Show NL instead of BR when displaying spam entry by Crabcyborg · Pull Request #3572 · Strategy11/formidable-forms

Crabcyborg · 2026-10-13T20:37:44Z

Fixes https://github.com/Strategy11/formidable-pro/issues/6841

A spam entry is intentionally fully escaped - no HTML should work for a spam entry.

But this update changes the escapes   tags to \n so line breaks look better.

coderabbitai · 2026-10-13T20:37:55Z

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: Strategy11/formidable-forms/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 067c59e0-ef37-4040-a5bf-8382a64f3785

📥 Commits

Reviewing files that changed from the base of the PR and between 37b7b7a and 6772e97.

📒 Files selected for processing: 2

classes/helpers/FrmSpamEntriesHelper.php
tests/phpunit/misc/test_FrmSpamOutput.php

 ______________________________
< Here's looking at you, code. >
 ------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

deepsource-io · 2026-10-13T20:39:07Z

DeepSource Code Review

We reviewed changes in 37b7b7a...6772e97 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
PHP		Oct 13, 2026 8:37p.m.	Review ↗
JavaScript		Oct 13, 2026 8:37p.m.	Review ↗

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

deepsource-io · 2026-10-13T20:39:09Z

+		$value    = array( 'nested' => array( 'First<br>Second<br/>Third<br />Fourth<img src=x onerror=alert(1)>', '', null, 0 ) );
+		$expected = array( 'nested' => array( "First\nSecond\nThird\nFourth&lt;img src=x onerror=alert(1)&gt;", '', null, 0 ) );
+
+		$this->assertSame( $expected, FrmSpamEntriesHelper::escape_value( $value ), 'Breaks should become newlines without allowing other markup or changing non-string values.' );


Call to an undefined method test_FrmSpamOutput::assertSame()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-13T20:39:09Z

+			)
+		);
+		$normal = FrmEntriesController::show_entry_shortcode( array( 'id' => $id ) );
+		$this->assertTrue( FrmSpamEntriesHelper::mark_as_spam( $id ), 'The entry should be marked as spam.' );


Call to an undefined method test_FrmSpamOutput::assertTrue()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-13T20:39:09Z

+		$spam = FrmEntriesController::show_entry_shortcode( array( 'id' => $id ) );
+
+		if ( $this->is_pro_active ) {
+			$this->assertSame( $spam, do_shortcode( '[frm-show-entry id="' . $id . '"]' ), 'The Pro shortcode should render the same spam entry table.' );


Call to an undefined method test_FrmSpamOutput::assertSame()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-13T20:39:09Z

+		}
+
+		foreach ( array( $normal, $spam ) as $html ) {
+			$this->assertMatchesRegularExpression(


Call to an undefined method test_FrmSpamOutput::assertMatchesRegularExpression()

The method you are trying to call is not defined, which can result in a fatal error.

deepsource-io · 2026-10-13T20:39:09Z

+				$html,
+				'Both normal and spam entries should display the address on separate lines.'
+			);
+			$this->assertStringNotContainsString( '&lt;br', $html, 'Formatting breaks should not appear as literal tags.' );


Call to an undefined method test_FrmSpamOutput::assertStringNotContainsString()

The method you are trying to call is not defined, which can result in a fatal error.

franky-the-going-merry

Approve at 6772e97. No findings.

The fix is correct and does what the issue (formidable-pro#6841) asks for. Spam values are escaped in FrmSpamEntriesHelper::escape_value(), and FrmFieldValue runs it over the already-built display value, which is where the address field's   separators arrive. They were being escaped into visible  . The change turns  ,   and   into a newline before esc_html(), so everything else a spammer submits stays escaped.

Live repro (Playground preview env, Lite + Pro; address field and a textarea, entry marked as spam, rendered through FrmEntriesController::show_entry_shortcode() and [frm-show-entry]):

On master: the Address cell is 123 Main St Baltimore, MD 12345 United States, which is the bug from the issue.
On this PR: the same cell is 123 Main St Baltimore, MD 12345 United States, real line breaks. A textarea value with bold <img src=x onerror=alert(1)> still renders as bold <img src=x onerror=alert(1)> on both, so no markup gets through. The entries list cell for the address reads 123 Main St Baltimore, MD 12345 United States.

