fix: decode macOS .mobileconfig payloads, stop decoding script hashes

[royklo]

Three rendering bugs, found by reading two generated reports.

• macOS/iOS profiles now show what's in them. payload is a base64 .mobileconfig
  (a plist XML document) and the reports printed the base64 verbatim — 2,300 characters
  that told you a profile existed and nothing about what it configured.
• Script hashes are no longer decoded. hashedScriptContent is a raw digest; the
  decoder matched it on name alongside scriptContent and turned it into
  V<FFFD><FFFD>0…, presented behind a "View script" toggle.
• Code blocks scroll horizontally instead of re-wrapping and breaking lines
  mid-identifier. overflow-x: auto was already declared in both renderers — it was
  dead as long as white-space: pre-wrap sat in front of it.

Shared root cause of the first two: the property name was the only test.
ConvertFrom-InforcerBase64Text now decodes with strict UTF-8 and rejects control bytes,
putting the guard on the decoded bytes. That also covers signed profiles and any future
binary field. The helper replaces all four duplicate inline decode sites.

Turned up while scanning for more of the same: the internal __SCRIPT_CODE__ render
marker leaked into the Markdown and Excel exports, and newlines in decoded content end
the row in a GFM table — silently destroying the rest of the settings table for any
policy with script content.

Docs: module/README.md still said 20 cmdlets (the manifest exports 21 and omitted
Get-InforcerSecureScore), scope labels in API-REFERENCE.md normalised to one spelling,
dead #code-style anchor in CONTRIBUTING.md.

448/0/2 tests, 13 new. Version 0.7.1 — PATCH, the public surface is unchanged.

[Copilot]

🟡 Changes recommended

Unresolved decoder coverage and profile-rendering/type-detection issues remain.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Updates report rendering for base64-encoded macOS/iOS profiles and script content, alongside export, documentation, test, and version changes.

Changes:

• Centralizes validated base64 text decoding.
• Adds XML rendering, horizontal scrolling, and export cleanup.
• Updates tests, documentation, changelog, and version to 0.7.1.

File summaries

File	Change
Tests/Consistency.Tests.ps1	Adds decoding and renderer regression coverage.
module/README.md	Corrects the exported cmdlet count and listing.
module/Private/Get-InforcerComparisonData.ps1	Uses shared decoding logic.
module/Private/Export-InforcerDocExcel.ps1	Removes internal render markers.
module/Private/ConvertTo-InforcerSettingRows.ps1	Decodes textual payload fields.
module/Private/ConvertTo-InforcerMarkdown.ps1	Handles newlines and removes markers.
module/Private/ConvertTo-InforcerHtml.ps1	Adds XML rendering and scrolling.
module/Private/ConvertTo-InforcerComparisonHtml.ps1	Adds comparison XML rendering.
module/Private/ConvertFrom-InforcerBase64Text.ps1	Centralizes base64 text validation.
module/Private/Compare-InforcerDocModels.ps1	Applies shared decoding during comparisons.
module/InforcerCommunity.psd1	Bumps the module version to 0.7.1.
docs/CMDLET-REFERENCE.md	Documents rendering behavior.
docs/API-REFERENCE.md	Normalizes API scope labels.
CONTRIBUTING.md	Fixes the code-style anchor.
CHANGELOG.md	Records the 0.7.1 changes.

Review details

Suppressed comments (6)

module/Private/ConvertFrom-InforcerBase64Text.ps1:10

• The new helper is not used by every existing report decode path: module/Private/Resolve-InforcerGraphEnrichment.ps1:146-154 still calls lenient Encoding.UTF8.GetString(FromBase64String(...)) for Graph-fetched rulesContent. Graph-enriched comparisons therefore bypass the strict UTF-8/control-byte guard and can still emit replacement characters, so route that call through this helper too.

        Intune base64-encodes both text (scriptContent, rulesContent, the macOS/iOS
        .mobileconfig payload plist) and binary (hashedScriptContent digests, signed
        profiles) — so the property name alone is not a safe test. This decodes and
        verifies the bytes were text, returning $null otherwise so callers keep the
        base64 as-is rather than rendering mojibake.

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• This XML branch is only reached for values in the manual-review renderer. macOS/iOS configuration-profile categories are not routed to manual review, while the normal comparison-row renderer strips __SCRIPT_CODE__ and emits the payload as a plain/truncated table value. Therefore Compare-InforcerEnvironments still does not provide the promised collapsible, XML-highlighted profile; route configuration-profile categories through this path or add XML block rendering to normal comparison rows, with a regression test.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• Please add a regression test for the new XML branch in ConvertTo-InforcerComparisonHtml using a manual-review payload value. The existing comparison-renderer tests cover PowerShell/Bash/JSON paths, but they do not exercise xml-code, View profile, or highlightXML, so a future break in the newly added comparison report path would not be caught.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• This condition treats any decoded value beginning with < as a profile. A PowerShell script commonly starts with a <# block comment, so it will now be labeled View profile and receive XML highlighting instead of script highlighting. Match a plist/XML signature such as <?xml, <plist, or <!DOCTYPE plist rather than any <.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerHtml.ps1:998

• This condition treats any decoded value beginning with < as a profile. A PowerShell script commonly starts with a <# block comment, so it will now be labeled View profile and receive XML highlighting instead of script highlighting. Match a plist/XML signature such as <?xml, <plist, or <!DOCTYPE plist rather than any <.

