Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator/backend/internal
CarterPerez-dev 41b9d2c911 fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup
Audit catch (code-reviewer agent). formatGeo emitted literal `(` and `)`
around the geo block (e.g. `(Toronto, CA)`), but `(` and `)` are in the
MarkdownV2 reserved set when used outside `[text](url)` link delimiter
positions. Telegram would reject the entire message with
`Bad Request: can't parse entities: Character '(' is reserved`.

Fix: write the wrapping parens as `\(` and `\)` literals in the three
parens-construction switch arms. The dynamic field values inside still
flow through EscapeMD as before. The `[View full event timeline](url)`
inline link is left alone — its `(` `)` ARE link delimiters and per V2
rules must NOT be escaped (only `)` and `\` inside the URL portion need
escapes, and our manage URL has neither).

Regression test: TestSender_Send_MessageContainsKeyFields now asserts
`require.Contains(text, \\(Toronto, CA\\))` so substring matching can't
hide future regressions on the wrapping parens.
2026-05-14 00:47:08 -04:00
..
admin fix(canary-phase0): address audit findings before phase rollup 2026-05-10 05:37:32 -04:00
config feat(canary): wire event + notify into runtime + create-tier rate limits 2026-05-14 00:31:24 -04:00
core fix(canary): replace //nolint pragmas with explicit error handling 2026-05-13 13:28:44 -04:00
event test(canary): testcontainers integration test for trigger + dedup + retention 2026-05-14 00:32:28 -04:00
health fix(canary): replace //nolint pragmas with explicit error handling 2026-05-13 13:28:44 -04:00
middleware feat(canary): turnstile verifier + middleware 2026-05-13 15:08:37 -04:00
notify fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup 2026-05-14 00:47:08 -04:00
server fix(canary-phase1): clear all post-phase-1 audit observations + header normalization 2026-05-10 06:15:26 -04:00
testutil fix(canary): clear pre-audit lint debt + migrate golangci config to v2 2026-05-12 02:49:56 -04:00
token refactor(canary): consolidate realIP into middleware across 5 generators 2026-05-14 00:31:49 -04:00
turnstile feat(canary): turnstile verifier + middleware 2026-05-13 15:08:37 -04:00