fix: escape user-controlled data in order.log() and objects_to_hyperlinks()

api/models/order.py

@@ -1,5 +1,6 @@
 # We use custom seeded UUID generation during testing
 import uuid
+from html import escape
 
 from decimal import Decimal
 from decouple import config
@@ -353,7 +354,7 @@ def log(self, event="empty event", level="INFO"):
             level_out_tag = "" if level == "INFO" else "</b>"
             self.logs = (
                 self.logs
-                + f"<tr><td>{timestamp}</td><td>{level_in_tag}{level}{level_out_tag}</td><td>{event}</td></tr>"
+                + f"<tr><td>{timestamp}</td><td>{level_in_tag}{escape(level)}{level_out_tag}</td><td>{escape(event)}</td></tr>"
             )
             self.save(update_fields=["logs"])
         except Exception:

api/utils.py

@@ -1,6 +1,7 @@
 import json
 import logging
 import re
+from html import escape
 from datetime import datetime, timedelta
 from datetime import timezone as datetime_timezone
 
@@ -513,6 +514,7 @@ def objects_to_hyperlinks(logs: str) -> str:
     Used to format pretty logs for the Order admin panel.
     """
     objects = ["LNPayment", "Robot", "Order", "OnchainPayment", "MarketTick"]
+    logs = escape(logs)
     try:
         for obj in objects:
             logs = re.sub(