Cybersecurity-Projects/PROJECTS/beginner/canary-token-generator/backend/internal/notify/telegram
CarterPerez-dev 41b9d2c911 fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup
Audit catch (code-reviewer agent). formatGeo emitted literal `(` and `)`
around the geo block (e.g. `(Toronto, CA)`), but `(` and `)` are in the
MarkdownV2 reserved set when used outside `[text](url)` link delimiter
positions. Telegram would reject the entire message with
`Bad Request: can't parse entities: Character '(' is reserved`.

Fix: write the wrapping parens as `\(` and `\)` literals in the three
parens-construction switch arms. The dynamic field values inside still
flow through EscapeMD as before. The `[View full event timeline](url)`
inline link is left alone — its `(` `)` ARE link delimiters and per V2
rules must NOT be escaped (only `)` and `\` inside the URL portion need
escapes, and our manage URL has neither).

Regression test: TestSender_Send_MessageContainsKeyFields now asserts
`require.Contains(text, \\(Toronto, CA\\))` so substring matching can't
hide future regressions on the wrapping parens.
2026-05-14 00:47:08 -04:00
..
sender.go fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup 2026-05-14 00:47:08 -04:00
sender_test.go fix(canary-phase10): escape geo wrapping parens for MarkdownV2 before rollup 2026-05-14 00:47:08 -04:00