stripping html from native notifications

js/utils/dom.js

@@ -49,3 +49,17 @@ export function insertAtCursor(myField, myValue) {
     myField.value += myValue;
   }
 }
+
+/**
+ * Returns a string of text with html stripped out.
+ * (https://stackoverflow.com/a/822486/632806)
+ */
+export function stripHtml(text) {
+  if (typeof text !== 'string') {
+    throw new Error('Please provide text as a string.');
+  }
+
+  const el = document.createElement('div');
+  el.innerHTML = text;
+  return el.textContent || el.innerText || '';
+}

js/utils/notification.js

@@ -1,5 +1,6 @@
 import _ from 'underscore';
 import { ipcRenderer } from 'electron';
+import { stripHtml } from './dom';
 
 let unreadNotifCount = 0;
 let unreadChatMsgCount = 0;
@@ -65,12 +66,19 @@ function playNotifSound() {
 }
 
 export function launchNativeNotification(notifTitle = '', options = {}) {
+  if (options.body !== undefined && typeof options.body !== 'string') {
+    throw new Error('If providing a notification body, it must be provided ' +
+      'as a string.');
+  }
+
   const notifOptions = {
     silent: true,
     ...(_.omit(options || {}, 'onclick', 'onerror')),
+    body: options.body ? stripHtml(options.body) : '',
   };
 
-  const notif = new Notification(notifTitle, notifOptions);
+  const title = typeof notifTitle === 'string' ? stripHtml(notifTitle) : notifTitle;
+  const notif = new Notification(title, notifOptions);
 
   if (typeof options.onclick === 'function') {
     notif.addEventListener('click', notifOptions.onclick);