release: New release v5.5.0.

Signed-off-by: Anders Kaseorg <anders@zulip.com>

README.md

@@ -1,13 +1,13 @@
 # Zulip Desktop Client
-[![Build Status](https://travis-ci.org/zulip/zulip-desktop.svg?branch=master)](https://travis-ci.org/zulip/zulip-desktop)
+[![Build Status](https://travis-ci.com/zulip/zulip-desktop.svg?branch=master)](https://travis-ci.com/github/zulip/zulip-desktop)
 [![Windows Build Status](https://ci.appveyor.com/api/projects/status/github/zulip/zulip-desktop?branch=master&svg=true)](https://ci.appveyor.com/project/zulip/zulip-desktop/branch/master)
 [![XO code style](https://img.shields.io/badge/code_style-XO-5ed9c7.svg)](https://github.com/sindresorhus/xo)
 [![project chat](https://img.shields.io/badge/zulip-join_chat-brightgreen.svg)](https://chat.zulip.org)
 
 Desktop client for Zulip. Available for Mac, Linux, and Windows.
 
-<img src="https://i.imgur.com/s1o6TRA.png"/>
-<img src="https://i.imgur.com/vekKnW4.png"/>
+![screenshot](https://i.imgur.com/s1o6TRA.png)
+![screenshot](https://i.imgur.com/vekKnW4.png)
 
 # Download
 Please see the [installation guide](https://zulip.com/help/desktop-app-install-guide).

app/main/index.ts

@@ -6,7 +6,6 @@ import path from 'path';
 import windowStateKeeper from 'electron-window-state';
 
 import * as BadgeSettings from '../renderer/js/pages/preference/badge-settings';
-import * as CertificateUtil from '../renderer/js/utils/certificate-util';
 import * as ConfigUtil from '../renderer/js/utils/config-util';
 import * as ProxyUtil from '../renderer/js/utils/proxy-util';
 import {sentryInit} from '../renderer/js/utils/sentry-util';
@@ -70,7 +69,7 @@ const toggleApp = (): void => {
 
 function createMainWindow(): Electron.BrowserWindow {
 	// Load the previous state with fallback to defaults
-	const mainWindowState: windowStateKeeper.State = windowStateKeeper({
+	mainWindowState = windowStateKeeper({
 		defaultWidth: 1100,
 		defaultHeight: 720,
 		path: `${app.getPath('userData')}/config`
@@ -87,7 +86,8 @@ function createMainWindow(): Electron.BrowserWindow {
 		minWidth: 500,
 		minHeight: 400,
 		webPreferences: {
-			plugins: true,
+			contextIsolation: false,
+			enableRemoteModule: true,
 			nodeIntegration: true,
 			partition: 'persist:webviewsession',
 			webviewTag: true
@@ -222,36 +222,9 @@ app.on('ready', () => {
 		event: Event,
 		webContents: Electron.WebContents,
 		urlString: string,
-		error: string,
-		certificate: Electron.Certificate,
-		callback: (isTrusted: boolean) => void
-	) /* eslint-disable-line max-params */ => {
-		// TODO: The entire concept of selectively ignoring certificate errors
-		// is ill-conceived, and this handler needs to be deleted.
-
+		error: string
+	) => {
 		const url = new URL(urlString);
-		if (url.protocol === 'wss:') {
-			url.protocol = 'https:';
-		}
-
-		const filename = CertificateUtil.getCertificate(encodeURIComponent(url.origin));
-		if (filename !== undefined) {
-			try {
-				const savedCertificate = fs.readFileSync(
-					path.join(`${app.getPath('userData')}/certificates`, filename),
-					'utf8'
-				);
-				if (certificate.data.replace(/[\r\n]/g, '') ===
-					savedCertificate.replace(/[\r\n]/g, '')) {
-					event.preventDefault();
-					callback(true);
-					return;
-				}
-			} catch (error) {
-				console.error(`Error reading certificate file ${filename}:`, error);
-			}
-		}
-
 		dialog.showErrorBox(
 			'Certificate error',
 			`The server presented an invalid certificate for ${url.origin}:
@@ -285,32 +258,6 @@ ${error}`
 		app.quit();
 	});
 
-	// Code to show pdf in a new BrowserWindow (currently commented out due to bug-upstream)
-	// ipcMain.on('pdf-view', (event, url) => {
-	// 	// Paddings for pdfWindow so that it fits into the main browserWindow
-	// 	const paddingWidth = 55;
-	// 	const paddingHeight = 22;
-
-	// 	// Get the config of main browserWindow
-	// 	const mainWindowState = global.mainWindowState;
-
-	// 	// Window to view the pdf file
-	// 	const pdfWindow = new electron.BrowserWindow({
-	// 		x: mainWindowState.x + paddingWidth,
-	// 		y: mainWindowState.y + paddingHeight,
-	// 		width: mainWindowState.width - paddingWidth,
-	// 		height: mainWindowState.height - paddingHeight,
-	// 		webPreferences: {
-	// 			plugins: true,
-	// 			partition: 'persist:webviewsession'
-	// 		}
-	// 	});
-	// 	pdfWindow.loadURL(url);
-
-	// 	// We don't want to have the menu bar in pdf window
-	// 	pdfWindow.setMenu(null);
-	// });
-
 	// Reload full app not just webview, useful in debugging
 	ipcMain.on('reload-full-app', () => {
 		mainWindow.reload();

app/main/linuxupdater.ts

@@ -38,7 +38,7 @@ export async function linuxUpdateNotification(session: Electron.session): Promis
 				LinuxUpdateUtil.setUpdateItem(latestVersion, true);
 			}
 		}
-	} catch (error) {
+	} catch (error: unknown) {
 		logger.error('Linux update error.');
 		logger.error(error);
 	}

app/main/menu.ts

@@ -308,7 +308,7 @@ function getDarwinTpl(props: MenuProps): Electron.MenuItemConstructorOptions[] {
 			enabled: enableMenu,
 			click(_item, focusedWindow) {
 				if (focusedWindow) {
-					sendAction('shortcut');
+					sendAction('show-keyboard-shortcuts');
 				}
 			}
 		}, {
@@ -450,7 +450,7 @@ function getOtherTpl(props: MenuProps): Electron.MenuItemConstructorOptions[] {
 			enabled: enableMenu,
 			click(_item, focusedWindow) {
 				if (focusedWindow) {
-					sendAction('shortcut');
+					sendAction('show-keyboard-shortcuts');
 				}
 			}
 		}, {

app/main/request.ts

@@ -4,7 +4,6 @@ import path from 'path';
 import stream from 'stream';
 import util from 'util';
 
-import escape from 'escape-html';
 import getStream from 'get-stream';
 
 import {ServerConf} from '../renderer/js/utils/domain-util';
@@ -73,7 +72,7 @@ export const _getServerSettings = async (domain: string, session: Electron.sessi
 		// Following check handles both the cases
 		icon: realm_icon.startsWith('/') ? realm_uri + realm_icon : realm_icon,
 		url: realm_uri,
-		alias: escape(realm_name)
+		alias: realm_name
 	};
 };
 
@@ -88,7 +87,7 @@ export const _saveServerIcon = async (url: string, session: Electron.session): P
 		const filePath = generateFilePath(url);
 		await pipeline(response, fs.createWriteStream(filePath));
 		return filePath;
-	} catch (error) {
+	} catch (error: unknown) {
 		logger.log('Could not get server icon.');
 		logger.log(error);
 		logger.reportSentry(error);
@@ -106,7 +105,7 @@ export const _isOnline = async (url: string, session: Electron.session): Promise
 		}));
 		const isValidResponse = response.statusCode >= 200 && response.statusCode < 400;
 		return isValidResponse;
-	} catch (error) {
+	} catch (error: unknown) {
 		logger.log(error);
 		return false;
 	}

app/main/startup.ts

@@ -19,11 +19,7 @@ export const setAutoLaunch = async (AutoLaunchValue: boolean): Promise<void> =>
 			name: 'Zulip',
 			isHidden: false
 		});
-		if (autoLaunchOption) {
-			await ZulipAutoLauncher.enable();
-		} else {
-			await ZulipAutoLauncher.disable();
-		}
+		await (autoLaunchOption ? ZulipAutoLauncher.enable() : ZulipAutoLauncher.disable());
 	} else {
 		app.setLoginItemSettings({
 			openAtLogin: autoLaunchOption,

app/renderer/about.html

@@ -26,8 +26,7 @@
 
             const { app } = require('electron').remote;
             const version_tag = document.querySelector('#version');
-            version_tag.innerHTML = 'v' + app.getVersion();
+            version_tag.textContent = 'v' + app.getVersion();
         </script>
-        <script>require('./js/shared/preventdrag.js')</script>
     </body>
 </html>

app/renderer/css/preference.css

@@ -622,10 +622,6 @@ input.toggle-round:checked + label::after {
     max-width: 100%;
 }
 