                            elseif ($trimmed -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $label = 'View profile' }

module/Private/ConvertTo-InforcerSettingRows.ps1:335

• payload is marked as __SCRIPT_CODE__, but categories such as macOS / Configuration Profiles do not satisfy the manual-review routing predicate in Compare-InforcerDocModels.ps1:461-515. Those rows use the ordinary comparison table, where the marker is only stripped; the new XML branch is never reached, so comparison reports lose the collapsible XML block and their newlines collapse. Route payload-bearing non-catalog policies to the code-block path or make comparison rows marker-aware.

            # Decode scripts, rulesContent JSON and .mobileconfig payloads. hashedScriptContent
            # matches this pattern too but is a digest — the helper rejects it.
            if ($prop.Name -match '(?i)scriptContent|rulesContent|^payload$' -and $strVal -is [string]) {
                $decoded = ConvertFrom-InforcerBase64Text -Value $strVal
                if ($decoded) { $strVal = "__SCRIPT_CODE__$decoded" }

• Files reviewed: 15/15 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Eight unresolved moderate findings affect decoding, comparison rendering, and Markdown export.

Review details

Suppressed comments (8)

Previously missed (1) — in code that hasn't changed since the last review.

module/Private/ConvertTo-InforcerMarkdown.ps1:48

• Decoded plist content is inserted into Markdown table cells without escaping <, > or &. GFM treats tags such as <plist>, <dict>, and <key> as raw HTML, so the Markdown export will not preserve the profile as literal XML (and an XML declaration may be interpreted as a processing instruction). HTML-escape the cell value before replacing newlines so decoded profiles remain readable and safe.

module/Private/ConvertFrom-InforcerBase64Text.ps1:25

• This length gate rejects valid short text fields. For example, a script body of echo hi encodes as ZWNobyBoaQ== (12 characters), so the helper returns $null and the caller leaves scriptContent as base64 instead of rendering the script. Since this helper is now the common decoder for all script fields, please remove this floor or replace it with a validation that does not discard short valid payloads.

    if ([string]::IsNullOrWhiteSpace($Value) -or $Value.Length -le 20 -or $Value -match '\s') { return $null }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• The new XML path in the comparison renderer is not covered by the added tests: the plist test exercises ConvertTo-InforcerHtml, while no test renders ConvertTo-InforcerComparisonHtml with a __SCRIPT_CODE__<plist... setting. Because this renderer has its own XML classification, CSS, and highlighter, a regression here could pass the suite; add a comparison fixture/assertion for the XML block and preserved profile content.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• This XML branch is only reached for __SCRIPT_CODE__ values in the Manual Review cards. Standard macOS / Configuration Profiles categories are not routed to ManualReview by Compare-InforcerDocModels, so their decoded payload remains in the main comparison table and is displayed as plain/truncated cell text rather than a collapsible, XML-highlighted profile. Route payload profiles to manual review or add payload-aware rendering to comparison rows.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• The same < prefix check misclassifies PowerShell scripts starting with <# in comparison reports, so those scripts are shown as profiles with XML highlighting. Use the same XML-specific prefix check as the tenant renderer rather than treating every leading < as plist XML.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerHtml.ps1:998

• The new < prefix check also matches PowerShell block-comment prologues such as <# comment-based help #>. A script beginning with comment-based help will therefore be labeled View profile and receive XML highlighting instead of the existing script rendering. Restrict this branch to an XML declaration/DOCTYPE or a plist root so script content is not misclassified.

                            elseif ($trimmed -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $label = 'View profile' }

module/Private/ConvertTo-InforcerMarkdown.ps1:48

• The decoder explicitly preserves bare CR characters, but this replacement only handles CRLF and LF. A decoded script or plist containing a lone \r can still terminate a GFM row; normalize all line-ending forms before emitting the table.

            $val = $val -replace '\r?\n', '<br>'

module/Private/Get-InforcerComparisonData.ps1:226

• This centralizes decoding for the linked-script path, but Resolve-InforcerGraphEnrichment.ps1 still decodes Graph rulesContent with Encoding.UTF8.GetString(FromBase64String(...)). That lenient path can still emit U+FFFD for invalid bytes when -FetchGraphData is used, so the no-mojibake guarantee and stated replacement of all duplicate decoders are incomplete; route that call through this helper too.

                        $decoded = ConvertFrom-InforcerBase64Text -Value $val
                        if ($decoded) { $val = $decoded }

• Files reviewed: 15/15 changed files
• Comments generated: 0 new
• Review effort level: Lite