Health Checker: Fix HTML report URL hyperlinks, br tag encoding, and CVE detail row leaks#2546
Merged
Conversation
…CVE detail row leaks - Convert plain-text URLs to clickable hyperlinks in HTML report (fixes #532) - Preserve <br> tags after HTML encoding in GetHtmlTextValue (PR #2475 regression) - Add AddHtmlDetailRow = $false to 9 Security Vulnerability entries that were leaking individual CVE rows into the HTML detail table instead of only appearing in the rolled-up Security Vulnerabilities summary row - Add Extract for Pester Testing markers to GetHtmlTextValue for testability - Add GetHtmlServerDetail and GetHtmlOverviewValue test helpers - Add 15 Pester tests: 11 unit tests for GetHtmlTextValue encoding/URL/br behavior and 4 integration tests for HTML report structure and CVE rendering Files fixed for missing AddHtmlDetailRow: - Invoke-AnalyzerSecurityADV24199947.ps1 - Invoke-AnalyzerSecurityCve-2022-21978.ps1 - Invoke-AnalyzerSecurityCve-2022-41040.NotPublished.ps1 - Invoke-AnalyzerSecurityCveAddressedBySerializedDataSigning.ps1 - Invoke-AnalyzerSecurityCveAndOverrideCheck.ps1 - Invoke-AnalyzerSecurityExtendedProtectionConfigState.ps1 (4 locations) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR improves HealthChecker’s HTML report rendering and output shaping, primarily for the Security Vulnerabilities section, by (1) converting plain-text URLs into clickable hyperlinks, (2) preserving intended <br> tags in HTML cells (regression from PR #2475), and (3) preventing individual CVE “Security Vulnerability” entries from leaking into the HTML detail table by setting AddHtmlDetailRow = $false in relevant analyzers.
Changes:
- Updated HTML text formatting logic (
GetHtmlTextValue) to preserve<br>and converthttp(s)://URLs into safe<a ...>links. - Suppressed HTML detail-row output for multiple Security Vulnerability analyzers via
AddHtmlDetailRow = $false. - Added/expanded Pester coverage (unit + integration-style assertions) and introduced test helpers to validate HTML report structure and CVE rollups.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| Diagnostics/HealthChecker/Analyzer/Add-AnalyzedResultInformation.ps1 | Enhances HTML text processing to preserve <br> and hyperlink URLs; adds Pester extract markers for testability. |
| Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityADV24199947.ps1 | Prevents ADV24199947 from creating per-CVE HTML detail rows. |
| Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCve-2022-21978.ps1 | Prevents CVE-2022-21978 from creating per-CVE HTML detail rows (but see blocking null-check bug comment). |
| Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCve-2022-41040.NotPublished.ps1 | Prevents CVE-2022-41040 from creating per-CVE HTML detail rows. |
| Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCveAddressedBySerializedDataSigning.ps1 | Prevents serialized-data-signing CVE entry from creating per-CVE HTML detail rows. |
| Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityCveAndOverrideCheck.ps1 | Prevents override-based CVE entries from creating per-CVE HTML detail rows. |
| Diagnostics/HealthChecker/Analyzer/Security/Invoke-AnalyzerSecurityExtendedProtectionConfigState.ps1 | Prevents EP-related “Security Vulnerability” entries from leaking into HTML detail rows. |
| Diagnostics/HealthChecker/Tests/HealthChecker.E19.Main.Tests.ps1 | Adds unit tests for GetHtmlTextValue and HTML structure/CVE rollup validations. |
| Diagnostics/HealthChecker/Tests/HealthCheckerTests.ImportCode.NotPublished.ps1 | Adds helper accessors for HtmlServerValues to support new HTML tests. |
Comment on lines
+297
to
+298
| # The regular CVE path sets AddHtmlDetailRow = $false, but the override CVE path | ||
| # in Invoke-AnalyzerSecurityCveAndOverrideCheck.ps1 is missing it. |
lusassl-msft
approved these changes
Jun 5, 2026
Member
Author
|
/azp run |
|
Azure Pipelines successfully started running 1 pipeline(s). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes three HTML report rendering issues:
<a>hyperlinks withtarget=_blankandrel=noopener noreferrer<br>Tag Preservation — Fixes a regression from PR Handle HTML text including greater and less than symbols #2475 where<br>tags (used in the Security Vulnerabilities summary row) were being HTML-encoded to<br>AddHtmlDetailRow = $falseto 9 Security Vulnerability entries across 6 files that were leaking individual CVE rows into the HTML detail table instead of only appearing in the rolled-up summaryFiles Changed
Fixes
Add-AnalyzedResultInformation.ps1— URL-to-hyperlink conversion and<br>preservation inGetHtmlTextValue; added Pester extract markers for testabilityInvoke-AnalyzerSecurityADV24199947.ps1— AddedAddHtmlDetailRow = $falseInvoke-AnalyzerSecurityCve-2022-21978.ps1— AddedAddHtmlDetailRow = $falseInvoke-AnalyzerSecurityCve-2022-41040.NotPublished.ps1— AddedAddHtmlDetailRow = $falseInvoke-AnalyzerSecurityCveAddressedBySerializedDataSigning.ps1— AddedAddHtmlDetailRow = $falseInvoke-AnalyzerSecurityCveAndOverrideCheck.ps1— AddedAddHtmlDetailRow = $falseInvoke-AnalyzerSecurityExtendedProtectionConfigState.ps1— AddedAddHtmlDetailRow = $false(4 locations)Tests
HealthChecker.E19.Main.Tests.ps1— 15 new tests: 11 unit tests forGetHtmlTextValue(encoding,<br>preservation, URL conversion, trailing punctuation) and 4 integration tests for HTML report structure and CVE renderingHealthCheckerTests.ImportCode.NotPublished.ps1— AddedGetHtmlServerDetailandGetHtmlOverviewValuetest helpersTesting
Fixes #532