-#add-certificate-button {
-    margin: 10px 10px 10px 37px;
-}
-
 .tip {
     background: none;
     padding: 0;

app/renderer/js/components/base.ts

@@ -1,7 +1,7 @@
 export default class BaseComponent {
-	generateNodeFromTemplate(template: string): Element | null {
+	generateNodeFromHTML(html: string): Element | null {
 		const wrapper = document.createElement('div');
-		wrapper.innerHTML = template;
+		wrapper.innerHTML = html;
 		return wrapper.firstElementChild;
 	}
 }

app/renderer/js/components/functional-tab.ts

@@ -1,3 +1,5 @@
+import {htmlEscape} from 'escape-goat';
+
 import Tab, {TabProps} from './tab';
 
 export default class FunctionalTab extends Tab {
@@ -8,19 +10,21 @@ export default class FunctionalTab extends Tab {
 		this.init();
 	}
 
-	template(): string {
-		return `<div class="tab functional-tab" data-tab-id="${this.props.tabIndex}">
-					<div class="server-tab-badge close-button">
-						<i class="material-icons">close</i>
-					</div>
-					<div class="server-tab">
-						<i class="material-icons">${this.props.materialIcon}</i>
-					</div>
-				</div>`;
+	templateHTML(): string {
+		return htmlEscape`
+			<div class="tab functional-tab" data-tab-id="${this.props.tabIndex}">
+				<div class="server-tab-badge close-button">
+					<i class="material-icons">close</i>
+				</div>
+				<div class="server-tab">
+					<i class="material-icons">${this.props.materialIcon}</i>
+				</div>
+			</div>
+		`;
 	}
 
 	init(): void {
-		this.$el = this.generateNodeFromTemplate(this.template());
+		this.$el = this.generateNodeFromHTML(this.templateHTML());
 		if (this.props.name !== 'Settings') {
 			this.props.$root.append(this.$el);
 			this.$closeButton = this.$el.querySelectorAll('.server-tab-badge')[0];

app/renderer/js/components/server-tab.ts

@@ -1,5 +1,7 @@
 import {ipcRenderer} from 'electron';
 
+import {htmlEscape} from 'escape-goat';
+
 import * as SystemUtil from '../utils/system-util';
 
 import Tab, {TabProps} from './tab';
@@ -12,19 +14,21 @@ export default class ServerTab extends Tab {
 		this.init();
 	}
 
-	template(): string {
-		return `<div class="tab" data-tab-id="${this.props.tabIndex}">
-					<div class="server-tooltip" style="display:none">${this.props.name}</div>
-					<div class="server-tab-badge"></div>
-					<div class="server-tab">
-					<img class="server-icons" src='${this.props.icon}'/>
-					</div>
-					<div class="server-tab-shortcut">${this.generateShortcutText()}</div>
-				</div>`;
+	templateHTML(): string {
+		return htmlEscape`
+			<div class="tab" data-tab-id="${this.props.tabIndex}">
+				<div class="server-tooltip" style="display:none">${this.props.name}</div>
+				<div class="server-tab-badge"></div>
+				<div class="server-tab">
+					<img class="server-icons" src="${this.props.icon}"/>
+				</div>
+				<div class="server-tab-shortcut">${this.generateShortcutText()}</div>
+			</div>
+		`;
 	}
 
 	init(): void {
-		this.$el = this.generateNodeFromTemplate(this.template());
+		this.$el = this.generateNodeFromHTML(this.templateHTML());
 		this.props.$root.append(this.$el);
 		this.registerListeners();
 		this.$badge = this.$el.querySelectorAll('.server-tab-badge')[0];
@@ -33,7 +37,7 @@ export default class ServerTab extends Tab {
 	updateBadge(count: number): void {
 		if (count > 0) {
 			const formattedCount = count > 999 ? '1K+' : count.toString();
-			this.$badge.innerHTML = formattedCount;
+			this.$badge.textContent = formattedCount;
 			this.$badge.classList.add('active');
 		} else {
 			this.$badge.classList.remove('active');
@@ -50,11 +54,7 @@ export default class ServerTab extends Tab {
 
 		let shortcutText = '';
 
-		if (SystemUtil.getOS() === 'Mac') {
-			shortcutText = `⌘ ${shownIndex}`;
-		} else {
-			shortcutText = `Ctrl+${shownIndex}`;
-		}
+		shortcutText = SystemUtil.getOS() === 'Mac' ? `⌘ ${shownIndex}` : `Ctrl+${shownIndex}`;
 
 		// Array index == Shown index - 1
 		ipcRenderer.send('switch-server-tab', shownIndex - 1);

app/renderer/js/components/webview.ts

@@ -2,6 +2,8 @@ import {ipcRenderer, remote} from 'electron';
 import fs from 'fs';
 import path from 'path';
 
+import {htmlEscape} from 'escape-goat';
+
 import * as ConfigUtil from '../utils/config-util';
 import * as SystemUtil from '../utils/system-util';
 
@@ -50,25 +52,26 @@ export default class WebView extends BaseComponent {
 		this.$webviewsContainer = document.querySelector('#webviews-container').classList;
 	}
 
-	template(): string {
-		return `<webview
-					class="disabled"
-					data-tab-id="${this.props.tabIndex}"
-					src="${this.props.url}"
-					${this.props.nodeIntegration ? 'nodeIntegration' : ''}
-					${this.props.preload ? 'preload="js/preload.js"' : ''}
-					partition="persist:webviewsession"
-					name="${this.props.name}"
-					webpreferences="
-						${this.props.nodeIntegration ? '' : 'contextIsolation,'}
-						${ConfigUtil.getConfigItem('enableSpellchecker') ? 'spellcheck,' : ''}
-						javascript
-					">
-				</webview>`;
+	templateHTML(): string {
+		return htmlEscape`
+			<webview
+				class="disabled"
+				data-tab-id="${this.props.tabIndex}"
+				src="${this.props.url}"
+				` + (this.props.nodeIntegration ? 'nodeIntegration' : '') + htmlEscape`
+				` + (this.props.preload ? 'preload="js/preload.js"' : '') + htmlEscape`
+				partition="persist:webviewsession"
+				name="${this.props.name}"
+				webpreferences="
+					contextIsolation=${!this.props.nodeIntegration},
+					spellcheck=${Boolean(ConfigUtil.getConfigItem('enableSpellchecker'))}
+				">
+			</webview>
+		`;
 	}
 
 	init(): void {
-		this.$el = this.generateNodeFromTemplate(this.template()) as Electron.WebviewTag;
+		this.$el = this.generateNodeFromHTML(this.templateHTML()) as Electron.WebviewTag;
 		this.domReady = new Promise(resolve => {
 			this.$el.addEventListener('dom-ready', () => resolve(), true);
 		});
@@ -262,8 +265,8 @@ export default class WebView extends BaseComponent {
 		ipcRenderer.sendTo(this.$el.getWebContentsId(), 'logout');
 	}
 
-	showShortcut(): void {
-		ipcRenderer.sendTo(this.$el.getWebContentsId(), 'shortcut');
+	showKeyboardShortcuts(): void {
+		ipcRenderer.sendTo(this.$el.getWebContentsId(), 'show-keyboard-shortcuts');
 	}
 
 	openDevTools(): void {

app/renderer/js/electron-bridge.ts

@@ -1,68 +1,61 @@
 import {ipcRenderer} from 'electron';
 import {EventEmitter} from 'events';
 
+import isDev from 'electron-is-dev';
+
 import {ClipboardDecrypterImpl} from './clipboard-decrypter';
 import {NotificationData, newNotification} from './notification';
 
 type ListenerType = ((...args: any[]) => void);
 
-class ElectronBridgeImpl extends EventEmitter implements ElectronBridge {
-	send_notification_reply_message_supported: boolean;
-	idle_on_system: boolean;
-	last_active_on_system: number;
+let notificationReplySupported = false;
+// Indicates if the user is idle or not
+let idle = false;
+// Indicates the time at which user was last active
+let lastActive = Date.now();
 
-	constructor() {
-		super();
-		this.send_notification_reply_message_supported = false;
-		// Indicates if the user is idle or not
-		this.idle_on_system = false;
+export const bridgeEvents = new EventEmitter();
 
-		// Indicates the time at which user was last active
-		this.last_active_on_system = Date.now();
-	}
+const electron_bridge: ElectronBridge = {
+	send_event: (eventName: string | symbol, ...args: unknown[]): boolean =>
+		bridgeEvents.emit(eventName, ...args),
 
-	send_event = (eventName: string | symbol, ...args: unknown[]): void => {
-		this.emit(eventName, ...args);
-	};
+	on_event: (eventName: string, listener: ListenerType): void => {
+		bridgeEvents.on(eventName, listener);
+	},
 
-	on_event = (eventName: string, listener: ListenerType): void => {
-		this.on(eventName, listener);
-	};
-
-	new_notification = (
+	new_notification: (
 		title: string,
 		options: NotificationOptions | undefined,
 		dispatch: (type: string, eventInit: EventInit) => boolean
 	): NotificationData =>
-		newNotification(title, options, dispatch);
+		newNotification(title, options, dispatch),
 
-	get_idle_on_system = (): boolean => this.idle_on_system;
+	get_idle_on_system: (): boolean => idle,
 
-	get_last_active_on_system = (): number => this.last_active_on_system;
+	get_last_active_on_system: (): number => lastActive,
 
-	get_send_notification_reply_message_supported = (): boolean =>
-		this.send_notification_reply_message_supported;
+	get_send_notification_reply_message_supported: (): boolean =>
+		notificationReplySupported,
 
-	set_send_notification_reply_message_supported = (value: boolean): void => {
-		this.send_notification_reply_message_supported = value;
-	};
+	set_send_notification_reply_message_supported: (value: boolean): void => {
+		notificationReplySupported = value;
+	},
 
