From 7071d44d874c44bf3796ec75d3b646857444ec1f Mon Sep 17 00:00:00 2001
From: pUrGe12 <helloitsme0218@gmail.com>
Date: Sat, 14 Mar 2026 02:33:55 +0530
Subject: [PATCH 1/5] forced file uploads instead of referencing on the server
 side

---
 nettacker/api/engine.py         | 41 +++++++++++++++++++++++++++++++++
 nettacker/config.py             |  1 +
 nettacker/locale/en.yaml        |  6 ++++-
 nettacker/web/static/index.html | 24 ++++++++++++++++++-
 nettacker/web/static/js/main.js | 27 ++++++++++++++++++++++
 5 files changed, 97 insertions(+), 2 deletions(-)

diff --git a/nettacker/api/engine.py b/nettacker/api/engine.py
index 817673f61..e4f0f253d 100644
--- a/nettacker/api/engine.py
+++ b/nettacker/api/engine.py
@@ -5,6 +5,7 @@
 import random
 import string
 import time
+import uuid
 from threading import Thread
 from types import SimpleNamespace
 
@@ -50,6 +51,11 @@
 
 app = Flask(__name__, template_folder=str(Config.path.web_static_dir))
 app.config.from_object(__name__)
+app.config["MAX_CONTENT_LENGTH"] = (
+    10 * 1024 * 1024
+)  # https://flask.palletsprojects.com/en/stable/patterns/fileuploads/
+FILE_UPLOAD_PARAMS = ("targets_list", "passwords_list", "usernames_list", "read_from_file")
+uploaded_files = {}
 
 nettacker_path_config = Config.path
 nettacker_application_config = Config.settings.as_dict()
@@ -236,6 +242,35 @@ def sanitize_report_path_filename(report_path_filename):
     return safe_report_path
 
 
+def allowed_file(filename):
+    return (
+        "." in filename
+        and filename.rsplit(".", 1)[1].lower() in Config.settings.allowed_upload_extensions
+    )
+
+
+@app.route("/upload/file", methods=["POST"])
+def upload_file():
+    api_key_is_valid(app, flask_request)
+    param_name = get_value(flask_request, "param_name")
+    if "file" not in flask_request.files:
+        return jsonify(structure(status="error", msg=_("upload_no_file"))), 400
+    uploaded = flask_request.files["file"]
+    if uploaded.filename == "":
+        return jsonify(structure(status="error", msg=_("upload_no_file_selected"))), 400
+    if not allowed_file(uploaded.filename):
+        return jsonify(structure(status="error", msg=_("upload_file_type_not_allowed"))), 400
+    filename = secure_filename(uploaded.filename)
+    if not filename:
+        return jsonify(structure(status="error", msg=_("upload_invalid_filename"))), 400
+    unique_name = f"{uuid.uuid4().hex}_{filename}"
+    tmp_dir = nettacker_path_config.tmp_dir
+    tmp_dir.mkdir(parents=True, exist_ok=True)
+    uploaded.save(str(tmp_dir / unique_name))
+    uploaded_files[param_name] = str(tmp_dir / unique_name)
+    return jsonify(structure(status="ok", msg=unique_name)), 200
+
+
 @app.route("/new/scan", methods=["GET", "POST"])
 def new_scan():
     """
@@ -253,6 +288,12 @@ def new_scan():
     if not report_path_filename:
         return jsonify(structure(status="error", msg="Invalid report filename")), 400
     form_values["report_path_filename"] = str(report_path_filename)
+
+    # Ensuring that these parameters cannot be set by the user without a file upload
+    for key in FILE_UPLOAD_PARAMS:
+        form_values.pop(key, None)
+    form_values.update(uploaded_files)
+
     for key in nettacker_application_config:
         if key not in form_values:
             form_values[key] = nettacker_application_config[key]
diff --git a/nettacker/config.py b/nettacker/config.py
index f05730213..f5bf061f0 100644
--- a/nettacker/config.py
+++ b/nettacker/config.py
@@ -190,6 +190,7 @@ class DefaultSettings(ConfigBase):
     verbose_mode = False
     scan_compare_id = None
     compare_report_path_filename = ""
+    allowed_upload_extensions = ("txt", "csv", "lst", "list")
 
