Notifications: should escape <a href> value

[smcv]

Operating System

n/a, source code inspection

XDG Desktop Portal version

Other

XDG Desktop Portal version (Other)

1.19.1

Desktop Environment

Other

Desktop Environment (Other)

n/a, source code inspection

Expected Behavior

If a client sends for example {"markup-body": <'<a href="&lt;&quot;&gt;">'>}, the href attribute should be re-escaped when emitting the filtered/sanitized markup-body.

Current Behavior

If I'm reading the code correctly, this

+          if (strcmp (attribute_names[i], "href") == 0)
+            {
+              g_string_append_printf (composed, "<a href=\"%s\">", attribute_values[i]);
+              break;
+            }

will emit the attribute unescaped.

Steps to Reproduce

n/a, source code inspection

Anything else we should know?

No response