-	decrypt_clipboard = (version: number): ClipboardDecrypterImpl =>
-		new ClipboardDecrypterImpl(version);
-}
+	decrypt_clipboard: (version: number): ClipboardDecrypterImpl =>
+		new ClipboardDecrypterImpl(version)
+};
 
-const electron_bridge = new ElectronBridgeImpl();
-
-electron_bridge.on('total_unread_count', (...args) => {
+bridgeEvents.on('total_unread_count', (...args) => {
 	ipcRenderer.send('unread-count', ...args);
 });
 
-electron_bridge.on('realm_name', realmName => {
+bridgeEvents.on('realm_name', realmName => {
 	const serverURL = location.origin;
 	ipcRenderer.send('realm-name-changed', serverURL, realmName);
 });
 
-electron_bridge.on('realm_icon_url', (iconURL: unknown) => {
+bridgeEvents.on('realm_icon_url', (iconURL: unknown) => {
 	if (typeof iconURL !== 'string') {
 		throw new TypeError('Expected string for iconURL');
 	}
@@ -72,6 +65,25 @@ electron_bridge.on('realm_icon_url', (iconURL: unknown) => {
 	ipcRenderer.send('realm-icon-changed', serverURL, iconURL);
 });
 
+// Set user as active and update the time of last activity
+ipcRenderer.on('set-active', () => {
+	if (isDev) {
+		console.log('active');
+	}
+
+	idle = false;
+	lastActive = Date.now();
+});
+
+// Set user as idle and time of last activity is left unchanged
+ipcRenderer.on('set-idle', () => {
+	if (isDev) {
+		console.log('idle');
+	}
+
+	idle = true;
+});
+
 // This follows node's idiomatic implementation of event
 // emitters to make event handling more simpler instead of using
 // functions zulip side will emit event using ElectronBrigde.send_event

app/renderer/js/injected.ts

@@ -9,13 +9,7 @@ interface CompatElectronBridge extends ElectronBridge {
 (() => {
 	const zulipWindow = window as typeof window & {
 		electron_bridge: CompatElectronBridge;
-		narrow: {
-			by_subject?: (target_id: number, opts: {trigger?: string}) => void;
-			by_topic?: (target_id: number, opts: {trigger?: string}) => void;
-		};
-		page_params?: {
-			default_language?: string;
-		};
+		page_params?: unknown;
 		raw_electron_bridge: ElectronBridge;
 	};
 
@@ -41,27 +35,6 @@ interface CompatElectronBridge extends ElectronBridge {
 
 	zulipWindow.electron_bridge = electron_bridge;
 
-	(async () => {
-		if (document.readyState === 'loading') {
-			await new Promise(resolve => {
-				document.addEventListener('DOMContentLoaded', () => {
-					resolve();
-				});
-			});
-		}
-
-		const {page_params} = zulipWindow;
-		if (page_params) {
-			electron_bridge.send_event('zulip-loaded');
-		}
-	})();
-
-	electron_bridge.on_event('narrow-by-topic', (id: number) => {
-		const {narrow} = zulipWindow;
-		const narrowByTopic = narrow.by_topic || narrow.by_subject;
-		narrowByTopic(id, {trigger: 'notification'});
-	});
-
 	function attributeListener<T extends EventTarget>(type: string): PropertyDescriptor {
 		const symbol = Symbol('on' + type);
 

app/renderer/js/main.ts

@@ -2,7 +2,6 @@ import {ipcRenderer, remote, clipboard} from 'electron';
 import path from 'path';
 
 import isDev from 'electron-is-dev';
-import escape from 'escape-html';
 
 import * as Messages from '../../resources/messages';
 
@@ -10,7 +9,6 @@ import FunctionalTab from './components/functional-tab';
 import ServerTab from './components/server-tab';
 import WebView from './components/webview';
 import {feedbackHolder} from './feedback';
-import * as CommonUtil from './utils/common-util';
 import * as ConfigUtil from './utils/config-util';
 import * as DNDUtil from './utils/dnd-util';
 import type {DNDSettings} from './utils/dnd-util';
@@ -125,7 +123,7 @@ class ServerManagerView {
 
 		this.$fullscreenPopup = document.querySelector('#fullscreen-popup');
 		this.$fullscreenEscapeKey = process.platform === 'darwin' ? '^⌘F' : 'F11';
-		this.$fullscreenPopup.innerHTML = `Press ${this.$fullscreenEscapeKey} to exit full screen`;
+		this.$fullscreenPopup.textContent = `Press ${this.$fullscreenEscapeKey} to exit full screen`;
 
 		this.loading = new Set();
 		this.activeTabIndex = -1;
@@ -163,19 +161,15 @@ class ServerManagerView {
 		}
 
 		const proxyEnabled = ConfigUtil.getConfigItem('useManualProxy') || ConfigUtil.getConfigItem('useSystemProxy');
-		if (proxyEnabled) {
-			await session.fromPartition('persist:webviewsession').setProxy({
-				pacScript: ConfigUtil.getConfigItem('proxyPAC', ''),
-				proxyRules: ConfigUtil.getConfigItem('proxyRules', ''),
-				proxyBypassRules: ConfigUtil.getConfigItem('proxyBypass', '')
-			});
-		} else {
-			await session.fromPartition('persist:webviewsession').setProxy({
-				pacScript: '',
-				proxyRules: '',
-				proxyBypassRules: ''
-			});
-		}
+		await session.fromPartition('persist:webviewsession').setProxy(proxyEnabled ? {
+			pacScript: ConfigUtil.getConfigItem('proxyPAC', ''),
+			proxyRules: ConfigUtil.getConfigItem('proxyRules', ''),
+			proxyBypassRules: ConfigUtil.getConfigItem('proxyBypass', '')
+		} : {
+			pacScript: '',
+			proxyRules: '',
+			proxyBypassRules: ''
+		});
 	}
 
 	// Settings are initialized only when user clicks on General/Server/Network section settings
@@ -257,7 +251,7 @@ class ServerManagerView {
 			const serverConf = await DomainUtil.checkDomain(domain);
 			await DomainUtil.addDomain(serverConf);
 			return true;
-		} catch (error) {
+		} catch (error: unknown) {
 			logger.error(error);
 			logger.error(`Could not add ${domain}. Please contact your system administrator.`);
 			return false;
@@ -358,7 +352,7 @@ class ServerManagerView {
 		this.tabs.push(new ServerTab({
 			role: 'server',
 			icon: server.icon,
-			name: CommonUtil.decodeString(server.alias),
+			name: server.alias,
 			$root: this.$tabsContainer,
 			onClick: this.activateLastTab.bind(this, index),
 			index,
@@ -371,7 +365,7 @@ class ServerManagerView {
 				tabIndex,
 				url: server.url,
 				role: 'server',
-				name: CommonUtil.decodeString(server.alias),
+				name: server.alias,
 				hasPermission: (origin: string, permission: string) =>
 					origin === server.url && permission === 'notifications',
 				isActive: () => index === this.activeTabIndex,
@@ -463,7 +457,7 @@ class ServerManagerView {
 		const $parent = $img.parentElement;
 		const $container = $parent.parentElement;
 		const webviewId = $container.dataset.tabId;
-		const $webview = document.querySelector(`webview[data-tab-id="${webviewId}"]`);
+		const $webview = document.querySelector(`webview[data-tab-id="${CSS.escape(webviewId)}"]`);
 		const realmName = $webview.getAttribute('name');
 
 		if (realmName === null) {
@@ -499,7 +493,7 @@ class ServerManagerView {
 	}
 
 	onHover(index: number): void {
-		// `this.$serverIconTooltip[index].innerHTML` already has realm name, so we are just
+		// `this.$serverIconTooltip[index].textContent` already has realm name, so we are just
 		// removing the style.
 		this.$serverIconTooltip[index].removeAttribute('style');
 		// To handle position of servers' tooltip due to scrolling of list of organizations
@@ -684,8 +678,8 @@ class ServerManagerView {
 		this.functionalTabs.clear();
 
 		// Clear DOM elements
-		this.$tabsContainer.innerHTML = '';
-		this.$webviewsContainer.innerHTML = '';
+		this.$tabsContainer.textContent = '';
+		this.$webviewsContainer.textContent = '';
 	}
 
 	async reloadView(): Promise<void> {
@@ -804,7 +798,7 @@ class ServerManagerView {
 			['zoomOut', webview => webview.zoomOut()],
 			['zoomActualSize', webview => webview.zoomActualSize()],
 			['log-out', webview => webview.logOut()],
-			['shortcut', webview => webview.showShortcut()],
+			['show-keyboard-shortcuts', webview => webview.showKeyboardShortcuts()],
 			['tab-devtools', webview => webview.openDevTools()]
 		];
 
@@ -929,11 +923,11 @@ class ServerManagerView {
 				if (domain.url.includes(serverURL)) {
 					const serverTooltipSelector = '.tab .server-tooltip';
 					const serverTooltips = document.querySelectorAll(serverTooltipSelector);
-					serverTooltips[index].innerHTML = escape(realmName);
-					this.tabs[index].props.name = escape(realmName);
+					serverTooltips[index].textContent = realmName;
+					this.tabs[index].props.name = realmName;
 					this.tabs[index].webview.props.name = realmName;
 
