Escape Markdown in Telegram notification titles

workers/paymaster/tests/index.test.ts

@@ -543,7 +543,7 @@ describe('PaymasterWorker', () => {
     /**
      * Arrange
      */
-    const currentDate = new Date();
+    const currentDate = new Date('2005-12-22');
     const paidUntil = new Date(currentDate.getTime());
 
     paidUntil.setMonth(paidUntil.getMonth() + 3);
@@ -590,7 +590,7 @@ describe('PaymasterWorker', () => {
     /**
      * Arrange
      */
-    const currentDate = new Date();
+    const currentDate = new Date('2005-12-22');
     const paidUntil = new Date(currentDate.getTime());
 
     paidUntil.setDate(paidUntil.getDate() + 1);
@@ -647,7 +647,7 @@ describe('PaymasterWorker', () => {
     /**
      * Arrange
      */
-    const currentDate = new Date();
+    const currentDate = new Date('2005-12-22');
     const lastChargeDate = new Date(currentDate.getTime());
 
     lastChargeDate.setMonth(lastChargeDate.getMonth() - 1); // Set last charge date to 1 month ago

workers/telegram/src/templates/event.ts

@@ -1,5 +1,14 @@
 import type { EventsTemplateVariables, TemplateEventData } from 'hawk-worker-sender/types/template-variables';
 
+/**
+ * Escape characters that break Telegram legacy Markdown parsing
+ *
+ * @param text - raw text
+ */
+export function escapeMarkdown(text: string): string {
+  return text.replace(/[_*`[]/g, '\\$&');
+}
+
 /**
  * Return tpl with data substitutions
  *
@@ -17,10 +26,10 @@ export default function render(tplData: EventsTemplateVariables): string {
     location = '\n' + '```\n' + location + '\n```'; // markdown code block
   }
 
-  return ''.concat(event.payload.title,
+  return ''.concat(escapeMarkdown(event.payload.title),
     '\n',
     location || '',
     '\n',
-    `[View details](${eventURL}) `, `| *${tplData.project.name}*`, ` | ${eventInfo.newCount} new (${eventInfo.event.totalCount} total)`
+    `[View details](${eventURL}) `, `| ${escapeMarkdown(tplData.project.name)}`, ` | ${eventInfo.newCount} new (${eventInfo.event.totalCount} total)`
   );
 }

workers/telegram/src/templates/several-events.ts

@@ -1,4 +1,5 @@
 import type { EventsTemplateVariables } from 'hawk-worker-sender/types/template-variables';
+import { escapeMarkdown } from './event';
 
 /**
  * Return tpl with data substitutions
@@ -10,10 +11,10 @@ export default function render(tplData: EventsTemplateVariables): string {
   let message = tplData.events.length + ' new events\n\n';
 
   tplData.events.forEach(({ event, newCount }) => {
-    message += `(${newCount}) ${event.payload.title} \n`;
+    message += `(${newCount}) ${escapeMarkdown(event.payload.title)} \n`;
   });
 
-  message += `\n[View all events](${projectUrl}) | *${tplData.project.name}*`;
+  message += `\n[View all events](${projectUrl}) | ${escapeMarkdown(tplData.project.name)}`;
 
   return message;
 }

workers/telegram/tests/provider.test.ts

@@ -2,7 +2,7 @@ import { EventNotification, SeveralEventsNotification } from 'hawk-worker-sender
 import { DecodedGroupedEvent, ProjectDBScheme } from '@hawk.so/types';
 import TelegramProvider from 'hawk-worker-telegram/src/provider';
 import templates from '../src/templates';
-import EventTpl from '../src/templates/event';
+import EventTpl, { escapeMarkdown } from '../src/templates/event';
 import { ObjectId } from 'mongodb';
 
 /**
@@ -13,6 +13,11 @@ describe('TelegramProvider', () => {
    * Check templates rendering
    */
   describe('templates', () => {
+    it('should escape Markdown entities in event titles', () => {
+      expect(escapeMarkdown('No such file: /home/market_static/*.csv [`x`]'))
+        .toBe('No such file: /home/market\\_static/\\*.csv \\[\\`x\\`]');
+    });
+
     /**
      * Check that rendering of a single event message works without errors
      */