fix(telegram): escape journal html content

app/src/telegram/handlers/journal.py

@@ -183,7 +183,7 @@ async def _show_journal_page(
             await target_message.edit_text(
                 text,
                 reply_markup=kb,
-                parse_mode=None,
+                parse_mode="HTML",
             )
         except TelegramBadRequest as exc:
             if "message is not modified" in str(exc).lower():
@@ -198,7 +198,7 @@ async def _show_journal_page(
     sent_message = await target_message.answer(
         text,
         reply_markup=kb,
-        parse_mode=None,
+        parse_mode="HTML",
     )
     _register_journal_screen(sent_message)
 

app/src/telegram/handlers/journal_ui.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from datetime import datetime
+from html import escape
 from zoneinfo import ZoneInfo
 
 from aiogram.types import InlineKeyboardMarkup
@@ -67,6 +68,10 @@ def build_keyboard(
     return kb.as_markup()
 
 
+def _html(value: object) -> str:
+    return escape(str(value or ""), quote=False)
+
+
 def build_actions_keyboard() -> InlineKeyboardMarkup:
     # Первый экран экспорта: выбираем, что именно экспортировать.
     kb = InlineKeyboardBuilder()
@@ -233,8 +238,8 @@ def _render_auto_signal(
 ) -> list[str]:
     level = str(event.get("level") or "INFO").upper()
     icon = LEVEL_ICONS.get(level, "•")
-    title = _event_title(event.get("event_type"))
-    message = _humanize_message(event.get("message"))
+    title = _html(_event_title(event.get("event_type")))
+    message = _html(_humanize_message(event.get("message")))
 
     lines = [
         f"{icon} <b>{level}</b> · {title}",
@@ -253,8 +258,8 @@ def _render_default_event(
 ) -> list[str]:
     level = str(event.get("level") or "INFO").upper()
     icon = LEVEL_ICONS.get(level, "•")
-    title = _event_title(event.get("event_type"))
-    message = _humanize_message(event.get("message"))
+    title = _html(_event_title(event.get("event_type")))
+    message = _html(_humanize_message(event.get("message")))
 
     lines = [
         f"{icon} <b>{level}</b> · {title}",