diff --git a/parsers/github.php b/parsers/github.php index 2811a6c..4def29c 100644 --- a/parsers/github.php +++ b/parsers/github.php @@ -66,10 +66,12 @@ HTML; if ($commitCount > 0) { $eventContent .= '
| $keySafe | @@ -110,7 +110,7 @@ HTML; $labelsContent .= '
| $keySafe | @@ -130,7 +130,7 @@ HTML; $annotationsContent .= '
| $keySafe | @@ -180,7 +180,7 @@ HTML; $alertsContent .= '
| $keySafe | @@ -196,7 +196,7 @@ HTML; $alertsContent .= '
| $keySafe | diff --git a/parsers/helpers.php b/parsers/helpers.php index 410c804..aaf7aa8 100644 --- a/parsers/helpers.php +++ b/parsers/helpers.php @@ -3,6 +3,13 @@ * Helper functions for webhook parsers */ +/** + * Escape a free-text value for an HTML cell, keeping line breaks. + */ +function esc($value) { + return nl2br(htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8'), false); +} + /** * Helper function to render nested arrays/objects as HTML tables * @@ -18,7 +25,7 @@ function renderDataAsTable($data, $depth = 0) { $html = ''; if (!is_array($data)) { - $safe = htmlspecialchars((string)$data, ENT_QUOTES, 'UTF-8'); + $safe = esc($data); return "|
| ' . $keySafe . ' | '; $html .= '' . $valueSafe . ' | '; @@ -53,7 +60,7 @@ function renderDataAsTable($data, $depth = 0) { $html .= '
| ' . $label . ' | ' . $safe . ' |
| Item ' . ($index + 1) . ' | ' . esc($item) . ' |
| Item ' . ($index + 1) . ' | '; @@ -165,7 +180,7 @@ function renderJsonData($data, $path = '') { foreach ($simpleData as $key => $value) { $keySafe = htmlspecialchars($key, ENT_QUOTES, 'UTF-8'); - $valueSafe = htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8'); + $valueSafe = esc($value); $html .= '||
| ' . $keySafe . ' | '; $html .= '' . $valueSafe . ' | '; diff --git a/parsers/wxinteract.php b/parsers/wxinteract.php index 7c4c25c..27cc6a2 100644 --- a/parsers/wxinteract.php +++ b/parsers/wxinteract.php @@ -119,7 +119,7 @@ function buildOutboundSmsSubmittedContent($data) { $messageId = htmlspecialchars($data['message_id'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); $to = htmlspecialchars($data['to'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); $from = htmlspecialchars($data['from'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); - $message = htmlspecialchars($data['message'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); + $message = esc($data['message'] ?? 'N/A'); $submittedAt = htmlspecialchars($data['submitted_at'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); $campaignId = htmlspecialchars($data['campaign_id'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); @@ -205,7 +205,7 @@ function buildOutboundSmsFailedContent($data) { $from = htmlspecialchars($data['from'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); $failedAt = htmlspecialchars($data['failed_at'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); $errorCode = htmlspecialchars($data['error_code'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); - $errorMessage = htmlspecialchars($data['error_message'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); + $errorMessage = esc($data['error_message'] ?? 'N/A'); $campaignId = htmlspecialchars($data['campaign_id'] ?? 'N/A', ENT_QUOTES, 'UTF-8'); return <<
| $keySafe |