 
 class Config:
diff --git a/nettacker/locale/en.yaml b/nettacker/locale/en.yaml
index 5b60b92d1..a9d7b661b 100644
--- a/nettacker/locale/en.yaml
+++ b/nettacker/locale/en.yaml
@@ -140,4 +140,8 @@ report_retrieval_fail: Could not retrieve the report
 read_report_fail: Failed to read report file {0}
 search_results_end: No more search results
 database_error: Database error!
-error_exclude_all: "Cannot exclude all modules. Please specify individual module names to exclude using -x."
\ No newline at end of file
+error_exclude_all: "Cannot exclude all modules. Please specify individual module names to exclude using -x."
+upload_no_file: no file provided
+upload_no_file_selected: no file selected
+upload_invalid_filename: invalid filename
+upload_file_type_not_allowed: file type not allowed
\ No newline at end of file
diff --git a/nettacker/web/static/index.html b/nettacker/web/static/index.html
index 7205802fd..d1ac453cc 100644
--- a/nettacker/web/static/index.html
+++ b/nettacker/web/static/index.html
@@ -162,6 +162,10 @@ <h3>Targets</h3>
                     <span class="input-group-addon"><i class="fa fa-space-shuttle"></i></span>
                     <input id="targets" type="text" class="form-control" data-role="tagsinput" placeholder="Add new target" >
                 </div>
+                <label class="btn btn-default btn-sm" style="margin-top: 5px;">
+                    Upload targets file <input type="file" id="targets_list_file" style="display:none;">
+                </label>
+                <span id="targets_list_status"></span>
                 <div class="form-group" style="margin-top: 10px;">
                     <label>
                         <input id="skip_service_discovery" type="checkbox">
@@ -313,21 +317,39 @@ <h3>HTTP Headers</h3>
                 </div>
                 <br>
 
+
                 <div class="form-group col-md-6">
                     <h3>Usernames</h3>
                     <textarea class="input-mini form-control" rows="8" cols="50" id="usernames"
                               data-role="tagsinput" placeholder="separate with commas or new line">
                     </textarea>
+                    <label class="btn btn-default btn-sm" style="margin-top: 5px;">
+                        Upload usernames file <input type="file" id="usernames_list_file" style="display:none;" >
+                    </label>
+                    <span id="usernames_list_status"></span>
                 </div>
                 <div class="form-group col-md-6">
                     <h3>Passwords</h3>
                     <textarea class="form-control" rows="8" cols="50" id="passwords"
                                placeholder="separate with commas or new line"></textarea>
+                    <label class="btn btn-default btn-sm" style="margin-top: 5px;">
+                            Upload passwords file <input type="file" id="passwords_list_file" style="display:none;" >
+                        </label>
+                        <span id="passwords_list_status"></span>
+                </div>
+                <div class="clearfix"></div>
+                <div class="form-group col-md-6">
+                    <h3>Wordlist</h3>
+                    <label class="btn btn-default btn-sm">
+                        Upload wordlist file <input type="file" id="read_from_file_file" style="display:none;">   <!-- Not checking for file extensions here because that is a config in the core -->
+                    </label>
+                    <span id="read_from_file_status"></span>
                 </div>
                 <br>
             </div>
+            <div class="clearfix"></div>
             <br>
-            <ul id="submit_new_scan" class="btn btn-primary" action="javascript:submit_new_scan()">
+            <ul id="submit_new_scan" class="btn btn-primary" style="margin-left: 15px;" action="javascript:submit_new_scan()">
                 Submit
             </ul>
         </form>
diff --git a/nettacker/web/static/js/main.js b/nettacker/web/static/js/main.js
index 0ee398b36..9e7a33d07 100644
--- a/nettacker/web/static/js/main.js
+++ b/nettacker/web/static/js/main.js
@@ -320,6 +320,33 @@ $(document).ready(function () {
     }
   });
 
