[SimonFair]

VM Manager issue fix.

Related to OS-877

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 734f278c-4710-4b70-98d1-f008de9ae71e

📥 Commits

Reviewing files that changed from the base of the PR and between 5b0825d and ea17390.

📒 Files selected for processing (2)

• emhttp/plugins/dynamix.vm.manager/include/VMMachines.php
• tests/vm-interface-escaping.php

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

The VM manager adds a UTF-8 HTML-escaping helper, applies it to guest-reported interface values before rendering, and adds a regression test for escaping behavior and source usage.

Changes

VM interface escaping

Layer / File(s)	Summary
Escape interface values emhttp/plugins/dynamix.vm.manager/include/VMMachines.php	Adds vm_manager_escape_html() and applies it to interface names, addresses, and prefixes before rendering. The IPv6 private-address filter runs on the string-cast address.
Validate escaping behavior tests/vm-interface-escaping.php	Adds assertions for markup escaping, invalid UTF-8 handling, and helper usage on interface fields. tests/vm-interface-escaping.php locates and evaluates the helper from the plugin source.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to ea173

Guest-reported VM interface values are escaped before rendering, reducing HTML injection risk without an identified remaining merge-blocking issue.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title identifies the VM Manager but uses the vague phrase "issue fix". It does not describe the HTML escaping or security change.	Use a specific title such as "fix: Escape guest interface data in VM Manager".

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

• Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each network line
Tags become text, neat and fine
Bad bytes stop at the gate
Names and prefixes meet their fate
Green tests mark the safer state}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔧 PR Test Plugin Available

A test plugin has been generated for this PR that includes the modified files.

Version: 2026.09.15.0720
Build: View Workflow Run

📥 Installation Instructions:

Install via Unraid Web UI:

1. Go to Plugins → Install Plugin
2. Copy and paste this URL:

https://preview.dl.unraid.net/pr-plugins/pr-2752/webgui-pr-2752.plg

3. Click Install

Alternative: Direct Download

• 📦 Download PLG
• 📦 Download TXZ

⚠️ Important Notes:

• Testing only: This plugin is for testing PR changes
• Backup included: Original files are automatically backed up
• Easy removal: Files are restored when plugin is removed
• Conflicts: Remove this plugin before installing production updates
• Post-merge behavior: This preview stays available after merge until preview storage expires or it is manually cleaned up

📝 Modified Files:

Click to expand file list

emhttp/plugins/dynamix.vm.manager/include/VMMachines.php

🔄 To Remove:

Navigate to Plugins → Installed Plugins and remove webgui-pr-2752, or run:

plugin remove webgui-pr-2752

---

_{🤖 This comment is automatically generated and will be updated with each new push to this PR.}