Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator/backend
CarterPerez-dev 41b9d2c911 fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup
Audit catch (code-reviewer agent). formatGeo emitted literal `(` and `)`
around the geo block (e.g. `(Toronto, CA)`), but `(` and `)` are in the
MarkdownV2 reserved set when used outside `[text](url)` link delimiter
positions. Telegram would reject the entire message with
`Bad Request: can't parse entities: Character '(' is reserved`.

Fix: write the wrapping parens as `\(` and `\)` literals in the three
parens-construction switch arms. The dynamic field values inside still
flow through EscapeMD as before. The `[View full event timeline](url)`
inline link is left alone — its `(` `)` ARE link delimiters and per V2
rules must NOT be escaped (only `)` and `\` inside the URL portion need
escapes, and our manage URL has neither).

Regression test: TestSender_Send_MessageContainsKeyFields now asserts
`require.Contains(text, \\(Toronto, CA\\))` so substring matching can't
hide future regressions on the wrapping parens.
2026-05-14 00:47:08 -04:00
..
cmd feat(canary): wire event + notify into runtime + create-tier rate limits 2026-05-14 00:31:24 -04:00
internal fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup 2026-05-14 00:47:08 -04:00
.air.toml fix(canary-phase1): clear all post-phase-1 audit observations + header normalization 2026-05-10 06:15:26 -04:00
.gitignore fix(canary-phase0): address audit findings before phase rollup 2026-05-10 05:37:32 -04:00
.golangci.yml chore(canary): scope gosec G101/G107/G704 to outbound HTTP packages 2026-05-14 00:32:07 -04:00
config.yaml fix(canary-phase1): clear all post-phase-1 audit observations + header normalization 2026-05-10 06:15:26 -04:00
go.mod feat(canary): event + notify domain — contracts, senders, services 2026-05-14 00:30:42 -04:00
go.sum feat(canary): event + notify domain — contracts, senders, services 2026-05-14 00:30:42 -04:00