wf-shell icon indicating copy to clipboard operation
wf-shell copied to clipboard

panel: sanitize variables added to markup

Open trigg opened this issue 1 year ago • 8 comments

I've intentionally side-stepped touching command-output as it is fully possible that some users are intentionally writing markup out from a command to the panel.

trigg avatar Jul 30 '24 09:07 trigg

Fixes #266

trigg avatar Jul 30 '24 09:07 trigg

Hi! Thanks for your PR. Current behavior is actually not a bug but a feature because StatusNotifierItem protocol allows markup tags in tooltip text: https://www.freedesktop.org/wiki/Specifications/StatusNotifierItem/Markup/

NamorNiradnug avatar Jul 31 '24 14:07 NamorNiradnug

Interesting, that is an issue.

This came to light because an app (Spotify i believe) was using a loose ampersand which was causing a warning and incorrect label.

trigg avatar Jul 31 '24 14:07 trigg

What if we apply escape_text on tooltip_title only, but not on tooltip_text?

NamorNiradnug avatar Jul 31 '24 16:07 NamorNiradnug

Looking back at the initial bug, yes that would cover it. Might still be scope for the bug to creep back in as the documentation you linked doesn't mention escaping & at all.

trigg avatar Aug 05 '24 09:08 trigg

Looking back at the initial bug, yes that would cover it. Might still be scope for the bug to creep back in as the documentation you linked doesn't mention escaping & at all.

I think that's a good solution then because it's simple and the specification doesn't mean markup for title. Escaping & and other symbols manually would make the code complicated and I don't think it is worth it.

NamorNiradnug avatar Aug 05 '24 17:08 NamorNiradnug

@trigg @NamorNiradnug what should be done with this PR? I have no idea about the notification widget at this point, so I trust you can figure it out between yourselves ;)

ammen99 avatar Nov 04 '25 11:11 ammen99

@trigg @NamorNiradnug what should be done with this PR? I have no idea about the notification widget at this point, so I trust you can figure it out between yourselves ;)

Current solution degrades the support of markup. Hence I think we shouldn't merge it yet.

NamorNiradnug avatar Nov 04 '25 11:11 NamorNiradnug