From b0077e64d1affe4f8e3d19db5157f3e17f4bdfd2 Mon Sep 17 00:00:00 2001
From: Gabriel Corona <gabriel.corona@enst-bretagne.fr>
Date: Wed, 14 Aug 2024 20:22:55 +0200
Subject: [PATCH] Escape HTML tags in terminal-based desktop notifications (OSC
 99, OSC 77)

---
 src/Vt102Emulation.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/Vt102Emulation.cpp b/src/Vt102Emulation.cpp
index d12cf62fe..d0f779b63 100644
--- a/src/Vt102Emulation.cpp
+++ b/src/Vt102Emulation.cpp
@@ -1176,8 +1176,9 @@ void Vt102Emulation::processSessionAttributeRequest(const int tokenSize, const u
         const auto hasFocus = _currentScreen->currentTerminalDisplay()->hasFocus();
         KNotification *notification = nullptr;
         if (params.length() >= 3) {
-            notification =
-                KNotification::event(hasFocus ? QStringLiteral("ProcessNotification") : QStringLiteral("ProcessNotificationHidden"), params[1], params[2]);
+            notification = KNotification::event(hasFocus ? QStringLiteral("ProcessNotification") : QStringLiteral("ProcessNotificationHidden"),
+                                                params[1],
+                                                params[2].toHtmlEscaped());
         } else {
             notification = KNotification::event(hasFocus ? QStringLiteral("ProcessNotification") : QStringLiteral("ProcessNotificationHidden"), params[1]);
         }
@@ -1421,7 +1422,7 @@ void Vt102Emulation::processSessionAttributeRequest(const int tokenSize, const u
 
                     notification = KNotification::event(hasFocus ? QStringLiteral("ProcessNotification") : QStringLiteral("ProcessNotificationHidden"),
                                                         fullTitle,
-                                                        notificationState->body,
+                                                        notificationState->body.toHtmlEscaped(),
                                                         iconName);
 
                     KNotification::Urgency resultUrgency = KNotification::Urgency::NormalUrgency;