fixed tag rendering

Modules/Helpdesk/Http/Controllers/TicketCommentStoreController.php

@@ -54,10 +54,10 @@ final class TicketCommentStoreController extends Controller
                 ->where('is_active', true)
                 ->findOrFail((int) $validated['canned_response_id']);
 
-            $body = trim($response->body);
+            $body = trim($renderer->render($response->body, $ticket, $user));
         }
 
-        $body = $this->normaliseHtmlBody($renderer->render($body, $ticket, $user));
+        $body = $this->normaliseHtmlBody($body);
 
         validator(['commentBody' => $body], [
             'commentBody' => ['required', 'string', 'min:2'],
@@ -84,12 +84,40 @@ final class TicketCommentStoreController extends Controller
      */
     private function normaliseHtmlBody(string $body): string
     {
-        $body = html_entity_decode($body, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+        $body = trim($body);
+
+        for ($i = 0; $i < 5; $i++) {
+            if (! str_contains($body, '&lt;') && ! str_contains($body, '&gt;') && ! str_contains($body, '&amp;lt;')) {
+                break;
+            }
+
+            $decoded = html_entity_decode($body, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+
+            if ($decoded === $body) {
+                break;
+            }
+
+            $body = $decoded;
+        }
+
         $body = preg_replace('/<\s*(script|style)[^>]*>.*?<\s*\/\s*\1\s*>/is', '', $body) ?: '';
         $body = preg_replace('/\s+on[a-z]+\s*=\s*("[^"]*"|\'[^\']*\'|[^\s>]+)/i', '', $body) ?: '';
         $body = preg_replace('/javascript\s*:/i', '', $body) ?: '';
+        $body = trim(strip_tags($body, '<p><br><strong><b><em><i><u><ul><ol><li><blockquote><pre><code><a>'));
 
-        return trim(strip_tags($body, '<p><br><strong><b><em><i><u><ul><ol><li><blockquote><pre><code><a>'));
+        if ($body === '') {
+            return '';
+        }
+
+        if ($body === strip_tags($body)) {
+            return collect(preg_split('/\R{2,}/', $body) ?: [])
+                ->map(static fn (string $paragraph): string => trim($paragraph))
+                ->filter(static fn (string $paragraph): bool => $paragraph !== '')
+                ->map(static fn (string $paragraph): string => '<p>'.nl2br(e($paragraph), false).'</p>')
+                ->implode('');
+        }
+
+        return $body;
     }
 
     /**