feat(mail-overview): build notification bodies

Three rows of author and subject, then +N more, which bounds the
height so a mailing list burst is not a wall. Markup characters are
escaped because dunst renders body markup and a subject is untrusted
text off the internet.

1 files changed, 30 insertions, 0 deletions

diff --git a/mail-overview/mail-notify.sh b/mail-overview/mail-notify.sh
index 1cadce4..ed0c3e3 100755
--- a/mail-overview/mail-notify.sh
+++ b/mail-overview/mail-notify.sh
@@ -80,6 +80,36 @@ parse_accounts() {
     return 0
 }
 
+# Renders notmuch search JSON into notification body text.
+#   $1  the JSON array from `notmuch search --format=json`
+#   $2  the true total for this batch, which may exceed the rows present
+#
+# dunst has body-markup in its capabilities, so a subject containing < or &
+# would be parsed as markup and could vanish from the notification. Subjects
+# are attacker-controlled text arriving from the internet, so the three XML
+# characters are escaped here. This is the one place in this script where
+# untrusted text reaches a renderer.
+#
+# Malformed JSON prints nothing and succeeds. A notification with no body is
+# still worth sending: the summary already carries the account and the count.
+build_body() {
+    local json="$1" total="$2" shown
+
+    local body
+    body="$(printf '%s' "$json" | jq -r '
+        .[] | ((.authors // "(unknown)") + " — " + (.subject // "(no subject)"))
+        | gsub("&"; "&amp;") | gsub("<"; "&lt;") | gsub(">"; "&gt;")
+    ' 2>/dev/null)" || return 0
+    [[ -n "$body" ]] || return 0
+
+    shown="$(printf '%s\n' "$body" | wc -l)"
+    printf '%s' "$body"
+    if [[ "$total" -gt "$shown" ]]; then
+        printf '\n+%d more' "$((total - shown))"
+    fi
+    printf '\n'
+}
+
 main() {
     echo "not implemented"
 }