fix

Author: Matrix86

filters/telegrambot.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"html"
 	"io"
 	"net/http"
 	"os"
@@ -21,6 +22,33 @@ import (
 	"github.com/Matrix86/driplane/data"
 )
 
+// telegramTemplateFuncs returns sprig's funcs plus telegram-specific helpers.
+//
+// Extra funcs:
+//   - htmlEscape: escapes <, >, &, " for Telegram HTML parse_mode.
+//   - mdv2Escape: escapes the MarkdownV2 reserved set (_*[]()~`>#+-=|{}.!).
+func telegramTemplateFuncs() template.FuncMap {
+	fm := sprig.FuncMap()
+	fm["htmlEscape"] = html.EscapeString
+	fm["mdv2Escape"] = escapeMarkdownV2
+	return fm
+}
+
+// escapeMarkdownV2 escapes every reserved character defined by Telegram's
+// MarkdownV2 parse_mode. See https://core.telegram.org/bots/api#markdownv2-style
+func escapeMarkdownV2(s string) string {
+	const reserved = "_*[]()~`>#+-=|{}.!"
+	var b strings.Builder
+	b.Grow(len(s))
+	for _, r := range s {
+		if strings.ContainsRune(reserved, r) {
+			b.WriteByte('\\')
+		}
+		b.WriteRune(r)
+	}
+	return b.String()
+}
+
 // TelegramBot is a Filter to perform Bot API actions on top of the telegrambot feeder.
 type TelegramBot struct {
 	Base
@@ -109,7 +137,7 @@ func (f *TelegramBot) compileTemplates() error {
 		if !ok || v == "" {
 			continue
 		}
-		tpl, err := template.New("telegrambot:" + e.key).Funcs(sprig.FuncMap()).Parse(v)
+		tpl, err := template.New("telegrambot:" + e.key).Funcs(telegramTemplateFuncs()).Parse(v)
 		if err != nil {
 			return fmt.Errorf("telegrambot: invalid template for %q: %w", e.key, err)
 		}

filters/telegrambot_test.go

@@ -332,6 +332,44 @@ func TestTelegramBotResolveParseMode(t *testing.T) {
 	}
 }
 
+func TestTelegramBotTemplateHTMLEscape(t *testing.T) {
+	f := newTestFilter(t, map[string]string{
+		"action":  "send_message",
+		"to_chat": "1",
+		"text":    `{{ htmlEscape .raw }}`,
+	})
+	mock := newMockBotAPI(t)
+	b, _ := newMockedBot(t, mock)
+	msg := newTestMessage(b, "x", map[string]interface{}{"raw": `<test> & "ok"`})
+	got, err := msg.ApplyPlaceholder(f.text)
+	if err != nil {
+		t.Fatalf("ApplyPlaceholder: %v", err)
+	}
+	want := `&lt;test&gt; &amp; &#34;ok&#34;`
+	if got != want {
+		t.Fatalf("htmlEscape: got %q want %q", got, want)
+	}
+}
+
+func TestTelegramBotTemplateMarkdownV2Escape(t *testing.T) {
+	f := newTestFilter(t, map[string]string{
+		"action":  "send_message",
+		"to_chat": "1",
+		"text":    `{{ mdv2Escape .raw }}`,
+	})
+	mock := newMockBotAPI(t)
+	b, _ := newMockedBot(t, mock)
+	msg := newTestMessage(b, "x", map[string]interface{}{"raw": `a_b*c [d](e) ! .`})
+	got, err := msg.ApplyPlaceholder(f.text)
+	if err != nil {
+		t.Fatalf("ApplyPlaceholder: %v", err)
+	}
+	want := `a\_b\*c \[d\]\(e\) \! \.`
+	if got != want {
+		t.Fatalf("mdv2Escape: got %q want %q", got, want)
+	}
+}
+
 func TestTelegramBotParseReplyMarkup_Empty(t *testing.T) {
 	f := newTestFilter(t, map[string]string{"action": "send_message", "text": "hi", "to_chat": "1"})
 	mock := newMockBotAPI(t)

src_docs/content/doc/filters/telegrambot.md

@@ -30,7 +30,16 @@ Based on [go-telegram/bot](https://github.com/go-telegram/bot).
 | **media_type** | _STRING_ | `document` | `send_media`: one of `photo`, `document`, `video`, `audio`, `voice`, `animation`, `sticker`. Templated. |
 | **reply_markup** | _STRING_ | empty | Raw Bot API JSON. Variant auto-detected by top-level key: `inline_keyboard` → InlineKeyboardMarkup, `keyboard` → ReplyKeyboardMarkup, `remove_keyboard` → ReplyKeyboardRemove, `force_reply` → ForceReply. Templated, then parsed. |
 
-All string parameters support [templates](../../rules/templates/).
+All string parameters support [templates](en/doc/rules/templates/).
+
+In addition to the standard sprig functions, two extra template helpers are exposed for safe text rendering:
+
+| Function | Purpose |
+|---|---|
+| `htmlEscape` | Escapes `<`, `>`, `&`, `"` so user-supplied text can be safely embedded with `parse_mode="HTML"` (the default). Required when the rendered text contains `<`, otherwise Telegram parses it as an HTML tag and rejects the message. |
+| `mdv2Escape` | Escapes the MarkdownV2 reserved set (`` _*[]()~`>#+-=|{}.! ``) for use with `parse_mode="MarkdownV2"`. |
+
+Example: `telegrambot(text="found {{ htmlEscape .main }}")`.
 
 ### Required parameters per action