From a0b7df70d694a978dd7433244569883db8358e62 Mon Sep 17 00:00:00 2001
From: CaffeinatedTech <adam@caff.tech>
Date: Fri, 16 Feb 2024 13:36:16 +1000
Subject: [PATCH] Added escaping to enter and exit tags on telegram performance
 messages.

---
 freqtrade/rpc/telegram.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/freqtrade/rpc/telegram.py b/freqtrade/rpc/telegram.py
index f9a0635f0..f28b26766 100644
--- a/freqtrade/rpc/telegram.py
+++ b/freqtrade/rpc/telegram.py
@@ -4,6 +4,7 @@
 This module manage Telegram communication
 """
 import asyncio
+import html
 import json
 import logging
 import re
@@ -1378,7 +1379,7 @@ class Telegram(RPCHandler):
         output = "<b>Entry Tag Performance:</b>\n"
         for i, trade in enumerate(trades):
             stat_line = (
-                f"{i + 1}.\t <code>{trade['enter_tag']}\t"
+                f"{i + 1}.\t <code>{html.escape(trade['enter_tag'])}\t"
                 f"{fmt_coin(trade['profit_abs'], self._config['stake_currency'])} "
                 f"({trade['profit_ratio']:.2%}) "
                 f"({trade['count']})</code>\n")
@@ -1410,7 +1411,7 @@ class Telegram(RPCHandler):
         output = "<b>Exit Reason Performance:</b>\n"
         for i, trade in enumerate(trades):
             stat_line = (
-                f"{i + 1}.\t <code>{trade['exit_reason']}\t"
+                f"{i + 1}.\t <code>{html.escape(trade['exit_reason'])}\t"
                 f"{fmt_coin(trade['profit_abs'], self._config['stake_currency'])} "
                 f"({trade['profit_ratio']:.2%}) "
                 f"({trade['count']})</code>\n")
@@ -1442,7 +1443,7 @@ class Telegram(RPCHandler):
         output = "<b>Mix Tag Performance:</b>\n"
         for i, trade in enumerate(trades):
             stat_line = (
-                f"{i + 1}.\t <code>{trade['mix_tag']}\t"
+                f"{i + 1}.\t <code>{html.escape(trade['mix_tag'])}\t"
                 f"{fmt_coin(trade['profit_abs'], self._config['stake_currency'])} "
                 f"({trade['profit_ratio']:.2%}) "
                 f"({trade['count']})</code>\n")