score",
+  Risk: "Risk",
+  Host: "Host",
+  Protocol: "Protocol",
+  Port: "Port",
+  Name: "Name",
+  Synopsis: "Synopsis",
+  Description: "Description",
+  Solution: "Solution",
+  SeeAlso: "See Also",
+  PluginOutput: "Plugin Output",
+} as const;
+
+export type HeaderLabel = (typeof NessusCsvHeaders)[keyof typeof NessusCsvHeaders];

From bc67c4a84763d4c626ec4320f078ab687a2da410 Mon Sep 17 00:00:00 2001
From: Kevin Jablonski <kevjablonski@gmail.com>
Date: Wed, 12 Aug 2026 21:28:33 +0000
Subject: [PATCH 2/3] refactor(nessusExport): improve type safety and
 validation

Signed-off-by: Kevin Jablonski <kevjablonski@gmail.com>
---
 server/utils/excelExport/nessusExport.ts | 119 ++++++++++++-----------
 1 file changed, 63 insertions(+), 56 deletions(-)

diff --git a/server/utils/excelExport/nessusExport.ts b/server/utils/excelExport/nessusExport.ts
index 4384061..dc49dd1 100644
--- a/server/utils/excelExport/nessusExport.ts
+++ b/server/utils/excelExport/nessusExport.ts
@@ -20,6 +20,17 @@ function protocolFromId(id?: number | null): string {
   return protocolMap.get(id) ?? "";
 }
 
+function isSkippedStatus(value?: string | null): boolean {
+  const normalizedValue = value?.toLowerCase();
+
+  return (
+    normalizedValue === "notafinding" ||
+    normalizedValue === "notapplicable" ||
+    normalizedValue === "not_a_finding" ||
+    normalizedValue === "not_applicable"
+  );
+}
+
 export type NessusSoftwareItem = {
   name: string;
   version: string;
@@ -32,6 +43,14 @@ export type NessusParentObject = {
   existingObjects: string[];
 };
 
+type NessusSoftwareRow = [
+  name: string,
+  version: string,
+  systems: string,
+  pluginId: string,
+  component: string,
+];
+
 const columnGetters: Record<HeaderLabel, (ct: SourceData) => string> = {
   [NessusCsvHeaders.PluginId]: ({ item }) => String(item.NessusPlugin?.pluginId ?? ""),
   [NessusCsvHeaders.CVE]: (_ct) => "",
@@ -39,8 +58,8 @@ const columnGetters: Record<HeaderLabel, (ct: SourceData) => string> = {
   [NessusCsvHeaders.CvssV3]: ({ item }) => String(item.cvss3TemporalScore ?? ""),
   [NessusCsvHeaders.Risk]: ({ item }) => String(item.NessusPlugin?.riskFactor ?? ""),
   [NessusCsvHeaders.Host]: ({ report }) =>
-    String((report as any).host ?? (report as any).reportHostName ?? ""),
-  [NessusCsvHeaders.Protocol]: ({ item }) => String(protocolFromId((item as any).ProtocolId)),
+    String((report as any).host ?? report.reportHostName ?? ""),
+  [NessusCsvHeaders.Protocol]: ({ item }) => String(protocolFromId(item.ProtocolId)),
   [NessusCsvHeaders.Port]: ({ item }) => String(item.port ?? ""),
   [NessusCsvHeaders.Name]: ({ item }) => String(item.NessusPlugin?.pluginName ?? ""),
   [NessusCsvHeaders.Synopsis]: ({ item }) => String(item.NessusPlugin?.synopsis ?? ""),
@@ -53,7 +72,7 @@ const columnGetters: Record<HeaderLabel, (ct: SourceData) => string> = {
 };
 
 function getCveList(item: NessusReportItem): string[] {
-  const arr = item.NessusPlugin?.Cves?.map((c) => String((c as any).cveId)) ?? [];
+  const arr = item.NessusPlugin?.Cves?.map((c) => String(c.cveId)) ?? [];
   return arr.length ? arr : [""];
 }
 
@@ -129,34 +148,20 @@ export async function generateNessusCsv(
           for (const override of overrides[report.SystemId]) {
             if (Array.isArray(override)) {
               for (const sysOverride of override) {
-                if (sysOverride.NessusPluginId === item.NessusPluginId) {
-                  if (sysOverride.type.toLowerCase() === "status") {
-                    const cleanSysOverride = sysOverride?.value.toLowerCase();
-                    if (
-                      cleanSysOverride === "notafinding" ||
-                      cleanSysOverride === "notapplicable" ||
-                      cleanSysOverride === "not_a_finding" ||
-                      cleanSysOverride === "not_applicable"
-                    ) {
-                      skipped = true;
-                    }
-                  }
+                if (
+                  sysOverride.NessusPluginId === item.NessusPluginId &&
+                  sysOverride.type.toLowerCase() === "status" &&
+                  isSkippedStatus(sysOverride.value)
+                ) {
+                  skipped = true;
                 }
               }
             }
           }
         }
 
