fix: decode macOS .mobileconfig payloads, stop decoding script hashes - #42

Updates report rendering for base64-encoded macOS/iOS profiles and script content, alongside export, documentation, test, and version changes.

Changes:

• Centralizes validated base64 text decoding.
• Adds XML rendering, horizontal scrolling, and export cleanup.
• Updates tests, documentation, changelog, and version to 0.7.1.

Suppressed comments (6)

module/Private/ConvertFrom-InforcerBase64Text.ps1:10

• The new helper is not used by every existing report decode path: module/Private/Resolve-InforcerGraphEnrichment.ps1:146-154 still calls lenient Encoding.UTF8.GetString(FromBase64String(...)) for Graph-fetched rulesContent. Graph-enriched comparisons therefore bypass the strict UTF-8/control-byte guard and can still emit replacement characters, so route that call through this helper too.

        Intune base64-encodes both text (scriptContent, rulesContent, the macOS/iOS
        .mobileconfig payload plist) and binary (hashedScriptContent digests, signed
        profiles) — so the property name alone is not a safe test. This decodes and
        verifies the bytes were text, returning $null otherwise so callers keep the
        base64 as-is rather than rendering mojibake.

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• This XML branch is only reached for values in the manual-review renderer. macOS/iOS configuration-profile categories are not routed to manual review, while the normal comparison-row renderer strips __SCRIPT_CODE__ and emits the payload as a plain/truncated table value. Therefore Compare-InforcerEnvironments still does not provide the promised collapsible, XML-highlighted profile; route configuration-profile categories through this path or add XML block rendering to normal comparison rows, with a regression test.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• Please add a regression test for the new XML branch in ConvertTo-InforcerComparisonHtml using a manual-review payload value. The existing comparison-renderer tests cover PowerShell/Bash/JSON paths, but they do not exercise xml-code, View profile, or highlightXML, so a future break in the newly added comparison report path would not be caught.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• This condition treats any decoded value beginning with < as a profile. A PowerShell script commonly starts with a <# block comment, so it will now be labeled View profile and receive XML highlighting instead of script highlighting. Match a plist/XML signature such as <?xml, <plist, or <!DOCTYPE plist rather than any <.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerHtml.ps1:998

• This condition treats any decoded value beginning with < as a profile. A PowerShell script commonly starts with a <# block comment, so it will now be labeled View profile and receive XML highlighting instead of script highlighting. Match a plist/XML signature such as <?xml, <plist, or <!DOCTYPE plist rather than any <.

                            elseif ($trimmed -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $label = 'View profile' }

module/Private/ConvertTo-InforcerSettingRows.ps1:335

• payload is marked as __SCRIPT_CODE__, but categories such as macOS / Configuration Profiles do not satisfy the manual-review routing predicate in Compare-InforcerDocModels.ps1:461-515. Those rows use the ordinary comparison table, where the marker is only stripped; the new XML branch is never reached, so comparison reports lose the collapsible XML block and their newlines collapse. Route payload-bearing non-catalog policies to the code-block path or make comparison rows marker-aware.

            # Decode scripts, rulesContent JSON and .mobileconfig payloads. hashedScriptContent
            # matches this pattern too but is a digest — the helper rejects it.
            if ($prop.Name -match '(?i)scriptContent|rulesContent|^payload$' -and $strVal -is [string]) {
                $decoded = ConvertFrom-InforcerBase64Text -Value $strVal
                if ($decoded) { $strVal = "__SCRIPT_CODE__$decoded" }

• Files reviewed: 15/15 changed files
• Comments generated: 1
• Review effort level: Lite

Suppressed comments (8)

Previously missed (1) — in code that hasn't changed since the last review.

module/Private/ConvertTo-InforcerMarkdown.ps1:48

• Decoded plist content is inserted into Markdown table cells without escaping <, > or &. GFM treats tags such as <plist>, <dict>, and <key> as raw HTML, so the Markdown export will not preserve the profile as literal XML (and an XML declaration may be interpreted as a processing instruction). HTML-escape the cell value before replacing newlines so decoded profiles remain readable and safe.

module/Private/ConvertFrom-InforcerBase64Text.ps1:25

• This length gate rejects valid short text fields. For example, a script body of echo hi encodes as ZWNobyBoaQ== (12 characters), so the helper returns $null and the caller leaves scriptContent as base64 instead of rendering the script. Since this helper is now the common decoder for all script fields, please remove this floor or replace it with a validation that does not discard short valid payloads.

    if ([string]::IsNullOrWhiteSpace($Value) -or $Value.Length -le 20 -or $Value -match '\s') { return $null }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• The new XML path in the comparison renderer is not covered by the added tests: the plist test exercises ConvertTo-InforcerHtml, while no test renders ConvertTo-InforcerComparisonHtml with a __SCRIPT_CODE__<plist... setting. Because this renderer has its own XML classification, CSS, and highlighter, a regression here could pass the suite; add a comparison fixture/assertion for the XML block and preserved profile content.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• This XML branch is only reached for __SCRIPT_CODE__ values in the Manual Review cards. Standard macOS / Configuration Profiles categories are not routed to ManualReview by Compare-InforcerDocModels, so their decoded payload remains in the main comparison table and is displayed as plain/truncated cell text rather than a collapsible, XML-highlighted profile. Route payload profiles to manual review or add payload-aware rendering to comparison rows.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerComparisonHtml.ps1:1351

• The same < prefix check misclassifies PowerShell scripts starting with <# in comparison reports, so those scripts are shown as profiles with XML highlighting. Use the same XML-specific prefix check as the tenant renderer rather than treating every leading < as plist XML.

                        elseif ($trimmedCode -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $codeLabel = 'View profile' }

module/Private/ConvertTo-InforcerHtml.ps1:998

• The new < prefix check also matches PowerShell block-comment prologues such as <# comment-based help #>. A script beginning with comment-based help will therefore be labeled View profile and receive XML highlighting instead of the existing script rendering. Restrict this branch to an XML declaration/DOCTYPE or a plist root so script content is not misclassified.

                            elseif ($trimmed -match '^\s*<') { $codeClass = 'xml-code'; $summaryClass = 'xml-code-summary'; $label = 'View profile' }

module/Private/ConvertTo-InforcerMarkdown.ps1:48

• The decoder explicitly preserves bare CR characters, but this replacement only handles CRLF and LF. A decoded script or plist containing a lone \r can still terminate a GFM row; normalize all line-ending forms before emitting the table.

            $val = $val -replace '\r?\n', '<br>'

module/Private/Get-InforcerComparisonData.ps1:226

• This centralizes decoding for the linked-script path, but Resolve-InforcerGraphEnrichment.ps1 still decodes Graph rulesContent with Encoding.UTF8.GetString(FromBase64String(...)). That lenient path can still emit U+FFFD for invalid bytes when -FetchGraphData is used, so the no-mojibake guarantee and stated replacement of all duplicate decoders are incomplete; route that call through this helper too.

                        $decoded = ConvertFrom-InforcerBase64Text -Value $val
                        if ($decoded) { $val = $decoded }

• Files reviewed: 15/15 changed files
• Comments generated: 0 new
• Review effort level: Lite