-					domain.alias = escape(realmName);
+					domain.alias = realmName;
 					DomainUtil.updateDomain(index, domain);
 					// Update the realm name also on the Window menu
 					ipcRenderer.send('update-menu', {
@@ -974,7 +968,7 @@ class ServerManagerView {
 			webviews.forEach(webview => {
 				const currentId = webview.getWebContentsId();
 				const tabId = webview.getAttribute('data-tab-id');
-				const concurrentTab: HTMLButtonElement = document.querySelector(`div[data-tab-id="${tabId}"]`);
+				const concurrentTab: HTMLButtonElement = document.querySelector(`div[data-tab-id="${CSS.escape(tabId)}"]`);
 				if (currentId === webviewId) {
 					concurrentTab.click();
 				}

app/renderer/js/notification/darwin-notifications.ts

@@ -1,113 +0,0 @@
-import {ipcRenderer} from 'electron';
-
-import MacNotifier from 'node-mac-notifier';
-
-import electron_bridge from '../electron-bridge';
-import * as ConfigUtil from '../utils/config-util';
-
-import {
-	appId, customReply, focusCurrentServer, parseReply
-} from './helpers';
-
-type ReplyHandler = (response: string) => void;
-type ClickHandler = () => void;
-let replyHandler: ReplyHandler;
-let clickHandler: ClickHandler;
-
-interface NotificationHandlerArgs {
-	response: string;
-}
-
-class DarwinNotification {
-	tag: number;
-
-	constructor(title: string, options: NotificationOptions) {
-		const silent: boolean = ConfigUtil.getConfigItem('silent') || false;
-		const {icon} = options;
-		const profilePic = new URL(icon, location.href).href;
-
-		this.tag = Number.parseInt(options.tag, 10);
-		const notification = new MacNotifier(title, Object.assign(options, {
-			bundleId: appId,
-			canReply: true,
-			silent,
-			icon: profilePic
-		}));
-
-		notification.addEventListener('click', () => {
-			// Focus to the server who sent the
-			// notification if not focused already
-			if (clickHandler) {
-				clickHandler();
-			}
-
-			focusCurrentServer();
-			ipcRenderer.send('focus-app');
-		});
-
-		notification.addEventListener('reply', this.notificationHandler);
-	}
-
-	static requestPermission(): void {
-		// Do nothing
-	}
-
-	// Override default Notification permission
-	static get permission(): NotificationPermission {
-		return ConfigUtil.getConfigItem('showNotification') ? 'granted' : 'denied';
-	}
-
-	get onreply(): ReplyHandler {
-		return replyHandler;
-	}
-
-	set onreply(handler: ReplyHandler) {
-		replyHandler = handler;
-	}
-
-	get onclick(): ClickHandler {
-		return clickHandler;
-	}
-
-	set onclick(handler: ClickHandler) {
-		clickHandler = handler;
-	}
-
-	// Not something that is common or
-	// used by zulip server but added to be
-	// future proff.
-	addEventListener(event: string, handler: ClickHandler | ReplyHandler): void {
-		if (event === 'click') {
-			clickHandler = handler as ClickHandler;
-		}
-
-		if (event === 'reply') {
-			replyHandler = handler as ReplyHandler;
-		}
-	}
-
-	async notificationHandler({response}: NotificationHandlerArgs): Promise<void> {
-		response = await parseReply(response);
-		focusCurrentServer();
-		if (electron_bridge.send_notification_reply_message_supported) {
-			electron_bridge.send_event('send_notification_reply_message', this.tag, response);
-			return;
-		}
-
-		electron_bridge.emit('narrow-by-topic', this.tag);
-		if (replyHandler) {
-			replyHandler(response);
-			return;
-		}
-
-		customReply(response);
-	}
-
-	// Method specific to notification api
-	// used by zulip
-	close(): void {
-		// Do nothing
-	}
-}
-
-module.exports = DarwinNotification;

app/renderer/js/notification/helpers.ts

@@ -1,69 +1,8 @@
 import {remote} from 'electron';
 
-import Logger from '../utils/logger-util';
-
-const logger = new Logger({
-	file: 'errors.log',
-	timestamp: true
-});
-
 // Do not change this
 export const appId = 'org.zulip.zulip-electron';
 
-export type BotListItem = [string, string];
-const botsList: BotListItem[] = [];
-let botsListLoaded = false;
-
-// This function load list of bots from the server
-// in case botsList isn't already completely loaded when required in parseRely
-export async function loadBots(): Promise<void> {
-	botsList.length = 0;
-	const response = await fetch('/json/users');
-	if (response.ok) {
-		const {members} = await response.json();
-		members.forEach(({is_bot, full_name}: {[key: string]: unknown}) => {
-			if (is_bot && typeof full_name === 'string') {
-				const bot = `@${full_name}`;
-				const mention = `@**${bot.replace(/^@/, '')}**`;
-				botsList.push([bot, mention]);
-			}
-		});
-		botsListLoaded = true;
-	} else {
-		logger.log('Load bots request failed: ', await response.text());
-		logger.log('Load bots request status: ', response.status);
-	}
-}
-
-export function checkElements(...elements: unknown[]): boolean {
-	let status = true;
-	elements.forEach(element => {
-		if (element === null || element === undefined) {
-			status = false;
-		}
-	});
-	return status;
-}
-
-export function customReply(reply: string): void {
-	// Server does not support notification reply yet.
-	const buttonSelector = '.messagebox #send_controls button[type=submit]';
-	const messageboxSelector = '.selected_message .messagebox .messagebox-border .messagebox-content';
-	const textarea: HTMLInputElement = document.querySelector('#compose-textarea');
-	const messagebox: HTMLButtonElement = document.querySelector(messageboxSelector);
-	const sendButton: HTMLButtonElement = document.querySelector(buttonSelector);
-
-	// Sanity check for old server versions
-	const elementsExists = checkElements(textarea, messagebox, sendButton);
-	if (!elementsExists) {
-		return;
-	}
-
-	textarea.value = reply;
-	messagebox.click();
-	sendButton.click();
-}
-
 const currentWindow = remote.getCurrentWindow();
 const webContents = remote.getCurrentWebContents();
 const webContentsId = webContents.id;
@@ -73,65 +12,3 @@ const webContentsId = webContents.id;
 export function focusCurrentServer(): void {
 	currentWindow.webContents.send('focus-webview-with-id', webContentsId);
 }
-
-// This function parses the reply from to notification
-// making it easier to reply from notification eg
-// @username in reply will be converted to @**username**
-// #stream in reply will be converted to #**stream**
-// bot mentions are not yet supported
-export async function parseReply(reply: string): Promise<string> {
-	const usersDiv = document.querySelectorAll('#user_presences li');
-	const streamHolder = document.querySelectorAll('#stream_filters li');
-
-	type UsersItem = BotListItem;
-	type StreamsItem = BotListItem;
-	const users: UsersItem[] = [];
-	const streams: StreamsItem[] = [];
-
-	usersDiv.forEach(userRow => {
-		const anchor = userRow.querySelector('span a');
-		if (anchor !== null) {
-			const user = `@${anchor.textContent.trim()}`;
-			const mention = `@**${user.replace(/^@/, '')}**`;
-			users.push([user, mention]);
-		}
-	});
-
-	streamHolder.forEach(stream => {
-		const streamAnchor = stream.querySelector('div a');
-		if (streamAnchor !== null) {
-			const streamName = `#${streamAnchor.textContent.trim()}`;
-			const streamMention = `#**${streamName.replace(/^#/, '')}**`;
-			streams.push([streamName, streamMention]);
-		}
-	});
-
-	users.forEach(([user, mention]) => {
-		if (reply.includes(user)) {
-			const regex = new RegExp(user, 'g');
-			reply = reply.replace(regex, mention);
-		}
-	});
-
-	streams.forEach(([stream, streamMention]) => {
-		const regex = new RegExp(stream, 'g');
-		reply = reply.replace(regex, streamMention);
-	});
-
-	// If botsList isn't completely loaded yet, make a request for list
-	if (!botsListLoaded) {
-		await loadBots();
-	}
-
-	// Iterate for every bot name and replace in reply
-	// @botname with @**botname**
-	botsList.forEach(([bot, mention]) => {
-		if (reply.includes(bot)) {
-			const regex = new RegExp(bot, 'g');
-			reply = reply.replace(regex, mention);
-		}
-	});
-
-	reply = reply.replace(/\\n/, '\n');
-	return reply;
-}

app/renderer/js/notification/index.ts

@@ -9,12 +9,6 @@ const {app} = remote;
 // On windows 8 we have to explicitly set the appUserModelId otherwise notification won't work.
 app.setAppUserModelId(appId);
 
