notification: Escape the body text of the markup-body when re-seriali…

…zing Similar to #1545, otherwise they'll be emitted unescaped, changing the meaning of the notification body. Fixes: ebff872 "notification: Add new property markup-body to support markup" Signed-off-by: Simon McVittie <[email protected]>
flatpak · Feb 14, 2025 · f8021a4 · f8021a4
1 parent b8bb1e0
commit f8021a4
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/src/notification.c b/src/notification.c
@@ -253,7 +253,15 @@ markup_parser_text (GMarkupParseContext  *context,
 {
   GString *composed = user_data;
 
-  g_string_append_len (composed, text, text_len);
+  while (text_len > 0)
+    {
+      gsize len = MIN (text_len, G_MAXSSIZE);
+      g_autofree char *escaped = g_markup_escape_text (text, len);
+
+      g_string_append (composed, escaped);
+      text_len -= len;
+      text += len;
+    }
 }
 
 static void