Fatal flaw fixed.

Reviewed-on: #33
Reviewed-by: Miroslavsckaya <miroslavsckaya@noreply.git.skobk.in>
Co-authored-by: Alexey Skobkin <skobkin-ru@ya.ru>
Co-committed-by: Alexey Skobkin <skobkin-ru@ya.ru>

requirements.txt

@@ -1,3 +1,4 @@
+bleach==5.0.1
 certifi==2021.10.8
 charset-normalizer==2.0.12
 decorator==5.1.1
@@ -7,5 +8,7 @@ pyTelegramBotAPI==4.5.0
 python-dotenv==0.20.0
 requests==2.27.1
 sgmllib3k==1.0.0
+six==1.16.0
 urllib3==1.26.9
 validators==0.19.0
+webencodings==0.5.1

telegram.py

@@ -1,5 +1,6 @@
 import time
 
+from bleach.sanitizer import Cleaner
 from logging import Logger
 from telebot import TeleBot
 from telebot.handler_backends import BaseMiddleware
@@ -39,6 +40,7 @@ class CommandProcessor:
         self.bot.infinity_polling()
 
     def __command_help(self, message: Message, data: dict):
+        # pylint: disable=unused-argument
         self.log.debug('__command_help(message=\'%s\', data=\'%s\')', message, data)
         self.bot.reply_to(
             message,
@@ -113,6 +115,12 @@ class Notifier:
         self.log = logger
         self.log.debug('Notifier.__init__(token=\'%s\', logger=%s)', token[:8] + '...', logger)
         self.bot: TeleBot = TeleBot(token)
+        self.html_sanitizer: Cleaner = Cleaner(
+            tags=['b', 'strong', 'i', 'em', 'u', 'ins', 's', 'strike', 'del', 'span', 'tg-spoiler', 'a', 'code', 'pre'],
+            attributes={"a": ["href", "title"]},
+            protocols=['http', 'https'],
+            strip=True,
+        )
 
     def send_updates(self, chat_ids: list[int], updates: list[FeedItem], feed_title: str):
         """Send notification about new items to the user"""
@@ -154,14 +162,18 @@ class Notifier:
             self.sent_counter = 0
         self.sent_counter += 1
 
-    @staticmethod
-    def __format_message(item: FeedItem) -> str:
+    def __format_message(self, item: FeedItem) -> str:
         return (
+            # TODO: Return date when FeedItem starts to return formattable datetime object
             f"<strong><a href=\"{item.url}\">{item.title}</a></strong>\n\n"
-            f"{item.date}\n"
-            # f"{item.description}"
+            f"{self.__sanitize_html(item.description)}"
         )
 
+    def __sanitize_html(self, html: str) -> str:
+        if not html:
+            return ''
+        return self.html_sanitizer.clean(html)
+
 
 class UserAuthMiddleware(BaseMiddleware):
     """Transparently authenticates and registers the user if needed."""