-let Notification = DefaultNotification;
-
-if (process.platform === 'darwin') {
-	Notification = require('./darwin-notifications');
-}
-
 export interface NotificationData {
 	close: () => void;
 	title: string;
@@ -39,7 +33,7 @@ export function newNotification(
 	options: NotificationOptions | undefined,
 	dispatch: (type: string, eventInit: EventInit) => boolean
 ): NotificationData {
-	const notification = new Notification(title, options);
+	const notification = new DefaultNotification(title, options);
 	for (const type of ['click', 'close', 'error', 'show']) {
 		notification.addEventListener(type, (ev: Event) => {
 			if (!dispatch(type, ev)) {

app/renderer/js/pages/preference/add-certificate.ts

@@ -1,97 +0,0 @@
-import {remote, OpenDialogOptions} from 'electron';
-import path from 'path';
-
-import BaseComponent from '../../components/base';
-import * as CertificateUtil from '../../utils/certificate-util';
-import * as DomainUtil from '../../utils/domain-util';
-import * as t from '../../utils/translation-util';
-
-interface AddCertificateProps {
-	$root: Element;
-}
-
-const {dialog} = remote;
-
-export default class AddCertificate extends BaseComponent {
-	props: AddCertificateProps;
-	_certFile: string;
-	$addCertificate: Element | null;
-	addCertificateButton: Element | null;
-	serverUrl: HTMLInputElement | null;
-	constructor(props: AddCertificateProps) {
-		super();
-		this.props = props;
-		this._certFile = '';
-	}
-
-	template(): string {
-		return `
-			<div class="settings-card certificates-card">
-				<div class="certificate-input">
-					<div>${t.__('Organization URL')}</div>
-					<input class="setting-input-value" autofocus placeholder="your-organization.zulipchat.com or zulip.your-organization.com"/>
-				</div>
-				<div class="certificate-input">
-					<div>${t.__('Certificate file')}</div>
-					<button class="green" id="add-certificate-button">${t.__('Upload')}</button>
-				</div>
-			</div>
-		`;
-	}
-
-	init(): void {
-		this.$addCertificate = this.generateNodeFromTemplate(this.template());
-		this.props.$root.append(this.$addCertificate);
-		this.addCertificateButton = this.$addCertificate.querySelector('#add-certificate-button');
-		this.serverUrl = this.$addCertificate.querySelectorAll('input.setting-input-value')[0] as HTMLInputElement;
-		this.initListeners();
-	}
-
-	async validateAndAdd(): Promise<void> {
-		const certificate = this._certFile;
-		const serverUrl = this.serverUrl.value;
-		if (certificate !== '' && serverUrl !== '') {
-			const server = encodeURIComponent(DomainUtil.formatUrl(serverUrl));
-			const fileName = path.basename(certificate);
-			const copy = CertificateUtil.copyCertificate(server, certificate, fileName);
-			if (!copy) {
-				return;
-			}
-
-			CertificateUtil.setCertificate(server, fileName);
-			this.serverUrl.value = '';
-			await dialog.showMessageBox({
-				title: 'Success',
-				message: 'Certificate saved!'
-			});
-		} else {
-			dialog.showErrorBox('Error', `Please, ${serverUrl === '' ?
-				'Enter an Organization URL' : 'Choose certificate file'}`);
-		}
-	}
-
-	async addHandler(): Promise<void> {
-		const showDialogOptions: OpenDialogOptions = {
-			title: 'Select file',
-			properties: ['openFile'],
-			filters: [{name: 'crt, pem', extensions: ['crt', 'pem']}]
-		};
-		const {filePaths, canceled} = await dialog.showOpenDialog(showDialogOptions);
-		if (!canceled) {
-			this._certFile = filePaths[0] || '';
-			await this.validateAndAdd();
-		}
-	}
-
-	initListeners(): void {
-		this.addCertificateButton.addEventListener('click', async () => {
-			await this.addHandler();
-		});
-
-		this.serverUrl.addEventListener('keypress', async event => {
-			if (event.key === 'Enter') {
-				await this.addHandler();
-			}
-		});
-	}
-}

app/renderer/js/pages/preference/base-section.ts

@@ -1,6 +1,6 @@
 import {ipcRenderer} from 'electron';
 
-import escape from 'escape-html';
+import {htmlEscape} from 'escape-goat';
 
 import BaseComponent from '../../components/base';
 
@@ -15,9 +15,9 @@ export default class BaseSection extends BaseComponent {
 	generateSettingOption(props: BaseSectionProps): void {
 		const {$element, disabled, value, clickHandler} = props;
 
-		$element.innerHTML = '';
+		$element.textContent = '';
 
-		const $optionControl = this.generateNodeFromTemplate(this.generateOptionTemplate(value, disabled));
+		const $optionControl = this.generateNodeFromHTML(this.generateOptionHTML(value, disabled));
 		$element.append($optionControl);
 
 		if (!disabled) {
@@ -25,39 +25,39 @@ export default class BaseSection extends BaseComponent {
 		}
 	}
 
-	generateOptionTemplate(settingOption: boolean, disabled?: boolean): string {
-		const label = disabled ? '<label class="disallowed" title="Setting locked by system administrator."/>' : '<label/>';
+	generateOptionHTML(settingOption: boolean, disabled?: boolean): string {
+		const labelHTML = disabled ? '<label class="disallowed" title="Setting locked by system administrator."></label>' : '<label></label>';
 		if (settingOption) {
-			return `
+			return htmlEscape`
 				<div class="action">
 					<div class="switch">
-					  <input class="toggle toggle-round" type="checkbox" checked disabled>
-					  ${label}
+						<input class="toggle toggle-round" type="checkbox" checked disabled>
+						` + labelHTML + htmlEscape`
 					</div>
 				</div>
 			`;
 		}
 
-		return `
-				<div class="action">
-					<div class="switch">
-					  <input class="toggle toggle-round" type="checkbox">
-					  ${label}
-					</div>
+		return htmlEscape`
+			<div class="action">
+				<div class="switch">
+					<input class="toggle toggle-round" type="checkbox">
+					` + labelHTML + htmlEscape`
 				</div>
-			`;
+			</div>
+		`;
 	}
 
 	/* A method that in future can be used to create dropdown menus using <select> <option> tags.
 		it needs an object which has ``key: value`` pairs and will return a string that can be appended to HTML
 	*/
-	generateSelectTemplate(options: {[key: string]: string}, className?: string, idName?: string): string {
-		let select = `<select class="${escape(className)}" id="${escape(idName)}">\n`;
+	generateSelectHTML(options: Record<string, string>, className?: string, idName?: string): string {
+		let html = htmlEscape`<select class="${className}" id="${idName}">\n`;
 		Object.keys(options).forEach(key => {
-			select += `<option name="${escape(key)}" value="${escape(key)}">${escape(options[key])}</option>\n`;
+			html += htmlEscape`<option name="${key}" value="${key}">${options[key]}</option>\n`;
 		});
-		select += '</select>';
-		return select;
+		html += '</select>';
+		return html;
 	}
 
 	reloadApp(): void {

app/renderer/js/pages/preference/connected-org-section.ts

@@ -1,9 +1,10 @@
 import {ipcRenderer} from 'electron';
 
+import {htmlEscape} from 'escape-goat';
+
 import * as DomainUtil from '../../utils/domain-util';
 import * as t from '../../utils/translation-util';
 
-import AddCertificate from './add-certificate';
 import BaseSection from './base-section';
 import FindAccounts from './find-accounts';
 import ServerInfoForm from './server-info-form';
@@ -17,22 +18,19 @@ export default class ConnectedOrgSection extends BaseSection {
 	$serverInfoContainer: Element | null;
 	$existingServers: Element | null;
 	$newOrgButton: HTMLButtonElement | null;
-	$addCertificateContainer: Element | null;
 	$findAccountsContainer: Element | null;
 	constructor(props: ConnectedOrgSectionProps) {
 		super();
 		this.props = props;
 	}
 
-	template(): string {
-		return `
+	templateHTML(): string {
+		return htmlEscape`
 			<div class="settings-pane" id="server-settings-pane">
 				<div class="page-title">${t.__('Connected organizations')}</div>
 				<div class="title" id="existing-servers">${t.__('All the connected orgnizations will appear here.')}</div>
 				<div id="server-info-container"></div>
 				<div id="new-org-button"><button class="green sea w-250">${t.__('Connect to another organization')}</button></div>
-				<div class="page-title">${t.__('Add Custom Certificates')}</div>
-				<div id="add-certificate-container"></div>
 				<div class="page-title">${t.__('Find accounts by email')}</div>
 				<div id="find-accounts-container"></div>
 			</div>
@@ -44,20 +42,19 @@ export default class ConnectedOrgSection extends BaseSection {
 	}
 
 	initServers(): void {
-		this.props.$root.innerHTML = '';
+		this.props.$root.textContent = '';
 
 		const servers = DomainUtil.getDomains();
-		this.props.$root.innerHTML = this.template();
+		this.props.$root.innerHTML = this.templateHTML();
 
 		this.$serverInfoContainer = document.querySelector('#server-info-container');
 		this.$existingServers = document.querySelector('#existing-servers');
 		this.$newOrgButton = document.querySelector('#new-org-button');
-		this.$addCertificateContainer = document.querySelector('#add-certificate-container');
 		this.$findAccountsContainer = document.querySelector('#find-accounts-container');
 
 		const noServerText = t.__('All the connected orgnizations will appear here');
 		// Show noServerText if no servers are there otherwise hide it
-		this.$existingServers.innerHTML = servers.length === 0 ? noServerText : '';
+		this.$existingServers.textContent = servers.length === 0 ? noServerText : '';
 
 		for (const [i, server] of servers.entries()) {
 			new ServerInfoForm({
@@ -72,16 +69,9 @@ export default class ConnectedOrgSection extends BaseSection {
 			ipcRenderer.send('forward-message', 'open-org-tab');
 		});
 
