Remove every remote destination from the HTML report

[abrignoni]

Why

Port of iLEAPP #1887, keeping html_safe.py byte-identical across the cores that carry it.

A remote href or src in a report is a disclosure channel: following one — or in the <img> case merely opening the report — tells whoever controls that host that the account is under examination, when, and from which IP address. Reports are read on analyst workstations and mailed to counsel, so a report should reach nothing outside its own folder.

What changed

• safe_url() no longer builds an anchor. It returns the URL as escaped text, so the evidence stays readable and copyable while the destination goes. The scheme allowlist it used to gate anchors on goes with them.
• safe_local_link() is added for the destinations that stay: report-relative paths. It refuses a scheme, a protocol-relative //host, an absolute path, and any .. segment.

No artifact in this core builds an anchor by hand, so the helper is the whole change.

This matters more than a zero-diff port looks: an artifact calling safe_url() was still emitting a live remote anchor here, because this core carried the old anchor-building version of the helper.

Validation

• py_compile clean
• safe_url returns no anchor for a remote URL; safe_local_link anchors a report-relative path and refuses a remote one
• PluginLoader loads every plugin

🤖 Generated with Claude Code