Skip to content

fix(telegram): preserve raw OAuth links in HTML rendering#2485

Open
afjcjsbx wants to merge 1 commit intosipeed:mainfrom
afjcjsbx:fix/telegram-oauth-links
Open

fix(telegram): preserve raw OAuth links in HTML rendering#2485
afjcjsbx wants to merge 1 commit intosipeed:mainfrom
afjcjsbx:fix/telegram-oauth-links

Conversation

@afjcjsbx
Copy link
Copy Markdown
Collaborator

📝 Description

This PR fixes a Telegram rendering bug that could corrupt raw OAuth links before they were sent to users.

In particular, OAuth query parameters containing underscores such as response_type, client_id, redirect_uri, code_challenge, and code_challenge_method could be altered by the Telegram HTML formatting pipeline, resulting in broken authorization URLs. This change preserves raw URLs during Telegram HTML conversion and adds regression tests for Google-style OAuth links and query-parameter escaping.

🗣️ Type of Change

  • 🐞 Bug fix (non-breaking change which fixes an issue)
  • ✨ New feature (non-breaking change which adds functionality)
  • 📖 Documentation update
  • ⚡ Code refactoring (no functional changes, no api changes)

🤖 AI Code Generation

  • 🤖 Fully AI-generated (100% AI, 0% Human)
  • 🛠️ Mostly AI-generated (AI draft, Human verified/modified)
  • 👨‍💻 Mostly Human-written (Human lead, AI assisted or none)

🔗 Related Issue

N/A

📚 Technical Context (Skip for Docs)

  • Reference URL: Telegram Bot API formatting behavior; Google OAuth authorization URL flow
  • Reasoning: The Telegram channel converts outbound content into HTML before sending it. Raw URLs were not isolated before inline formatting rules were applied, so underscores inside OAuth query parameters could be consumed by italic parsing and produce invalid links. This PR extracts raw URLs before formatting, restores them as safe HTML links, and adds regression coverage for this case.

🧪 Test Environment

  • Hardware: Raspberry Pi
  • OS: Debian 12 (Bookworm)
  • Model/Provider:
  • Channels: Telegram

📸 Evidence (Optional)

Click to view Logs/Screenshots
  • Before the fix, OAuth parameters such as response_type and client_id could appear as responsetype and clientid in Telegram messages.
  • After the fix, raw OAuth URLs are preserved and rendered correctly in Telegram.
  • Regression tests were added for:
    • raw OAuth URLs with underscores in query parameters
    • markdown links with query parameters escaped safely in HTML

☑️ Checklist

  • My code/docs follow the style of this project.
  • I have performed a self-review of my own changes.
  • I have updated the documentation accordingly.

@afjcjsbx afjcjsbx requested review from alexhoshina and yinwm April 12, 2026 08:47
@sipeed-bot sipeed-bot bot added type: bug Something isn't working domain: channel labels Apr 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

domain: channel type: bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant