Update backend/scanners_core.py

backend/scanners_core.py

@@ -1896,58 +1896,100 @@ def generate_scan_pdf(scan, vulnerabilities):
         # Legal Disclaimer & Confidentiality Notice
         elements.append(PageBreak())
         
-        disclaimer_title_style = ParagraphStyle(
-            'DisclaimerTitleStyle',
-            parent=styles['Heading3'],
-            fontSize=11,
-            leading=14,
+        disclaimer_header_style = ParagraphStyle(
+            'DisclaimerHeaderStyle',
+            parent=styles['Heading2'],
+            fontSize=12,
+            leading=15,
             textColor=colors.HexColor("#0F172A"),
-            spaceAfter=6
+            spaceAfter=0
         )
         
+        disclaimer_sub_style = ParagraphStyle(
+            'DisclaimerSubStyle',
+            parent=styles['Normal'],
+            fontSize=8,
+            leading=10,
+            textColor=colors.HexColor("#64748B"),
+            spaceAfter=0
+        )
+
+        disclaimer_item_title = ParagraphStyle(
+            'DisclaimerItemTitle',
+            parent=styles['Normal'],
+            fontSize=9.5,
+            leading=12.5,
+            textColor=colors.HexColor("#0F172A"),
+            spaceBefore=5,
+            spaceAfter=2
+        )
+
         disclaimer_body_style = ParagraphStyle(
             'DisclaimerBodyStyle',
             parent=styles['Normal'],
-            fontSize=8,
-            leading=10.5,
+            fontSize=8.5,
+            leading=11.5,
             textColor=colors.HexColor("#334155"),
-            alignment=4
+            alignment=4,
+            spaceAfter=4
         )
 