-		this.initAddCertificate();
 		this.initFindAccounts();
 	}
 
-	initAddCertificate(): void {
-		new AddCertificate({
-			$root: this.$addCertificateContainer
-		}).init();
-	}
-
 	initFindAccounts(): void {
 		new FindAccounts({
 			$root: this.$findAccountsContainer

app/renderer/js/pages/preference/find-accounts.ts

@@ -1,3 +1,5 @@
+import {htmlEscape} from 'escape-goat';
+
 import BaseComponent from '../../components/base';
 import * as LinkUtil from '../../utils/link-util';
 import * as t from '../../utils/translation-util';
@@ -16,8 +18,8 @@ export default class FindAccounts extends BaseComponent {
 		this.props = props;
 	}
 
-	template(): string {
-		return `
+	templateHTML(): string {
+		return htmlEscape`
 			<div class="settings-card certificate-card">
 				<div class="certificate-input">
 					<div>${t.__('Organization URL')}</div>
@@ -31,7 +33,7 @@ export default class FindAccounts extends BaseComponent {
 	}
 
 	init(): void {
-		this.$findAccounts = this.generateNodeFromTemplate(this.template());
+		this.$findAccounts = this.generateNodeFromHTML(this.templateHTML());
 		this.props.$root.append(this.$findAccounts);
 		this.$findAccountsButton = this.$findAccounts.querySelector('#find-accounts-button');
 		this.$serverUrlField = this.$findAccounts.querySelectorAll('input.setting-input-value')[0] as HTMLInputElement;

app/renderer/js/pages/preference/general-section.ts

@@ -2,6 +2,7 @@ import {ipcRenderer, remote, OpenDialogOptions} from 'electron';
 import path from 'path';
 
 import Tagify from '@yaireo/tagify';
+import {htmlEscape} from 'escape-goat';
 import fs from 'fs-extra';
 import ISO6391 from 'iso-639-1';
 
@@ -26,8 +27,8 @@ export default class GeneralSection extends BaseSection {
 		this.props = props;
 	}
 
-	template(): string {
-		return `
+	templateHTML(): string {
+		return htmlEscape`
             <div class="settings-pane">
                 <div class="title">${t.__('Appearance')}</div>
                 <div id="appearance-option-settings" class="settings-card">
@@ -147,7 +148,7 @@ export default class GeneralSection extends BaseSection {
 				<div class="title">${t.__('Factory Reset Data')}</div>
                 <div class="settings-card">
 					<div class="setting-row" id="factory-reset-option">
-						<div class="setting-description">${t.__('Reset the application, thus deleting all the connected organizations, accounts, and certificates.')}
+						<div class="setting-description">${t.__('Reset the application, thus deleting all the connected organizations and accounts.')}
 						</div>
 						<button class="factory-reset-button red w-150">${t.__('Factory Reset')}</button>
 					</div>
@@ -157,7 +158,7 @@ export default class GeneralSection extends BaseSection {
 	}
 
 	init(): void {
-		this.props.$root.innerHTML = this.template();
+		this.props.$root.innerHTML = this.templateHTML();
 		this.updateTrayOption();
 		this.updateBadgeOption();
 		this.updateSilentOption();
@@ -399,8 +400,8 @@ export default class GeneralSection extends BaseSection {
 
 	setLocale(): void {
 		const langDiv: HTMLSelectElement = document.querySelector('.lang-div');
-		const langList = this.generateSelectTemplate(supportedLocales, 'lang-menu');
-		langDiv.innerHTML += langList;
+		const langListHTML = this.generateSelectHTML(supportedLocales, 'lang-menu');
+		langDiv.innerHTML += langListHTML;
 		// `langMenu` is the select-option dropdown menu formed after executing the previous command
 		const langMenu: HTMLSelectElement = document.querySelector('.lang-menu');
 
@@ -516,7 +517,7 @@ export default class GeneralSection extends BaseSection {
 			const note: HTMLElement = document.querySelector('#note');
 			note.append(t.__('You can select a maximum of 3 languages for spellchecking.'));
 			const spellDiv: HTMLElement = document.querySelector('#spellcheck-langs');
-			spellDiv.innerHTML += `
+			spellDiv.innerHTML += htmlEscape`
 				<div class="setting-description">${t.__('Spellchecker Languages')}</div>
 				<input name='spellcheck' placeholder='Enter Languages'>`;
 
@@ -556,7 +557,7 @@ export default class GeneralSection extends BaseSection {
 				}
 			});
 
-			const configuredLanguages: string[] = ConfigUtil.getConfigItem('spellcheckerLanguages').map((code: string) => [...languagePairs].filter(pair => (pair[1] === code))[0][0]);
+			const configuredLanguages: string[] = ConfigUtil.getConfigItem('spellcheckerLanguages').map((code: string) => [...languagePairs].find(pair => (pair[1] === code))[0]);
 			tagify.addTags(configuredLanguages);
 
 			tagField.addEventListener('change', event => {

app/renderer/js/pages/preference/nav.ts

@@ -1,3 +1,5 @@
+import {htmlEscape} from 'escape-goat';
+
 import BaseComponent from '../../components/base';
 import * as t from '../../utils/translation-util';
 
@@ -17,29 +19,29 @@ export default class PreferenceNav extends BaseComponent {
 		this.init();
 	}
 
-	template(): string {
-		let navItemsTemplate = '';
+	templateHTML(): string {
+		let navItemsHTML = '';
 		for (const navItem of this.navItems) {
-			navItemsTemplate += `<div class="nav" id="nav-${navItem}">${t.__(navItem)}</div>`;
+			navItemsHTML += htmlEscape`<div class="nav" id="nav-${navItem}">${t.__(navItem)}</div>`;
 		}
 
-		return `
+		return htmlEscape`
 			<div>
 				<div id="settings-header">${t.__('Settings')}</div>
-				<div id="nav-container">${navItemsTemplate}</div>
+				<div id="nav-container">` + navItemsHTML + htmlEscape`</div>
 			</div>
 		`;
 	}
 
 	init(): void {
-		this.$el = this.generateNodeFromTemplate(this.template());
+		this.$el = this.generateNodeFromHTML(this.templateHTML());
 		this.props.$root.append(this.$el);
 		this.registerListeners();
 	}
 
 	registerListeners(): void {
 		for (const navItem of this.navItems) {
-			const $item = document.querySelector(`#nav-${navItem}`);
+			const $item = document.querySelector(`#nav-${CSS.escape(navItem)}`);
 			$item.addEventListener('click', () => {
 				this.props.onItemSelected(navItem);
 			});
@@ -57,12 +59,12 @@ export default class PreferenceNav extends BaseComponent {
 	}
 
 	activate(navItem: string): void {
-		const $item = document.querySelector(`#nav-${navItem}`);
+		const $item = document.querySelector(`#nav-${CSS.escape(navItem)}`);
 		$item.classList.add('active');
 	}
 
 	deactivate(navItem: string): void {
-		const $item = document.querySelector(`#nav-${navItem}`);
+		const $item = document.querySelector(`#nav-${CSS.escape(navItem)}`);
 		$item.classList.remove('active');
 	}
 }

app/renderer/js/pages/preference/network-section.ts

@@ -1,5 +1,7 @@
 import {ipcRenderer} from 'electron';
 
+import {htmlEscape} from 'escape-goat';
+
 import * as ConfigUtil from '../../utils/config-util';
 import * as t from '../../utils/translation-util';
 
@@ -21,8 +23,8 @@ export default class NetworkSection extends BaseSection {
 		this.props = props;
 	}
 
-	template(): string {
-		return `
+	templateHTML(): string {
+		return htmlEscape`
             <div class="settings-pane">
                 <div class="title">${t.__('Proxy')}</div>
                 <div id="appearance-option-settings" class="settings-card">
@@ -59,7 +61,7 @@ export default class NetworkSection extends BaseSection {
 	}
 
 	init(): void {
-		this.props.$root.innerHTML = this.template();
+		this.props.$root.innerHTML = this.templateHTML();
 		this.$proxyPAC = document.querySelector('#proxy-pac-option .setting-input-value');
 		this.$proxyRules = document.querySelector('#proxy-rules-option .setting-input-value');
 		this.$proxyBypass = document.querySelector('#proxy-bypass-option .setting-input-value');

app/renderer/js/pages/preference/new-server-form.ts

@@ -1,5 +1,7 @@
 import {ipcRenderer, remote} from 'electron';
 
+import {htmlEscape} from 'escape-goat';
+
 import BaseComponent from '../../components/base';
 import * as DomainUtil from '../../utils/domain-util';
 import * as LinkUtil from '../../utils/link-util';
@@ -22,8 +24,8 @@ export default class NewServerForm extends BaseComponent {
 		this.props = props;
 	}
 