Tests: both new tests in test_FrmSpamOutput pass on the PR (5/5, 39 assertions, run in a wordpress-develop checkout with Lite's phpunit.xml and Pro present). With only the one-line change reverted, the two new tests fail. The wider Spam/FrmFieldValue/entries filter shows the same 4 errors with and without the change (the first is test_FrmSpamCompatibility::test_old_addon_blocks_spam_storage), so they come from this local setup, not the PR. I could not read their messages: PHPUnit crashes while printing them.

Not exercised: the admin spam tab in a browser (I rendered the same code paths over HTTP instead), Views and email placeholders that call escape_value() through FrmProContent, where a bare newline will not show as a break unless the output is run through nl2br, and the review skills (a one-line change plus tests, read in full instead). CI is skipping every job except typos, and Psalm and the DeepSource and Scrutinizer checks were still pending when I started.

garretlaxton

This fix works good!

Crabcyborg · 2026-10-14T12:10:04Z

Thank you Garret!

🚀

Show NL instead of BR when displaying spam entry

6772e97

Crabcyborg added priority: high franky-review labels Oct 13, 2026

Crabcyborg added this to the 7.0 milestone Oct 13, 2026

franky-the-going-merry Bot added the franky-working Franky is actively reviewing this label Oct 13, 2026

deepsource-io Bot reviewed Oct 13, 2026

View reviewed changes

franky-the-going-merry Bot approved these changes Oct 13, 2026

View reviewed changes

franky-the-going-merry Bot removed franky-review franky-working Franky is actively reviewing this labels Oct 13, 2026

robin-the-going-merry Bot requested a review from garretlaxton October 13, 2026 21:33

garretlaxton approved these changes Oct 14, 2026

View reviewed changes

Crabcyborg marked this pull request as ready for review October 14, 2026 12:09

Crabcyborg merged commit 20f0d29 into master Oct 14, 2026
57 of 59 checks passed

Crabcyborg deleted the show_nl_instead_of_br_when_displaying_spam_entry branch October 14, 2026 12:10

Navigation Menu

Repository navigation

Show NL instead of BR when displaying spam entry - #3572

Show NL instead of BR when displaying spam entry#3572
Crabcyborg merged 1 commit into
masterfrom
show_nl_instead_of_br_when_displaying_spam_entry

Crabcyborg commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot commented Oct 13, 2026 •

edited

Loading

Uh oh!

deepsource-io Bot Oct 13, 2026

Uh oh!

deepsource-io Bot Oct 13, 2026

Uh oh!

deepsource-io Bot Oct 13, 2026

Uh oh!

deepsource-io Bot Oct 13, 2026

Uh oh!

deepsource-io Bot Oct 13, 2026

Uh oh!

franky-the-going-merry Bot left a comment

Uh oh!

garretlaxton left a comment

Uh oh!

Crabcyborg commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Crabcyborg commented Oct 13, 2026

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

deepsource-io Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

deepsource-io Bot Oct 13, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmSpamOutput::assertSame()

Uh oh!

deepsource-io Bot Oct 13, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmSpamOutput::assertTrue()

Uh oh!

deepsource-io Bot Oct 13, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmSpamOutput::assertSame()

Uh oh!

deepsource-io Bot Oct 13, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmSpamOutput::assertMatchesRegularExpression()

Uh oh!

deepsource-io Bot Oct 13, 2026

Choose a reason for hiding this comment

Call to an undefined method test_FrmSpamOutput::assertStringNotContainsString()

Uh oh!

franky-the-going-merry Bot left a comment

Choose a reason for hiding this comment

Uh oh!

garretlaxton left a comment

Choose a reason for hiding this comment

Uh oh!

Crabcyborg commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

deepsource-io Bot commented Oct 13, 2026 •

edited

Loading