Conversation
Added an /export command allowing users to download their saved articles as a markdown file (.md). The command fetches up to 500 articles and generates the file in-memory using io.BytesIO. Updated commands list in English and Russian, and added translation keys. Co-authored-by: AminSS99 <139346033+AminSS99@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request introduces a new feature that enables users to export their saved articles from the bot into a Markdown file. This enhancement provides users with a convenient way to retrieve and store their curated content outside the application, improving data portability and user experience by allowing offline access or integration with other tools. Highlights
Changelog
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a new "/export" command, allowing users to download their saved articles as a Markdown file. However, it contains a Markdown injection vulnerability because user-provided article titles and URLs are embedded into the Markdown file without proper escaping, which could allow for the injection of arbitrary Markdown content. Additionally, the review addresses improving maintainability and correctness by moving hardcoded text to translation files and refactoring a repeated filename into a constant.
| # Format articles into Markdown | ||
| lines = ["# " + ("Saved Articles" if user_lang == 'en' else "Сохраненные статьи"), ""] | ||
| for i, article in enumerate(articles, 1): | ||
| title = article.get('title', 'Untitled') |
There was a problem hiding this comment.
The article title is used directly in a Markdown link on line 670. If a title contains special Markdown characters (e.g., [ or ]), it can break the formatting of the exported file. You should escape the title to ensure the output is always valid.
To fix this, first add from .security_utils import escape_markdown_v1 with the other imports at the top of the function (around line 650), and then apply this suggestion.
title = escape_markdown_v1(article.get('title', 'Untitled'))| from .user_storage import get_saved_articles, get_user_language | ||
| from .translations import t | ||
| import io | ||
|
|
||
| telegram_id = update.effective_user.id | ||
| user_lang = get_user_language(telegram_id) | ||
| articles = get_saved_articles(telegram_id, limit=500) | ||
|
|
||
| if not articles: | ||
| await update.message.reply_text(t('export_empty', user_lang), parse_mode='Markdown') | ||
| return | ||
|
|
||
| # Format articles into Markdown | ||
| lines = ["# " + ("Saved Articles" if user_lang == 'en' else "Сохраненные статьи"), ""] | ||
| for i, article in enumerate(articles, 1): | ||
| title = article.get('title', 'Untitled') | ||
| url = article.get('url', '') | ||
| category = article.get('category', 'tech') | ||
| date_str = article.get('saved_at', '')[:10] | ||
|
|
||
| line = f"{i}. [{title}]({url}) - *{category}*" |
There was a problem hiding this comment.
This section contains a Markdown injection vulnerability because user-provided article titles and URLs are directly embedded into Markdown link syntax without proper escaping. This could allow for the injection of arbitrary Markdown content. To remediate this, escape special Markdown characters in the title and url fields using escape_markdown_v1. Additionally, the Markdown file header is hardcoded for English and Russian; for better internationalization, this string should be moved to translations.py using a key like export_title.
from .user_storage import get_saved_articles, get_user_language
from .translations import t
from .security_utils import escape_markdown_v1
import io
telegram_id = update.effective_user.id
user_lang = get_user_language(telegram_id)
articles = get_saved_articles(telegram_id, limit=500)
if not articles:
await update.message.reply_text(t('export_empty', user_lang), parse_mode='Markdown')
return
# Format articles into Markdown
lines = ["# " + ("Saved Articles" if user_lang == 'en' else "Сохраненные статьи"), ""]
for i, article in enumerate(articles, 1):
title = escape_markdown_v1(article.get('title', 'Untitled'))
url = article.get('url', '')
category = article.get('category', 'tech')
date_str = article.get('saved_at', '')[:10]
line = f"{i}. [{title}]({url}) - *{category}*"| # Create file-like object | ||
| file_obj = io.BytesIO(markdown_content.encode('utf-8')) | ||
| file_obj.name = "saved_articles.md" | ||
|
|
||
| await update.message.reply_document( | ||
| document=file_obj, | ||
| filename="saved_articles.md", | ||
| caption=t('export_caption', user_lang, count=len(articles)) | ||
| ) |
There was a problem hiding this comment.
The filename saved_articles.md is hardcoded in multiple places. It's better to define it as a constant once to avoid repetition and improve maintainability.
# Create file-like object
filename = "saved_articles.md"
file_obj = io.BytesIO(markdown_content.encode('utf-8'))
file_obj.name = filename
await update.message.reply_document(
document=file_obj,
filename=filename,
caption=t('export_caption', user_lang, count=len(articles))
)1 participant
Implements a feature to export saved articles as a Markdown file.
/exportinfunctions/telegram_bot.py.get_saved_articlesand streams them to the user via Telegram'sreply_documentinside anio.BytesIObuffer./exportto the English and Russian menus insidesetup_bot_commands.export_emptyandexport_captiontofunctions/translations.py.PR created automatically by Jules for task 5192149412159704075 started by @AminSS99