+  // file upload handler
+  $.each(["targets_list", "usernames_list", "passwords_list", "read_from_file"], function(_, param) {
+    $("#" + param + "_file").change(function () {
+      var fileInput = this;
+      if (!fileInput.files.length) return;
+      var formData = new FormData();
+      formData.append("file", fileInput.files[0]);
+      formData.append("param_name", param);
+      var statusSpan = $("#" + param + "_status");
+      statusSpan.text("Uploading...");
+      $.ajax({
+        type: "POST",
+        url: "/upload/file",
+        data: formData,
+        processData: false,
+        contentType: false,
+      })
+        .done(function () {
+          statusSpan.text("Uploaded: " + fileInput.files[0].name);
+        })
+        .fail(function (jqXHR) {
+          statusSpan.text("Upload failed");
+          fileInput.value = "";
+        });
+    });
+  });
+  
   // submit new scan
   $("#submit_new_scan").click(function () {
     // set variables

From b4707d830b4f36f4769b3622e4a37008bd56ab94 Mon Sep 17 00:00:00 2001
From: Achintya Jai <helloitsme0218@gmail.com>
Date: Sun, 17 May 2026 11:58:52 +0530
Subject: [PATCH 2/5] documentation update

---
 docs/API.md | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/docs/API.md b/docs/API.md
index a1888e4c5..7103dfe74 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -2,6 +2,7 @@ WebUI/API Manual usage explained in the [Usage](Usage#api-and-webui) page but le
 
 - [Purpose](#purpose)
 - [Requests Structure](#requests-structure)
+- [Upload File](#upload-file)
 - [New Scan](#new-scan)
 - [Set Session](#set-session)
   * [Set Cookie](#set-cookie)
@@ -70,6 +71,34 @@ At the first, you must send an API key through the request each time you send a
 401
 ```
 
+## Upload File
+
+The parameters that accept a file path (`targets_list`, `usernames_list`, `passwords_list`, and `read_from_file`) cannot be set directly through `/new/scan`; the API strips them from the form values and only honours paths populated by a prior upload. To provide a file for one of these parameters, `POST` it to `/upload/file` first and the server will store it and bind it to the named parameter for subsequent scans.
+
+The request must be `multipart/form-data` with two fields:
+
+- `file` — the file contents
+- `param_name` — one of `targets_list`, `usernames_list`, `passwords_list`, `read_from_file`
+
+Constraints:
+
+- Maximum size: 10 MB (`MAX_CONTENT_LENGTH`)
+- Allowed extensions for `targets_list`/`usernames_list`/`passwords_list`: `txt`, `csv`, `lst`, `list` (configurable via `allowed_upload_extensions` in `nettacker/config.py`). `read_from_file` is not extension-checked here because module configs gate it in the core.
+- Filenames are sanitised and prefixed with a UUID before being written to the tmp directory.
+
+```python
+>>> r = requests.post(
+...     "https://127.0.0.1:5000/upload/file",
+...     data={"key": "<your_api_key>", "param_name": "targets_list"},
+...     files={"file": open("targets.txt", "rb")},
+...     verify=False,
+... )
+>>> r.json()
+{"msg": "<uuid>_targets.txt", "status": "ok"}
+```
+
+Possible error responses (HTTP 400): `upload_no_file`, `upload_no_file_selected`, `upload_invalid_filename`, `upload_file_type_not_allowed`. A subsequent `POST /new/scan` will automatically pick up the uploaded path for the matching `param_name`.
+
 ## New Scan
 
 To submit a new scan follow this step.
@@ -217,7 +246,7 @@ u'{"msg":"please choose your scan method!","status":"error"}\n'
 
 ```
 
-All variables in JSON you've got in results could be changed in `GET`/`POST`/`Cookies`, you can fill them all just like normal CLI commands. (e.g. same scan method name (modules), you can separate with `,`, you can use `ports` like `80,100-200,1000,2000`, set users and passwords `user1,user2`, `passwd1,passwd2`). You cannot use `read_from_file:/tmp/users.txt` syntax in `methods_args`. if you want to send a big password list, just send it through the `POST` requests and separated with `,`.
+All variables in JSON you've got in results could be changed in `GET`/`POST`/`Cookies`, you can fill them all just like normal CLI commands. (e.g. same scan method name (modules), you can separate with `,`, you can use `ports` like `80,100-200,1000,2000`, set users and passwords `user1,user2`, `passwd1,passwd2`). You cannot use `read_from_file:/tmp/users.txt` syntax in `methods_args`. If you want to send a big password list, either pass it inline through `POST` separated with `,` or upload it via [`/upload/file`](#upload-file) with `param_name=passwords_list` (the same applies to `targets_list`, `usernames_list`, and `read_from_file` — passing them as plain form values is ignored because the server only trusts paths produced by an upload).
 