-	template(): string {
-		return `
+	templateHTML(): string {
+		return htmlEscape`
 			<div class="server-input-container">
 				<div class="title">${t.__('Organization URL')}</div>
 				<div class="add-server-info-row">
@@ -56,23 +58,24 @@ export default class NewServerForm extends BaseComponent {
 	}
 
 	initForm(): void {
-		this.$newServerForm = this.generateNodeFromTemplate(this.template());
+		this.$newServerForm = this.generateNodeFromHTML(this.templateHTML());
 		this.$saveServerButton = this.$newServerForm.querySelector('#connect');
-		this.props.$root.innerHTML = '';
+		this.props.$root.textContent = '';
 		this.props.$root.append(this.$newServerForm);
 		this.$newServerUrl = this.$newServerForm.querySelectorAll('input.setting-input-value')[0] as HTMLInputElement;
 	}
 
 	async submitFormHandler(): Promise<void> {
-		this.$saveServerButton.innerHTML = 'Connecting...';
+		this.$saveServerButton.textContent = 'Connecting...';
 		let serverConf;
 		try {
-			serverConf = await DomainUtil.checkDomain(this.$newServerUrl.value);
-		} catch (error) {
-			this.$saveServerButton.innerHTML = 'Connect';
+			serverConf = await DomainUtil.checkDomain(this.$newServerUrl.value.trim());
+		} catch (error: unknown) {
+			this.$saveServerButton.textContent = 'Connect';
 			await dialog.showMessageBox({
 				type: 'error',
-				message: error.toString(),
+				message: error instanceof Error ?
+					`${error.name}: ${error.message}` : 'Unknown error',
 				buttons: ['OK']
 			});
 			return;

app/renderer/js/pages/preference/server-info-form.ts

@@ -1,5 +1,7 @@
 import {remote, ipcRenderer} from 'electron';
 
+import {htmlEscape} from 'escape-goat';
+
 import * as Messages from '../../../../resources/messages';
 import BaseComponent from '../../components/base';
 import * as DomainUtil from '../../utils/domain-util';
@@ -26,8 +28,8 @@ export default class ServerInfoForm extends BaseComponent {
 		this.props = props;
 	}
 
-	template(): string {
-		return `
+	templateHTML(): string {
+		return htmlEscape`
 			<div class="settings-card">
 				<div class="server-info-left">
 					<img class="server-info-icon" src="${this.props.server.icon}"/>
@@ -56,7 +58,7 @@ export default class ServerInfoForm extends BaseComponent {
 	}
 
 	initForm(): void {
-		this.$serverInfoForm = this.generateNodeFromTemplate(this.template());
+		this.$serverInfoForm = this.generateNodeFromHTML(this.templateHTML());
 		this.$serverInfoAlias = this.$serverInfoForm.querySelectorAll('.server-info-alias')[0];
 		this.$serverIcon = this.$serverInfoForm.querySelectorAll('.server-info-icon')[0];
 		this.$deleteServerButton = this.$serverInfoForm.querySelectorAll('.server-delete-action')[0];

app/renderer/js/pages/preference/servers-section.ts

@@ -1,3 +1,5 @@
+import {htmlEscape} from 'escape-goat';
+
 import * as t from '../../utils/translation-util';
 
 import BaseSection from './base-section';
@@ -15,16 +17,16 @@ export default class ServersSection extends BaseSection {
 		this.props = props;
 	}
 
-	template(): string {
-		return `
-		<div class="add-server-modal">
-			<div class="modal-container">
-				<div class="settings-pane" id="server-settings-pane">
-					<div class="page-title">${t.__('Add a Zulip organization')}</div>
-					<div id="new-server-container"></div>
+	templateHTML(): string {
+		return htmlEscape`
+			<div class="add-server-modal">
+				<div class="modal-container">
+					<div class="settings-pane" id="server-settings-pane">
+						<div class="page-title">${t.__('Add a Zulip organization')}</div>
+						<div id="new-server-container"></div>
+					</div>
 				</div>
 			</div>
-		</div>
 		`;
 	}
 
@@ -33,9 +35,9 @@ export default class ServersSection extends BaseSection {
 	}
 
 	initServers(): void {
-		this.props.$root.innerHTML = '';
+		this.props.$root.textContent = '';
 
-		this.props.$root.innerHTML = this.template();
+		this.props.$root.innerHTML = this.templateHTML();
 		this.$newServerContainer = document.querySelector('#new-server-container');
 
 		this.initNewServerForm();

app/renderer/js/pages/preference/shortcuts-section.ts

@@ -1,3 +1,5 @@
+import {htmlEscape} from 'escape-goat';
+
 import * as LinkUtil from '../../utils/link-util';
 import * as t from '../../utils/translation-util';
 
@@ -14,14 +16,14 @@ export default class ShortcutsSection extends BaseSection {
 		this.props = props;
 	}
 
-	// TODO - Deduplicate templateMac and templateWinLin functions. In theory
+	// TODO - Deduplicate templateMacHTML and templateWinLinHTML functions. In theory
 	// they both should be the same the only thing different should be the userOSKey
 	// variable but there seems to be inconsistences between both function, one has more
 	// lines though one may just be using more new lines and other thing is the use of +.
-	templateMac(): string {
+	templateMacHTML(): string {
 		const userOSKey = '⌘';
 
-		return `
+		return htmlEscape`
 						<div class="settings-pane">
 						<div class="settings-card tip"><p><b><i class="material-icons md-14">settings</i>${t.__('Tip')}:  </b>${t.__('These desktop app shortcuts extend the Zulip webapp\'s')} <span id="open-hotkeys-link"> ${t.__('keyboard shortcuts')}</span>.</p></div>
 							<div class="title">${t.__('Application Shortcuts')}</div>
@@ -182,10 +184,10 @@ export default class ShortcutsSection extends BaseSection {
 		`;
 	}
 
-	templateWinLin(): string {
+	templateWinLinHTML(): string {
 		const userOSKey = 'Ctrl';
 
-		return `
+		return htmlEscape`
 						<div class="settings-pane">
 						<div class="settings-card tip"><p><b><i class="material-icons md-14">settings</i>${t.__('Tip')}:  </b>${t.__('These desktop app shortcuts extend the Zulip webapp\'s')} <span id="open-hotkeys-link"> ${t.__('keyboard shortcuts')}</span>.</p></div>
 							<div class="title">${t.__('Application Shortcuts')}</div>
@@ -340,7 +342,7 @@ export default class ShortcutsSection extends BaseSection {
 
 	init(): void {
 		this.props.$root.innerHTML = (process.platform === 'darwin') ?
-			this.templateMac() : this.templateWinLin();
+			this.templateMacHTML() : this.templateWinLinHTML();
 		this.openHotkeysExternalLink();
 	}
 }

app/renderer/js/preload.ts

@@ -1,23 +1,16 @@
 import {contextBridge, ipcRenderer, webFrame} from 'electron';
 import fs from 'fs';
 
-import isDev from 'electron-is-dev';
-
-import electron_bridge from './electron-bridge';
-import {loadBots} from './notification/helpers';
+import electron_bridge, {bridgeEvents} from './electron-bridge';
 import * as NetworkError from './pages/network';
 
-// Prevent drag and drop event in main process which prevents remote code executaion
-// eslint-disable-next-line import/no-unassigned-import
-import './shared/preventdrag';
-
 contextBridge.exposeInMainWorld('raw_electron_bridge', electron_bridge);
 
-electron_bridge.once('zulip-loaded', async () => {
-	await loadBots();
-});
-
 ipcRenderer.on('logout', () => {
+	if (bridgeEvents.emit('logout')) {
+		return;
+	}
+
 	// Create the menu for the below
 	const dropdown: HTMLElement = document.querySelector('.dropdown-toggle');
 	dropdown.click();
@@ -26,7 +19,11 @@ ipcRenderer.on('logout', () => {
 	nodes[nodes.length - 1].click();
 });
 
-ipcRenderer.on('shortcut', () => {
+ipcRenderer.on('show-keyboard-shortcuts', () => {
+	if (bridgeEvents.emit('show-keyboard-shortcuts')) {
+		return;
+	}
+
 	// Create the menu for the below
 	const node: HTMLElement = document.querySelector('a[data-overlay-trigger=keyboard-shortcuts]');
 	// Additional check
@@ -40,6 +37,10 @@ ipcRenderer.on('shortcut', () => {
 });
 
 ipcRenderer.on('show-notification-settings', () => {
+	if (bridgeEvents.emit('show-notification-settings')) {
+		return;
+	}
+
 	// Create the menu for the below
 	const dropdown: HTMLElement = document.querySelector('.dropdown-toggle');
 	dropdown.click();
@@ -55,16 +56,6 @@ ipcRenderer.on('show-notification-settings', () => {
 	}, 100);
 });
 
-electron_bridge.once('zulip-loaded', () => {
-	// Redirect users to network troubleshooting page
-	const getRestartButton = document.querySelector('.restart_get_events_button');
-	if (getRestartButton) {
-		getRestartButton.addEventListener('click', () => {
-			ipcRenderer.send('forward-message', 'reload-viewer');
-		});
-	}
-});
-
 window.addEventListener('load', (event: any): void => {
 	if (!event.target.URL.includes('app/renderer/network.html')) {
 		return;
@@ -91,25 +82,6 @@ document.addEventListener('keydown', event => {
 	}
 });
 
