From 0a294b8bf87d15d4bbc322d64e0de652869ec7c1 Mon Sep 17 00:00:00 2001 From: 3252a8 <3252a8@proton.me> Date: Wed, 3 Jun 2026 09:53:32 +0300 Subject: [PATCH] fix(miniapp): strip HTML tags from web app promo error messages Localized promo errors carry Telegram-style markup, which the web app rendered as literal text. Strip tags and unescape entities before returning the message in the JSON error. --- backend/bot/app/web/webapp/billing.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/backend/bot/app/web/webapp/billing.py b/backend/bot/app/web/webapp/billing.py index 6a3cf16..ef1ec17 100644 --- a/backend/bot/app/web/webapp/billing.py +++ b/backend/bot/app/web/webapp/billing.py @@ -5,6 +5,15 @@ from bot.app.web.webapp.cache_helpers import invalidate_webapp_user_caches from db.dal import message_log_dal +_HTML_TAG_RE = re.compile(r"<[^>]+>") + + +def _plain_text_message(value: Any) -> str: + """Strip Telegram-style HTML markup from a localized message for the web app.""" + text = _HTML_TAG_RE.sub("", str(value)) + return html.unescape(text).strip() + + def _billing_iso_datetime(value: Optional[Any]) -> Optional[str]: if not value: return None @@ -69,7 +78,7 @@ async def apply_promo_route(request: web.Request) -> web.Response: ) if not success: await session.commit() - return _json_error(400, "promo_apply_failed", str(result)) + return _json_error(400, "promo_apply_failed", _plain_text_message(result)) await session.commit() end_date = result if isinstance(result, datetime) else None return web.json_response(