 ## Set Session
 

From 47dbe59e968dda08c39c177e9324b8fe0ca298d5 Mon Sep 17 00:00:00 2001
From: purge12 <helloitsme0218@gmail.com>
Date: Sun, 5 Jul 2026 13:28:18 +0000
Subject: [PATCH 3/5] removed shared server state and made it stateless

---
 nettacker/api/engine.py         | 22 +++++++++++++++-------
 nettacker/web/static/js/main.js |  7 ++++++-
 2 files changed, 21 insertions(+), 8 deletions(-)

diff --git a/nettacker/api/engine.py b/nettacker/api/engine.py
index e4f0f253d..5ce2c2b63 100644
--- a/nettacker/api/engine.py
+++ b/nettacker/api/engine.py
@@ -55,7 +55,6 @@
     10 * 1024 * 1024
 )  # https://flask.palletsprojects.com/en/stable/patterns/fileuploads/
 FILE_UPLOAD_PARAMS = ("targets_list", "passwords_list", "usernames_list", "read_from_file")
-uploaded_files = {}
 
 nettacker_path_config = Config.path
 nettacker_application_config = Config.settings.as_dict()
@@ -252,7 +251,6 @@ def allowed_file(filename):
 @app.route("/upload/file", methods=["POST"])
 def upload_file():
     api_key_is_valid(app, flask_request)
-    param_name = get_value(flask_request, "param_name")
     if "file" not in flask_request.files:
         return jsonify(structure(status="error", msg=_("upload_no_file"))), 400
     uploaded = flask_request.files["file"]
@@ -267,7 +265,6 @@ def upload_file():
     tmp_dir = nettacker_path_config.tmp_dir
     tmp_dir.mkdir(parents=True, exist_ok=True)
     uploaded.save(str(tmp_dir / unique_name))
-    uploaded_files[param_name] = str(tmp_dir / unique_name)
     return jsonify(structure(status="ok", msg=unique_name)), 200
 
 
@@ -289,10 +286,17 @@ def new_scan():
         return jsonify(structure(status="error", msg="Invalid report filename")), 400
     form_values["report_path_filename"] = str(report_path_filename)
 
-    # Ensuring that these parameters cannot be set by the user without a file upload
+    uploaded_paths = []
     for key in FILE_UPLOAD_PARAMS:
-        form_values.pop(key, None)
-    form_values.update(uploaded_files)
+        token = form_values.get(key)
+        if not token:
+            form_values.pop(key, None)
+            continue
+        file_path = nettacker_path_config.tmp_dir / secure_filename(token)
+        if not file_path.is_file():
+            return jsonify(structure(status="error", msg="Uploaded file not found")), 400
+        form_values[key] = str(file_path)
+        uploaded_paths.append(file_path)
 
     for key in nettacker_application_config:
         if key not in form_values:
@@ -304,7 +308,11 @@ def new_scan():
         ]
     # Handle service discovery
     form_values["skip_service_discovery"] = form_values.get("skip_service_discovery", "") == "true"
-    nettacker_app = Nettacker(api_arguments=SimpleNamespace(**form_values))
+    try:
+        nettacker_app = Nettacker(api_arguments=SimpleNamespace(**form_values))
+    finally:
+        for file_path in uploaded_paths:
+            file_path.unlink(missing_ok=True)
     app.config["OWASP_NETTACKER_CONFIG"]["options"] = nettacker_app.arguments
     thread = Thread(target=nettacker_app.run)
     thread.start()
diff --git a/nettacker/web/static/js/main.js b/nettacker/web/static/js/main.js
index 9e7a33d07..07615db8c 100644
--- a/nettacker/web/static/js/main.js
+++ b/nettacker/web/static/js/main.js
@@ -321,6 +321,7 @@ $(document).ready(function () {
   });
 