-        if (factorOverrides && item.statusOverride) {
-          const cleanStatusOverride = item.statusOverride?.toLowerCase();
-          if (
-            cleanStatusOverride === "notafinding" ||
-            cleanStatusOverride === "notapplicable" ||
-            cleanStatusOverride === "not_a_finding" ||
-            cleanStatusOverride === "not_applicable"
-          ) {
-            skipped = true;
-          }
+        if (factorOverrides && isSkippedStatus(item.statusOverride)) {
+          skipped = true;
         }
 
         if (!skipped) {
@@ -361,19 +366,10 @@ function getSystemsPrint(systems: string[]): string {
 export async function generateNessusSW(
   boundaryId: number,
   reports: NessusReport[],
-): Promise<string[][]> {
-  const headers: string[] = ["Name", "Version", "Systems", "Plugin ID", "Component"];
-
-  const csvContent: string[][] = [];
-  csvContent.push(Array(headers.length).fill("")); // for headers
-
-  let csvRow = 0;
-  let csvColumn = 0;
-  for (const h of headers) {
-    csvContent[csvRow][csvColumn] = h;
-    csvColumn++;
-  }
-  csvRow++;
+): Promise<NessusSoftwareRow[]> {
+  const csvContent: NessusSoftwareRow[] = [
+    ["Name", "Version", "Systems", "Plugin ID", "Component"],
+  ];
 
   const loadedSystems = await System.findAll({
     where: {
@@ -385,35 +381,46 @@ export async function generateNessusSW(
 
   for (const report of reports) {
     if (!report.NessusReportItems) continue;
+
     for (const row of report.NessusReportItems) {
+      if (!row.NessusPlugin || !row.pluginOutput) {
+        continue;
+      }
+
+      const pluginId = row.NessusPlugin.pluginId;
       // Other potential pluginIds to be consider commented here: 20811, 22869, 97993, 178102
-      if (row.NessusPlugin && (row.NessusPlugin.pluginId === 22869 || row.NessusPlugin.pluginId === 178102)) {
-        const mySystem = loadedSystems.find((sys) => sys.id === report.SystemId);
-        if (mySystem) {
-          ReportedSoftware = formatOutput(
-            row.pluginOutput,
-            mySystem.name,
-            row.NessusPlugin.pluginId,
-            ReportedSoftware,
-          );
-        }
+      if (pluginId !== 22869 && pluginId !== 178102) {
+        continue;
       }
+
+      const system = loadedSystems.find((sys) => sys.id === report.SystemId);
+
+      if (!system?.name) {
+        continue;
+      }
+
+      ReportedSoftware = formatOutput(
+        row.pluginOutput,
+        system.name,
+        pluginId,
+        ReportedSoftware,
+      );
     }
   }
 
   let parentItem: string[] = [];
+
   for (const sw of ReportedSoftware) {
-    // this is where we check for parent
     const parentTestComponent = getParent(sw.name, sw.version, parentItem);
     parentItem = parentTestComponent.existingObjects;
 
-    csvContent.push(Array(headers.length).fill("")); // for headers
-    csvContent[csvRow][0] = sw.name;
-    csvContent[csvRow][1] = sw.version;
-    csvContent[csvRow][2] = getSystemsPrint(sw.systems);
-    csvContent[csvRow][3] = sw.pluginId.toString();
-    csvContent[csvRow][4] = parentTestComponent.isComponent.toString();
-    csvRow++;
+    csvContent.push([
+      sw.name,
+      sw.version,
+      getSystemsPrint(sw.systems),
+      sw.pluginId.toString(),
+      parentTestComponent.isComponent.toString(),
+    ]);
   }
 
   // Finished SW Export

From abf8fc7836e4fd67f4d878d7a49f88f47b8366aa Mon Sep 17 00:00:00 2001
From: Kevin Jablonski <kevjablonski@gmail.com>
Date: Thu, 13 Aug 2026 18:17:38 +0000
Subject: [PATCH 3/3] fix(nessusExport): remove redundant quote replacements

Signed-off-by: Kevin Jablonski <kevjablonski@gmail.com>
---
 server/utils/excelExport/nessusExport.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/server/utils/excelExport/nessusExport.ts b/server/utils/excelExport/nessusExport.ts
index dc49dd1..fed2eba 100644
--- a/server/utils/excelExport/nessusExport.ts
+++ b/server/utils/excelExport/nessusExport.ts
@@ -268,14 +268,13 @@ function formatOutput(
       const splitted = longString.split(splitDelimiter);
       for (const myVal of splitted) {
         const softwareDetails = myVal.split("\n");
-        const mySoftware = softwareDetails[0].replace('"', '"');
+        const mySoftware = softwareDetails[0];
         if (mySoftware !== "") {
           const myVersion = myVal
             .split("All Possible Versions")[1]
             .split("\n")[0]
             .split(":")[1]
             .trim()
-            .replace('"', '"');
           const printName = '"' + mySoftware + '"';
           const printVersion = '"' + myVersion + '"';
           const theseSystems = addSoftwareSystem(