address PR review feedback

Harden numeric-entity icon sanitization across all five standalone report templates by decoding entity-only input to text before HTML escaping. Add regression coverage for encoded tags, benign glyphs, mixed markup, and malformed entities.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 741453d1-2d59-4081-bed7-c95fe7fe8646

Author: priyanshu92

plugins/power-pages/agents/assets/data-model-plan.html

@@ -265,7 +265,18 @@ <h2>ER Diagram</h2>
 
 function safeIcon(value) {
   const icon = String(value ?? '');
-  return /^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon) ? icon : esc(icon);
+  if (!/^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon)) return esc(icon);
+
+  let valid = true;
+  const decoded = icon.replace(/&#(?:x([0-9a-f]+)|(\d+));/gi, (_, hex, decimal) => {
+    const codePoint = Number.parseInt(hex || decimal, hex ? 16 : 10);
+    if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) {
+      valid = false;
+      return '';
+    }
+    return String.fromCodePoint(codePoint);
+  });
+  return valid ? esc(decoded) : esc(icon);
 }
 
 function safeStatus(value) {

plugins/power-pages/agents/assets/permissions-plan.html

@@ -250,7 +250,18 @@ <h3>Legend</h3>
 
 function safeIcon(value) {
   const icon = String(value ?? '');
-  return /^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon) ? icon : esc(icon);
+  if (!/^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon)) return esc(icon);
+
+  let valid = true;
+  const decoded = icon.replace(/&#(?:x([0-9a-f]+)|(\d+));/gi, (_, hex, decimal) => {
+    const codePoint = Number.parseInt(hex || decimal, hex ? 16 : 10);
+    if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) {
+      valid = false;
+      return '';
+    }
+    return String.fromCodePoint(codePoint);
+  });
+  return valid ? esc(decoded) : esc(icon);
 }
 
 function safeScope(value) {

plugins/power-pages/scripts/tests/render-generated-plan-security.test.js

@@ -8,6 +8,15 @@ const { spawnSync } = require('node:child_process');
 
 const scriptsDir = path.join(__dirname, '..');
 const attack = '<img src=x onerror="globalThis.pwned=1"> \' "</script><script>globalThis.pwned=2</script> ` ${globalThis.pwned=3}';
+const encodedTagAttack = [...'<img src=x onerror="globalThis.pwned=1">']
+  .map(character => `&#${character.codePointAt(0)};`)
+  .join('');
+const ICON_RATIONALE_DATA = [
+  { icon: encodedTagAttack, title: 'Encoded tag', desc: 'Must render as text.' },
+  { icon: '&#9881;', title: 'Numeric glyph', desc: 'Must render as a glyph.' },
+  { icon: '&#9881;<img src=x>', title: 'Mixed input', desc: 'Must remain escaped text.' },
+  { icon: '&#xZZ;', title: 'Malformed entity', desc: 'Must remain escaped text.' },
+];
 
 const DATA_MODEL_DATA = {
   SITE_NAME: 'Contoso Portal',
@@ -259,6 +268,66 @@ test('data model plan normalizes unexpected statuses for stats, cards, and SVG c
   assert.ok(Object.values(attributes).every(value => value !== undefined && value !== 'undefined'));
 });
 