   // file upload handler
+  var uploaded_tokens = {};
   $.each(["targets_list", "usernames_list", "passwords_list", "read_from_file"], function(_, param) {
     $("#" + param + "_file").change(function () {
       var fileInput = this;
@@ -337,10 +338,12 @@ $(document).ready(function () {
         processData: false,
         contentType: false,
       })
-        .done(function () {
+        .done(function (res) {
+          uploaded_tokens[param] = res.msg;
           statusSpan.text("Uploaded: " + fileInput.files[0].name);
         })
         .fail(function (jqXHR) {
+          delete uploaded_tokens[param];
           statusSpan.text("Upload failed");
           fileInput.value = "";
         });
@@ -444,6 +447,8 @@ $(document).ready(function () {
       }
     }
 
+    $.extend(data, uploaded_tokens);
+
     $.ajax({
       type: "POST",
       url: "/new/scan",

From e363922f5d097890c8dfd6dd9993820c7624ceec Mon Sep 17 00:00:00 2001
From: purge12 <helloitsme0218@gmail.com>
Date: Mon, 13 Jul 2026 10:27:42 +0000
Subject: [PATCH 4/5] fixes for coderabbit and others

---
 docs/API.md                     | 11 +++---
 nettacker/api/engine.py         | 63 +++++++++++++++++++++++++++++----
 nettacker/locale/en.yaml        |  5 ++-
 nettacker/web/static/js/main.js | 23 +++++++++++-
 4 files changed, 90 insertions(+), 12 deletions(-)

diff --git a/docs/API.md b/docs/API.md
index 7103dfe74..8b92bf065 100644
--- a/docs/API.md
+++ b/docs/API.md
@@ -75,7 +75,7 @@ At the first, you must send an API key through the request each time you send a
 
 The parameters that accept a file path (`targets_list`, `usernames_list`, `passwords_list`, and `read_from_file`) cannot be set directly through `/new/scan`; the API strips them from the form values and only honours paths populated by a prior upload. To provide a file for one of these parameters, `POST` it to `/upload/file` first and the server will store it and bind it to the named parameter for subsequent scans.
 
-The request must be `multipart/form-data` with two fields:
+The request must be `multipart/form-data` with two **required** fields:
 
 - `file` — the file contents
 - `param_name` — one of `targets_list`, `usernames_list`, `passwords_list`, `read_from_file`
@@ -83,9 +83,11 @@ The request must be `multipart/form-data` with two fields:
 Constraints:
 
 - Maximum size: 10 MB (`MAX_CONTENT_LENGTH`)
-- Allowed extensions for `targets_list`/`usernames_list`/`passwords_list`: `txt`, `csv`, `lst`, `list` (configurable via `allowed_upload_extensions` in `nettacker/config.py`). `read_from_file` is not extension-checked here because module configs gate it in the core.
+- Allowed extensions: `txt`, `csv`, `lst`, `list` (configurable via `allowed_upload_extensions` in `nettacker/config.py`). The check applies to every `param_name`.
 - Filenames are sanitised and prefixed with a UUID before being written to the tmp directory.
 
+On success the response `msg` is an **opaque signed token**, not a filename. The token is bound to the `param_name` it was uploaded for and **expires 15 minutes** after upload. Pass it back through `/new/scan` under the matching parameter; the server verifies the signature, the expiry, and that the token's parameter matches the field it is submitted under. Tokens are stateless (nothing is stored server-side beyond the temp file), so they do not survive an API restart. Temp files left by uploads that are never submitted are swept once their token expires.
+
 ```python
 >>> r = requests.post(
 ...     "https://127.0.0.1:5000/upload/file",
@@ -94,10 +96,11 @@ Constraints:
 ...     verify=False,
 ... )
 >>> r.json()
-{"msg": "<uuid>_targets.txt", "status": "ok"}
+{"msg": "<signed_token>", "status": "ok"}
+>>> # then, in POST /new/scan: targets_list=<signed_token>
 ```
 
-Possible error responses (HTTP 400): `upload_no_file`, `upload_no_file_selected`, `upload_invalid_filename`, `upload_file_type_not_allowed`. A subsequent `POST /new/scan` will automatically pick up the uploaded path for the matching `param_name`.
+Possible error responses (HTTP 400): `upload_invalid_param`, `upload_no_file`, `upload_no_file_selected`, `upload_invalid_filename`, `upload_file_type_not_allowed`. At `/new/scan`, a bad token yields `upload_token_invalid` (forged/expired/wrong parameter) or `upload_file_not_found` (already consumed or swept).
 
