SUMMARY Notification content is parsed, interpreted and rendered as HTML. This results in various applications breaking notifications, trying to show a message that contains the character "<", for example: "Notification Test <gotcha - You can't see this" This also sounds like a bit of a security risk: essentially I can trigger rendering bugs (just thinking of WebKit's security track record) by sending people direct messages now, which will cause HTML content to be rendered on their systems.
Webkit is not used. It's QTextDocument's very very limited HTML rendering, and even within that we sanitize the input even more to be a subset. Can you tell me which app is sending the '<'?
The notifications in this example are triggered by Firefox. I'd expect it not to be able to show links within a notification, change the style or load an image either. Frankly, I'd like to suggest to html-sanitize the entire notification and disable HTML rendering altogether, at least for "external" notifications.