+test('all icon renderers decode numeric glyphs to text before HTML escaping', () => {
+  const reports = [
+    {
+      script: 'render-data-model-plan.js',
+      data: { ...DATA_MODEL_DATA, RATIONALE_DATA: ICON_RATIONALE_DATA },
+      options: { skipMermaid: true },
+    },
+    {
+      script: 'render-permissions-plan.js',
+      data: { ...PERMISSIONS_DATA, RATIONALE_DATA: ICON_RATIONALE_DATA },
+    },
+    {
+      script: 'render-backend-plan.js',
+      data: {
+        SITE_NAME: 'Contoso Portal',
+        PLAN_TITLE: 'Backend Integration Plan',
+        SUMMARY: 'Backend plan.',
+        ITEMS_DATA: [],
+        RATIONALE_DATA: ICON_RATIONALE_DATA,
+        DATA_FLOWS_DATA: [],
+      },
+    },
+    {
+      script: 'render-serverlogic-plan.js',
+      data: {
+        SITE_NAME: 'Contoso Portal',
+        PLAN_TITLE: 'Server Logic Plan',
+        SUMMARY: 'Server logic plan.',
+        WEB_ROLES_DATA: [],
+        SERVER_LOGICS_DATA: [],
+        RATIONALE_DATA: ICON_RATIONALE_DATA,
+        SECRETS_DATA: null,
+      },
+    },
+    {
+      script: 'render-cloudflow-plan.js',
+      data: {
+        SITE_NAME: 'Contoso Portal',
+        PLAN_TITLE: 'Cloud Flow Plan',
+        SUMMARY: 'Cloud flow plan.',
+        WEB_ROLES_DATA: [],
+        CLOUD_FLOWS_DATA: [],
+        RATIONALE_DATA: ICON_RATIONALE_DATA,
+      },
+    },
+  ];
+
+  for (const report of reports) {
+    const html = render(report.script, report.data);
+    const elements = executeInlineRenderer(html, report.options);
+    const rendered = elements.get('rationaleContainer').innerHTML;
+
+    assert.doesNotMatch(rendered, /<img\b/i, report.script);
+    assert.match(rendered, /&lt;img src=x onerror=&quot;globalThis\.pwned=1&quot;&gt;/, report.script);
+    assert.match(rendered, /<div class="principle-icon">⚙<\/div>/, report.script);
+    assert.match(rendered, /&amp;#9881;&lt;img src=x&gt;/, report.script);
+    assert.match(rendered, /&amp;#xZZ;/, report.script);
+  }
+});
+
 test('permissions plan neutralizes hostile text, event attributes, quotes, and interpolation syntax', () => {
   const hostile = {
     ...PERMISSIONS_DATA,

plugins/power-pages/skills/add-cloud-flow/assets/cloud-flow-plan.html

@@ -143,7 +143,18 @@ <h2>Cloud Flows</h2>
 function esc(str) { const d = document.createElement('div'); d.textContent = str == null ? '' : String(str); return d.innerHTML; }
 function safeIcon(value) {
   const icon = String(value ?? '');
-  return /^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon) ? icon : esc(icon);
+  if (!/^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon)) return esc(icon);
+
+  let valid = true;
+  const decoded = icon.replace(/&#(?:x([0-9a-f]+)|(\d+));/gi, (_, hex, decimal) => {
+    const codePoint = Number.parseInt(hex || decimal, hex ? 16 : 10);
+    if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) {
+      valid = false;
+      return '';
+    }
+    return String.fromCodePoint(codePoint);
+  });
+  return valid ? esc(decoded) : esc(icon);
 }
 function safeColor(value) { return /^#[0-9a-f]{6}$/i.test(String(value ?? '')) ? value : '#8890a4'; }
 

plugins/power-pages/skills/add-server-logic/assets/serverlogic-plan.html

@@ -174,7 +174,18 @@ <h2>Server Logic</h2>
 function esc(str) { const d = document.createElement('div'); d.textContent = str == null ? '' : String(str); return d.innerHTML; }
 function safeIcon(value) {
   const icon = String(value ?? '');
-  return /^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon) ? icon : esc(icon);
+  if (!/^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon)) return esc(icon);
+
+  let valid = true;
+  const decoded = icon.replace(/&#(?:x([0-9a-f]+)|(\d+));/gi, (_, hex, decimal) => {
+    const codePoint = Number.parseInt(hex || decimal, hex ? 16 : 10);
+    if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) {
+      valid = false;
+      return '';
+    }
+    return String.fromCodePoint(codePoint);
+  });
+  return valid ? esc(decoded) : esc(icon);
 }
 function safeColor(value) { return /^#[0-9a-f]{6}$/i.test(String(value ?? '')) ? value : '#8890a4'; }
 

plugins/power-pages/skills/integrate-backend/assets/backend-plan.html

@@ -261,7 +261,18 @@ <h2>Integration Items</h2>
 function esc(str) { const d = document.createElement('div'); d.textContent = str == null ? '' : String(str); return d.innerHTML; }
 function safeIcon(value) {
   const icon = String(value ?? '');
-  return /^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon) ? icon : esc(icon);
+  if (!/^(?:&#(?:x[0-9a-f]+|\d+);)+$/i.test(icon)) return esc(icon);
+
+  let valid = true;
+  const decoded = icon.replace(/&#(?:x([0-9a-f]+)|(\d+));/gi, (_, hex, decimal) => {
+    const codePoint = Number.parseInt(hex || decimal, hex ? 16 : 10);
+    if (codePoint > 0x10ffff || (codePoint >= 0xd800 && codePoint <= 0xdfff)) {
+      valid = false;
+      return '';
+    }
+    return String.fromCodePoint(codePoint);
+  });
+  return valid ? esc(decoded) : esc(icon);
 }
 function safeUrl(value) {
   try {