 ## New Scan
 
diff --git a/nettacker/api/engine.py b/nettacker/api/engine.py
index 5ce2c2b63..a758a8939 100644
--- a/nettacker/api/engine.py
+++ b/nettacker/api/engine.py
@@ -3,6 +3,8 @@
 import multiprocessing
 import os
 import random
+import re
+import secrets
 import string
 import time
 import uuid
@@ -11,6 +13,7 @@
 
 from flask import Flask, Response, abort, jsonify, make_response, render_template
 from flask import request as flask_request
+from itsdangerous import BadData, URLSafeTimedSerializer
 from werkzeug.serving import WSGIRequestHandler
 from werkzeug.utils import secure_filename
 
@@ -55,6 +58,16 @@
     10 * 1024 * 1024
 )  # https://flask.palletsprojects.com/en/stable/patterns/fileuploads/
 FILE_UPLOAD_PARAMS = ("targets_list", "passwords_list", "usernames_list", "read_from_file")
+# Uploaded files are referenced by a signed, self-expiring token instead of a raw
+# filename, so /new/scan only trusts paths that /upload/file actually issued (for the
+# matching parameter) and never has to keep any server-side upload state.
+UPLOAD_TOKEN_TTL_SECONDS = 15 * 60
+_upload_token_serializer = URLSafeTimedSerializer(
+    secrets.token_hex(32), salt="nettacker-file-upload"
+)
+# Only files written by upload_file() match this prefix (uuid4 hex + "_"); the cleanup
+# sweep is scoped to it so it can never touch reports or other tmp artifacts.
+UPLOAD_FILENAME_RE = re.compile(r"^[0-9a-f]{32}_")
 
 nettacker_path_config = Config.path
 nettacker_application_config = Config.settings.as_dict()
@@ -248,9 +261,37 @@ def allowed_file(filename):
     )
 
 
+def cleanup_expired_uploads():
+    """Delete upload temp files whose token has expired.
+
+    Files that were uploaded but never submitted to a scan are otherwise never
+    cleaned up. The sweep is opportunistic (run on every upload) so it needs no
+    background task or shared state, and is scoped to the upload naming prefix so
+    it can never remove reports or other tmp artifacts.
+    """
+    tmp_dir = nettacker_path_config.tmp_dir
+    if not tmp_dir.is_dir():
+        return
+    cutoff = time.time() - UPLOAD_TOKEN_TTL_SECONDS
+    for entry in tmp_dir.iterdir():
+        try:
+            if (
+                entry.is_file()
+                and UPLOAD_FILENAME_RE.match(entry.name)
+                and entry.stat().st_mtime < cutoff
+            ):
+                entry.unlink(missing_ok=True)
+        except OSError:
+            continue
+
+
 @app.route("/upload/file", methods=["POST"])
 def upload_file():
     api_key_is_valid(app, flask_request)
+    cleanup_expired_uploads()
+    param_name = flask_request.form.get("param_name", "")
+    if param_name not in FILE_UPLOAD_PARAMS:
+        return jsonify(structure(status="error", msg=_("upload_invalid_param"))), 400
     if "file" not in flask_request.files:
         return jsonify(structure(status="error", msg=_("upload_no_file"))), 400
     uploaded = flask_request.files["file"]
@@ -261,11 +302,12 @@ def upload_file():
     filename = secure_filename(uploaded.filename)
     if not filename:
         return jsonify(structure(status="error", msg=_("upload_invalid_filename"))), 400
-    unique_name = f"{uuid.uuid4().hex}_{filename}"
+    stored_name = f"{uuid.uuid4().hex}_{filename}"
     tmp_dir = nettacker_path_config.tmp_dir
     tmp_dir.mkdir(parents=True, exist_ok=True)
-    uploaded.save(str(tmp_dir / unique_name))
-    return jsonify(structure(status="ok", msg=unique_name)), 200
+    uploaded.save(str(tmp_dir / stored_name))
+    token = _upload_token_serializer.dumps({"param": param_name, "name": stored_name})
+    return jsonify(structure(status="ok", msg=token)), 200
 
