Repository navigation
Escape chat text for Telegram HTML in operator topics - #104
Merged
Merged
Conversation
Messages, nick and bot name are stored raw and sent with parse_mode HTML. A visitor writing «a < b» or a nick with < or & made Telegram reject the message («can't parse entities»), so it never reached the topic. They are escaped before links are made clickable; quotes, links and the bot italics keep working. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
mysubcult
added a commit
to mysubcult/telegram
that referenced
this pull request
Oct 26, 2026
…perChat#98, LiveHelperChat#100, LiveHelperChat#101, LiveHelperChat#104 accepted upstream; fork already had them) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Chat messages, the visitor nick and the bot name are stored raw in LHC. The operator-topic messages send them with
parse_mode: HTMLaftermake_clickable(), which does not escape anything.If a visitor writes
a < b,<something>orx & y, or has a nick containing<or&, Telegram rejects the whole message withBad Request: can't parse entities, and the message never reaches the topic. The same happens when the chat card is posted, since it lists the earlier messages.This PR adds
escapeHtml()(htmlspecialchars,ENT_NOQUOTES). It is applied to the message text, nick and bot name beforemake_clickable()in the visitor-message, bot-message, trigger-click and chat-started paths. Links still become clickable:make_clickable()handles escaped text, and Telegram decodes&insidehref. The bot italics are unchanged.Checked against a real forum topic:
a < b & c > d,<b>not bold</b>, and a URL with?a=1&b=2arrive as plain text, and Telegram detects the URL entity over its full length.🤖 Generated with Claude Code