Require textFormat declaration for all Text elements.

shell/plugins/notifications/NotificationLogic.js

@@ -5,8 +5,34 @@ function isChromiumDerived(app, appIcon) {
          source.indexOf("opera") >= 0
 }
 
+// The body renders as StyledText so notifications can use the markup the
+// body-markup capability advertises (see Service.qml). StyledText honours
+// <img src>, and a remote src makes the shell issue an unauthenticated GET
+// with no user action, so image tags go before the renderer sees them.
+//
+// One replace() pass is not enough. String.replace scans left to right once,
+// so a payload spliced inside the literal "<img" prefix reassembles into a
+// live tag out of the surviving halves:
+//
+//   <im<img src="http://a/decoy.png">g src="http://a/beacon.png">
+//     -> <img src="http://a/beacon.png">
+//
+// Repeat to a fixed point. Each pass can only shorten the string, so this
+// terminates.
+function stripImageTags(text) {
+  var current = text
+  var previous
+  do {
+    previous = current
+    // The `$` alternative catches a tag left unterminated at the end of the
+    // string, which the renderer closes for itself.
+    current = current.replace(/<img[^>]*(?:>|$)/gi, "")
+  } while (current !== previous)
+  return current
+}
+
 function sanitizeBody(body, app, appIcon) {
-  var text = String(body || "").replace(/<img[^>]*>/gi, "")
+  var text = stripImageTags(String(body || ""))
   if (!isChromiumDerived(app, appIcon)) return text
 
   return text

shell/plugins/notifications/components/NotificationCard.qml

@@ -133,6 +133,7 @@ BorderSurface {
         // Glyph fallback (Nerd Font character) when no image icon is
         // available. Used by omarchy-notification-send's `-g` flag.
         Text {
+          textFormat: Text.PlainText
           anchors.centerIn: parent
           visible: root.hasGlyph && smallIconImage.status !== Image.Ready
           text: root.glyph
@@ -143,6 +144,7 @@ BorderSurface {
       }
 
       Text {
+        textFormat: Text.PlainText
         Layout.alignment: Qt.AlignVCenter
         visible: root.compactGlyph
         text: root.glyph
@@ -159,6 +161,11 @@ BorderSurface {
         spacing: Style.space(2)
 
         Text {
+          // The spec defines the summary as a single line of plain text, so
+          // AutoText could only ever promote a hostile string to rich text.
+          // The body below is StyledText on purpose — see Service.qml's
+          // bodyMarkupSupported — and is stripped in NotificationLogic.
+          textFormat: Text.PlainText
           Layout.fillWidth: true
           visible: root.summary.length > 0
           text: root.summary