 
 @app.route("/new/scan", methods=["GET", "POST"])
@@ -292,9 +334,18 @@ def new_scan():
         if not token:
             form_values.pop(key, None)
             continue
-        file_path = nettacker_path_config.tmp_dir / secure_filename(token)
-        if not file_path.is_file():
-            return jsonify(structure(status="error", msg="Uploaded file not found")), 400
+        try:
+            payload = _upload_token_serializer.loads(token, max_age=UPLOAD_TOKEN_TTL_SECONDS)
+        except BadData:
+            # tampered, forged, or expired token
+            return jsonify(structure(status="error", msg=_("upload_token_invalid"))), 400
+        if not isinstance(payload, dict) or payload.get("param") != key:
+            # token was issued for a different parameter
+            return jsonify(structure(status="error", msg=_("upload_token_invalid"))), 400
+        stored_name = secure_filename(payload.get("name", ""))
+        file_path = nettacker_path_config.tmp_dir / stored_name
+        if not stored_name or not file_path.is_file():
+            return jsonify(structure(status="error", msg=_("upload_file_not_found"))), 400
         form_values[key] = str(file_path)
         uploaded_paths.append(file_path)
 
diff --git a/nettacker/locale/en.yaml b/nettacker/locale/en.yaml
index 55c9d84f1..040e75cf0 100644
--- a/nettacker/locale/en.yaml
+++ b/nettacker/locale/en.yaml
@@ -146,4 +146,7 @@ error_exclude_all: "Cannot exclude all modules. Please specify individual module
 upload_no_file: no file provided
 upload_no_file_selected: no file selected
 upload_invalid_filename: invalid filename
-upload_file_type_not_allowed: file type not allowed
\ No newline at end of file
+upload_file_type_not_allowed: file type not allowed
+upload_invalid_param: invalid or missing upload parameter
+upload_token_invalid: invalid or expired upload token
+upload_file_not_found: uploaded file not found or expired
\ No newline at end of file
diff --git a/nettacker/web/static/js/main.js b/nettacker/web/static/js/main.js
index 07615db8c..eef30f099 100644
--- a/nettacker/web/static/js/main.js
+++ b/nettacker/web/static/js/main.js
@@ -322,6 +322,7 @@ $(document).ready(function () {
 
   // file upload handler
   var uploaded_tokens = {};
+  var pendingUploads = 0;
   $.each(["targets_list", "usernames_list", "passwords_list", "read_from_file"], function(_, param) {
     $("#" + param + "_file").change(function () {
       var fileInput = this;
@@ -331,6 +332,7 @@ $(document).ready(function () {
       formData.append("param_name", param);
       var statusSpan = $("#" + param + "_status");
       statusSpan.text("Uploading...");
+      pendingUploads++;
       $.ajax({
         type: "POST",
         url: "/upload/file",
@@ -346,12 +348,24 @@ $(document).ready(function () {
           delete uploaded_tokens[param];
           statusSpan.text("Upload failed");
           fileInput.value = "";
+        })
+        .always(function () {
+          pendingUploads--;
         });
     });
   });
-  
+
   // submit new scan
   $("#submit_new_scan").click(function () {
+    // block submission while file uploads are still in flight, otherwise the
+    // scan is submitted without the uploaded file tokens and silently misses them
+    if (pendingUploads > 0) {
+      document.getElementById("error_msg").innerHTML =
+        "Please wait for file uploads to finish before submitting.";
+      $("#failed_request").removeClass("hidden");
+      setTimeout('$("#failed_request").addClass("hidden");', 5000);
+      return;
+    }
     // set variables
     // check ranges
     if (document.getElementById("scan_ip_range").checked) {
@@ -455,6 +469,13 @@ $(document).ready(function () {
       data: data,
     })
       .done(function (res) {
+        // the server deletes the uploaded temp files once the scan starts, so
+        // clear the consumed tokens to avoid re-sending stale ones on the next scan
+        uploaded_tokens = {};
+        $.each(["targets_list", "usernames_list", "passwords_list", "read_from_file"], function (_, param) {
+          $("#" + param + "_status").text("");
+          $("#" + param + "_file").val("");
+        });
         var results = JSON.stringify(res);
         results = results.replaceAll(",", ",<br>");
         document.getElementById("success_msg").innerHTML = results;