-        disclaimer_heading = Paragraph("<b>Legal Disclaimer, Scope Boundaries & Limitation of Liability</b>", disclaimer_title_style)
-        disclaimer_body = (
-            "<b>1. Nature of Automated Security Assessment (\"AS-IS\" Provision)</b><br/>"
-            "This vulnerability assessment report is completely system-generated by the LarShield automated engine. "
-            "Automated security scanning tools inspect web applications, APIs, network services, and infrastructure against known vulnerability signatures, heuristic patterns, and behavioral anomalies. "
-            "Due to the dynamic and evolving nature of security threats, automated assessments may contain false positives (incorrectly identified flaws), false negatives (undetected vulnerabilities), or incomplete contextual findings. "
-            "This document is provided strictly on an <b>\"AS-IS\" and \"AS-AVAILABLE\" basis</b> without warranties or guarantees of any kind, whether express, implied, statutory, or otherwise, including but not limited to implied warranties of merchantability, fitness for a particular purpose, non-infringement, or absolute system security.<br/><br/>"
-            "<b>2. Point-in-Time Evaluation & Scope Limitations</b><br/>"
-            "The findings, CVSS scoring, and risk calculations presented herein reflect a strict point-in-time snapshot of the target environment at the exact timestamp of scan execution. "
-            "Application updates, server configuration changes, firewall rule modifications, third-party component updates, or emerging zero-day exploits occurring after scan execution may fundamentally alter the target security posture. "
-            "LarShield makes no representation or warranty that target systems are completely immune to cyberattacks, unauthorized intrusion, data breaches, or operational disruptions.<br/><br/>"
-            "<b>3. Authorization & Compliance Verification</b><br/>"
-            "By initiating or scheduling security assessments using the LarShield platform, the requesting user or organization explicitly warrants and certifies that they possess full, legally verifiable authorization from all relevant infrastructure, network, and application owners to conduct security assessments against designated target endpoints. "
-            "LarShield disclaims all legal liability resulting from unauthorized scanning, misconfigured target inputs, or scans conducted against assets without explicit consent.<br/><br/>"
-            "<b>4. Strict Limitation of Liability</b><br/>"
-            "To the maximum extent permitted under applicable laws, under no circumstances shall LarShield, its parent company, operators, developers, officers, affiliates, or service providers be held liable for any direct, indirect, incidental, special, punitive, exemplary, or consequential damages whatsoever (including, without limitation, loss of business revenue, commercial profit, operational downtime, data corruption, unauthorized data access, regulatory fines, or third-party claims) arising out of or in connection with the use of, reliance upon, or inability to use this report or any security patch, configuration change, or remediation advice contained within.<br/><br/>"
-            "<b>5. Remediation & Patching Responsibility</b><br/>"
-            "All remediation guidance, code recommendations, and security configuration changes outlined in this report are advisory only. "
-            "Target system administrators and security personnel are solely responsible for thoroughly validating, testing, and reviewing any remediation steps in a non-production staging environment prior to production deployment. "
-            "LarShield assumes no responsibility for application breakage, service outage, or system instability resulting from remediation actions taken based on this report.<br/><br/>"
-            "<b>6. Proprietary Confidentiality Notice</b><br/>"
-            "This report contains sensitive, proprietary vulnerability intelligence regarding the client organization's digital assets. "
-            "Unauthorized distribution, public exposure, or reproduction of this document without prior written authorization from both the client organization and LarShield is strictly prohibited."
-        )
-        disclaimer_table = Table([[disclaimer_heading], [Paragraph(disclaimer_body, disclaimer_body_style)]], colWidths=[460])
-        disclaimer_table.setStyle(TableStyle([
+        header_p1 = Paragraph("<b>Legal Disclaimer, Scope Boundaries & Limitation of Liability</b>", disclaimer_header_style)
+        header_p2 = Paragraph("OFFICIAL SYSTEM-GENERATED VULNERABILITY ASSESSMENT GOVERNANCE NOTICE", disclaimer_sub_style)
+        
+        header_table = Table([[header_p1], [Spacer(1, 2)], [header_p2]], colWidths=[532])
+        header_table.setStyle(TableStyle([
+            ('BACKGROUND', (0,0), (-1,-1), colors.HexColor("#F1F5F9")),
+            ('LINELEFT', (0,0), (-1,-1), 4, colors.HexColor("#4F46E5")),
+            ('TOPPADDING', (0,0), (-1,-1), 8),
+            ('BOTTOMPADDING', (0,0), (-1,-1), 8),
+            ('LEFTPADDING', (0,0), (-1,-1), 12),
+            ('RIGHTPADDING', (0,0), (-1,-1), 12),
+        ]))
+
+        disclaimer_items = [
+            ("1. Nature of Automated Security Assessment (\"AS-IS\" Provision)",
+             "This vulnerability assessment report is completely system-generated by the LarShield automated engine. Automated security scanning tools inspect web applications, APIs, network services, and infrastructure against known vulnerability signatures, heuristic patterns, and behavioral anomalies. Due to the dynamic and evolving nature of security threats, automated assessments may contain false positives (incorrectly identified flaws), false negatives (undetected vulnerabilities), or incomplete contextual findings. This document is provided strictly on an <b>\"AS-IS\" and \"AS-AVAILABLE\" basis</b> without warranties or guarantees of any kind, whether express, implied, statutory, or otherwise, including but not limited to implied warranties of merchantability, fitness for a particular purpose, non-infringement, or absolute system security."),
+            
+            ("2. Point-in-Time Evaluation & Scope Limitations",
+             "The findings, CVSS scoring, and risk calculations presented herein reflect a strict point-in-time snapshot of the target environment at the exact timestamp of scan execution. Application updates, server configuration changes, firewall rule modifications, third-party component updates, or emerging zero-day exploits occurring after scan execution may fundamentally alter the target security posture. LarShield makes no representation or warranty that target systems are completely immune to cyberattacks, unauthorized intrusion, data breaches, or operational disruptions."),
+            
+            ("3. Authorization & Compliance Verification",
+             "By initiating or scheduling security assessments using the LarShield platform, the requesting user or organization explicitly warrants and certifies that they possess full, legally verifiable authorization from all relevant infrastructure, network, and application owners to conduct security assessments against designated target endpoints. LarShield disclaims all legal liability resulting from unauthorized scanning, misconfigured target inputs, or scans conducted against assets without explicit consent."),
+            
+            ("4. Strict Limitation of Liability",
+             "To the maximum extent permitted under applicable laws, under no circumstances shall LarShield, its parent company, operators, developers, officers, affiliates, or service providers be held liable for any direct, indirect, incidental, special, punitive, exemplary, or consequential damages whatsoever (including, without limitation, loss of business revenue, commercial profit, operational downtime, data corruption, unauthorized data access, regulatory fines, or third-party claims) arising out of or in connection with the use of, reliance upon, or inability to use this report or any security patch, configuration change, or remediation advice contained within."),
+            
+            ("5. Remediation & Patching Responsibility",
+             "All remediation guidance, code recommendations, and security configuration changes outlined in this report are advisory only. Target system administrators and security personnel are solely responsible for thoroughly validating, testing, and reviewing any remediation steps in a non-production staging environment prior to production deployment. LarShield assumes no responsibility for application breakage, service outage, or system instability resulting from remediation actions taken based on this report."),
+            
+            ("6. Proprietary Confidentiality Notice",
+             "This report contains sensitive, proprietary vulnerability intelligence regarding the client organization's digital assets. Unauthorized distribution, public exposure, or reproduction of this document without prior written authorization from both the client organization and LarShield is strictly prohibited.")
+        ]
+
+        content_flowables = [header_table, Spacer(1, 10)]
+
+        card_cells = []
+        for idx, (title, body) in enumerate(disclaimer_items):
+            t_p = Paragraph(f"<b>{title}</b>", disclaimer_item_title)
+            b_p = Paragraph(body, disclaimer_body_style)
+            card_cells.append(t_p)
+            card_cells.append(b_p)
+            if idx < len(disclaimer_items) - 1:
+                card_cells.append(Spacer(1, 4))
+
+        disclaimer_card_table = Table([[card_cells]], colWidths=[532])
+        disclaimer_card_table.setStyle(TableStyle([
             ('BACKGROUND', (0,0), (-1,-1), colors.HexColor("#F8FAFC")),
-            ('GRID', (0,0), (-1,-1), 0.5, colors.HexColor("#CBD5E1")),
+            ('BOX', (0,0), (-1,-1), 0.75, colors.HexColor("#CBD5E1")),
             ('TOPPADDING', (0,0), (-1,-1), 10),
             ('BOTTOMPADDING', (0,0), (-1,-1), 10),
-            ('LEFTPADDING', (0,0), (-1,-1), 12),
-            ('RIGHTPADDING', (0,0), (-1,-1), 12),
+            ('LEFTPADDING', (0,0), (-1,-1), 14),
+            ('RIGHTPADDING', (0,0), (-1,-1), 14),
         ]))
-        elements.append(KeepTogether(disclaimer_table))
+
+        content_flowables.append(disclaimer_card_table)
+        elements.append(KeepTogether(content_flowables))
         elements.append(Spacer(1, 15))
 
         return elements