From f6029372ef9b1c8c89fd991e96f3dae03e4f6dd2 Mon Sep 17 00:00:00 2001
From: Sergey <sbartasevich@gmail.com>
Date: Fri, 3 Jul 2026 11:06:04 +0300
Subject: [PATCH] fix(telegram): escape journal html content

---
 app/src/telegram/handlers/journal.py    |  4 ++--
 app/src/telegram/handlers/journal_ui.py | 13 +++++++++----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/app/src/telegram/handlers/journal.py b/app/src/telegram/handlers/journal.py
index c3cf3b0..158cf02 100644
--- a/app/src/telegram/handlers/journal.py
+++ b/app/src/telegram/handlers/journal.py
@@ -183,7 +183,7 @@ async def _show_journal_page(
             await target_message.edit_text(
                 text,
                 reply_markup=kb,
-                parse_mode=None,
+                parse_mode="HTML",
             )
         except TelegramBadRequest as exc:
             if "message is not modified" in str(exc).lower():
@@ -198,7 +198,7 @@ async def _show_journal_page(
     sent_message = await target_message.answer(
         text,
         reply_markup=kb,
-        parse_mode=None,
+        parse_mode="HTML",
     )
     _register_journal_screen(sent_message)
 
diff --git a/app/src/telegram/handlers/journal_ui.py b/app/src/telegram/handlers/journal_ui.py
index 9d8c431..c90848d 100644
--- a/app/src/telegram/handlers/journal_ui.py
+++ b/app/src/telegram/handlers/journal_ui.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from datetime import datetime
+from html import escape
 from zoneinfo import ZoneInfo
 
 from aiogram.types import InlineKeyboardMarkup
@@ -67,6 +68,10 @@ def build_keyboard(
     return kb.as_markup()
 
 
+def _html(value: object) -> str:
+    return escape(str(value or ""), quote=False)
+
+
 def build_actions_keyboard() -> InlineKeyboardMarkup:
     # Первый экран экспорта: выбираем, что именно экспортировать.
     kb = InlineKeyboardBuilder()
@@ -233,8 +238,8 @@ def _render_auto_signal(
 ) -> list[str]:
     level = str(event.get("level") or "INFO").upper()
     icon = LEVEL_ICONS.get(level, "•")
-    title = _event_title(event.get("event_type"))
-    message = _humanize_message(event.get("message"))
+    title = _html(_event_title(event.get("event_type")))
+    message = _html(_humanize_message(event.get("message")))
 
     lines = [
         f"{icon} <b>{level}</b> · {title}",
@@ -253,8 +258,8 @@ def _render_default_event(
 ) -> list[str]:
     level = str(event.get("level") or "INFO").upper()
     icon = LEVEL_ICONS.get(level, "•")
-    title = _event_title(event.get("event_type"))
-    message = _humanize_message(event.get("message"))
+    title = _html(_event_title(event.get("event_type")))
+    message = _html(_humanize_message(event.get("message")))
 
     lines = [
         f"{icon} <b>{level}</b> · {title}",