From a1a6c623fcdf54dae127def7b3fa08f3e3316287 Mon Sep 17 00:00:00 2001
From: pUrGe12 <helloitsme0218@gmail.com>
Date: Wed, 15 Jul 2026 11:15:28 +0530
Subject: [PATCH 5/5] cleanup

---
 nettacker/api/engine.py         | 14 --------------
 nettacker/web/static/js/main.js |  4 ----
 2 files changed, 18 deletions(-)

diff --git a/nettacker/api/engine.py b/nettacker/api/engine.py
index a758a8939..19e786bfe 100644
--- a/nettacker/api/engine.py
+++ b/nettacker/api/engine.py
@@ -58,15 +58,10 @@
     10 * 1024 * 1024
 )  # https://flask.palletsprojects.com/en/stable/patterns/fileuploads/
 FILE_UPLOAD_PARAMS = ("targets_list", "passwords_list", "usernames_list", "read_from_file")
-# Uploaded files are referenced by a signed, self-expiring token instead of a raw
-# filename, so /new/scan only trusts paths that /upload/file actually issued (for the
-# matching parameter) and never has to keep any server-side upload state.
 UPLOAD_TOKEN_TTL_SECONDS = 15 * 60
 _upload_token_serializer = URLSafeTimedSerializer(
     secrets.token_hex(32), salt="nettacker-file-upload"
 )
-# Only files written by upload_file() match this prefix (uuid4 hex + "_"); the cleanup
-# sweep is scoped to it so it can never touch reports or other tmp artifacts.
 UPLOAD_FILENAME_RE = re.compile(r"^[0-9a-f]{32}_")
 
 nettacker_path_config = Config.path
@@ -262,13 +257,6 @@ def allowed_file(filename):
 
 
 def cleanup_expired_uploads():
-    """Delete upload temp files whose token has expired.
-
-    Files that were uploaded but never submitted to a scan are otherwise never
-    cleaned up. The sweep is opportunistic (run on every upload) so it needs no
-    background task or shared state, and is scoped to the upload naming prefix so
-    it can never remove reports or other tmp artifacts.
-    """
     tmp_dir = nettacker_path_config.tmp_dir
     if not tmp_dir.is_dir():
         return
@@ -337,10 +325,8 @@ def new_scan():
         try:
             payload = _upload_token_serializer.loads(token, max_age=UPLOAD_TOKEN_TTL_SECONDS)
         except BadData:
-            # tampered, forged, or expired token
             return jsonify(structure(status="error", msg=_("upload_token_invalid"))), 400
         if not isinstance(payload, dict) or payload.get("param") != key:
-            # token was issued for a different parameter
             return jsonify(structure(status="error", msg=_("upload_token_invalid"))), 400
         stored_name = secure_filename(payload.get("name", ""))
         file_path = nettacker_path_config.tmp_dir / stored_name
diff --git a/nettacker/web/static/js/main.js b/nettacker/web/static/js/main.js
index eef30f099..b62d5116f 100644
--- a/nettacker/web/static/js/main.js
+++ b/nettacker/web/static/js/main.js
@@ -357,8 +357,6 @@ $(document).ready(function () {
 
   // submit new scan
   $("#submit_new_scan").click(function () {
-    // block submission while file uploads are still in flight, otherwise the
-    // scan is submitted without the uploaded file tokens and silently misses them
     if (pendingUploads > 0) {
       document.getElementById("error_msg").innerHTML =
         "Please wait for file uploads to finish before submitting.";
@@ -469,8 +467,6 @@ $(document).ready(function () {
       data: data,
     })
       .done(function (res) {
-        // the server deletes the uploaded temp files once the scan starts, so
-        // clear the consumed tokens to avoid re-sending stale ones on the next scan
         uploaded_tokens = {};
         $.each(["targets_list", "usernames_list", "passwords_list", "read_from_file"], function (_, param) {
           $("#" + param + "_status").text("");