-// Set user as active and update the time of last activity
-ipcRenderer.on('set-active', () => {
-	if (isDev) {
-		console.log('active');
-	}
-
-	electron_bridge.idle_on_system = false;
-	electron_bridge.last_active_on_system = Date.now();
-});
-
-// Set user as idle and time of last activity is left unchanged
-ipcRenderer.on('set-idle', () => {
-	if (isDev) {
-		console.log('idle');
-	}
-
-	electron_bridge.idle_on_system = true;
-});
-
 (async () => webFrame.executeJavaScript(
 	fs.readFileSync(require.resolve('./injected'), 'utf8')
 ))();

app/renderer/js/shared/preventdrag.ts

@@ -1,17 +0,0 @@
-// This is a security fix. Following function prevents drag and drop event in the app
-// so that attackers can't execute any remote code within the app
-// It doesn't affect the compose box so that users can still
-// use drag and drop event to share files etc
-
-const preventDragAndDrop = (): void => {
-	const preventEvents = ['dragover', 'drop'];
-	preventEvents.forEach(dragEvents => {
-		document.addEventListener(dragEvents, event => {
-			event.preventDefault();
-		});
-	});
-};
-
-preventDragAndDrop();
-
-export {};

app/renderer/js/tray.ts

@@ -21,6 +21,8 @@ const iconPath = (): string => {
 	return APP_ICON + (process.platform === 'win32' ? 'win.ico' : 'macOSTemplate.png');
 };
 
+const winUnreadTrayIconPath = (): string => APP_ICON + 'unread.ico';
+
 let unread = 0;
 
 const trayIconSize = (): number => {
@@ -97,6 +99,10 @@ const renderCanvas = function (arg: number): HTMLCanvasElement {
  * @return the native image
  */
 const renderNativeImage = function (arg: number): NativeImage {
+	if (process.platform === 'win32') {
+		return nativeImage.createFromPath(winUnreadTrayIconPath());
+	}
+
 	const canvas = renderCanvas(arg);
 	const pngData = nativeImage.createFromDataURL(canvas.toDataURL('image/png')).toPNG();
 	return nativeImage.createFromBuffer(pngData, {

app/renderer/js/utils/certificate-util.ts

@@ -1,79 +0,0 @@
-import electron from 'electron';
-import fs from 'fs';
-import path from 'path';
-
-import {JsonDB} from 'node-json-db';
-
-import {initSetUp} from './default-util';
-import Logger from './logger-util';
-
-const {app, dialog} =
-	process.type === 'renderer' ? electron.remote : electron;
-
-initSetUp();
-
-const logger = new Logger({
-	file: 'certificate-util.log',
-	timestamp: true
-});
-
-const certificatesDir = `${app.getPath('userData')}/certificates`;
-
-let db: JsonDB;
-
-reloadDB();
-
-export function getCertificate(server: string): string | undefined {
-	reloadDB();
-	return db.getData('/')[server];
-}
-
-// Function to copy the certificate to userData folder
-export function copyCertificate(_server: string, location: string, fileName: string): boolean {
-	let copied = false;
-	const filePath = `${certificatesDir}/${fileName}`;
-	try {
-		fs.copyFileSync(location, filePath);
-		copied = true;
-	} catch (error) {
-		dialog.showErrorBox(
-			'Error saving certificate',
-			'We encountered error while saving the certificate.'
-		);
-		logger.error('Error while copying the certificate to certificates folder.');
-		logger.error(error);
-	}
-
-	return copied;
-}
-
-export function setCertificate(server: string, fileName: string): void {
-	const filePath = `${fileName}`;
-	db.push(`/${server}`, filePath, true);
-	reloadDB();
-}
-
-export function removeCertificate(server: string): void {
-	db.delete(`/${server}`);
-	reloadDB();
-}
-
-function reloadDB(): void {
-	const settingsJsonPath = path.join(app.getPath('userData'), '/config/certificates.json');
-	try {
-		const file = fs.readFileSync(settingsJsonPath, 'utf8');
-		JSON.parse(file);
-	} catch (error) {
-		if (fs.existsSync(settingsJsonPath)) {
-			fs.unlinkSync(settingsJsonPath);
-			dialog.showErrorBox(
-				'Error saving settings',
-				'We encountered error while saving the certificate.'
-			);
-			logger.error('Error while JSON parsing certificates.json: ');
-			logger.error(error);
-		}
-	}
-
-	db = new JsonDB(settingsJsonPath, true, true);
-}

app/renderer/js/utils/common-util.ts

@@ -1,8 +0,0 @@
-// Unescape already encoded/escaped strings
-export function decodeString(stringInput: string): string {
-	const parser = new DOMParser();
-	const dom = parser.parseFromString(
-		'<!doctype html><body>' + stringInput,
-		'text/html');
-	return dom.body.textContent;
-}

app/renderer/js/utils/config-util.ts

@@ -32,7 +32,7 @@ reloadDB();
 export function getConfigItem(key: string, defaultValue: unknown = null): any {
 	try {
 		db.reload();
-	} catch (error) {
+	} catch (error: unknown) {
 		logger.error('Error while reloading settings.json: ');
 		logger.error(error);
 	}
@@ -60,7 +60,7 @@ export function getConfigString(key: string, defaultValue: string): string {
 export function isConfigItemExists(key: string): boolean {
 	try {
 		db.reload();
-	} catch (error) {
+	} catch (error: unknown) {
 		logger.error('Error while reloading settings.json: ');
 		logger.error(error);
 	}
@@ -89,7 +89,7 @@ function reloadDB(): void {
 	try {
 		const file = fs.readFileSync(settingsJsonPath, 'utf8');
 		JSON.parse(file);
-	} catch (error) {
+	} catch (error: unknown) {
 		if (fs.existsSync(settingsJsonPath)) {
 			fs.unlinkSync(settingsJsonPath);
 			dialog.showErrorBox(

app/renderer/js/utils/default-util.ts

@@ -1,17 +1,11 @@
 import electron from 'electron';
 import fs from 'fs';
 
-let app: Electron.App = null;
+const app = process.type === 'renderer' ? electron.remote.app : electron.app;
 let setupCompleted = false;
-if (process.type === 'renderer') {
-	app = electron.remote.app;
-} else {
-	app = electron.app;
-}
 
 const zulipDir = app.getPath('userData');
 const logDir = `${zulipDir}/Logs/`;
-const certificatesDir = `${zulipDir}/certificates/`;
 const configDir = `${zulipDir}/config/`;
 export const initSetUp = (): void => {
 	// If it is the first time the app is running
@@ -26,16 +20,11 @@ export const initSetUp = (): void => {
 			fs.mkdirSync(logDir);
 		}
 
-		if (!fs.existsSync(certificatesDir)) {
-			fs.mkdirSync(certificatesDir);
-		}
-
 		// Migrate config files from app data folder to config folder inside app
 		// data folder. This will be done once when a user updates to the new version.
 		if (!fs.existsSync(configDir)) {
 			fs.mkdirSync(configDir);
 			const domainJson = `${zulipDir}/domain.json`;
-			const certificatesJson = `${zulipDir}/certificates.json`;
 			const settingsJson = `${zulipDir}/settings.json`;
 			const updatesJson = `${zulipDir}/updates.json`;
 			const windowStateJson = `${zulipDir}/window-state.json`;
@@ -44,10 +33,6 @@ export const initSetUp = (): void => {
 					path: domainJson,
 					fileName: 'domain.json'
 				},
-				{
-					path: certificatesJson,
-					fileName: 'certificates.json'
-				},
 				{
 					path: settingsJson,
 					fileName: 'settings.json'

app/renderer/js/utils/domain-util.ts

@@ -91,27 +91,6 @@ export function duplicateDomain(domain: string): boolean {
 	return getDomains().some(server => server.url === domain);
 }
 
-async function checkCertError(domain: string, serverConf: ServerConf, error: any, silent: boolean): Promise<ServerConf> {
-	if (silent) {
-		// Since getting server settings has already failed
-		return serverConf;
-	}
-
-	// Report error to sentry to get idea of possible certificate errors
-	// users get when adding the servers
-	logger.reportSentry(error);
-	const certErrorMessage = Messages.certErrorMessage(domain, error);
-	const certErrorDetail = Messages.certErrorDetail();
-
-	await dialog.showMessageBox({
-		type: 'error',
-		buttons: ['OK'],
-		message: certErrorMessage,
-		detail: certErrorDetail
-	});
-	throw new Error('Untrusted certificate.');
-}
-
 export async function checkDomain(domain: string, silent = false): Promise<ServerConf> {
 	if (!silent && duplicateDomain(domain)) {
 		// Do not check duplicate in silent mode
@@ -120,25 +99,9 @@ export async function checkDomain(domain: string, silent = false): Promise<Serve
 
 	domain = formatUrl(domain);
 
-	const serverConf = {
-		icon: defaultIconUrl,
-		url: domain,
-		alias: domain
-	};
-
 	try {
 		return await getServerSettings(domain);
-	} catch (error_) {
-		// Make sure that error is an error or string not undefined
-		// so validation does not throw error.
-		const error = error_ || '';
-
-		const certsError = error.toString().includes('certificate');
-		if (certsError) {
-			const result = await checkCertError(domain, serverConf, error, silent);
-			return result;
-		}
-
+	} catch {
 		throw new Error(Messages.invalidZulipServerError(domain));
 	}
 }
@@ -162,7 +125,7 @@ export async function updateSavedServer(url: string, index: number): Promise<voi
 			updateDomain(index, newServerConf);
 			reloadDB();
 		}
-	} catch (error) {
+	} catch (error: unknown) {
 		logger.log('Could not update server icon.');
 		logger.log(error);
 		logger.reportSentry(error);
@@ -174,7 +137,7 @@ function reloadDB(): void {
 	try {
 		const file = fs.readFileSync(domainJsonPath, 'utf8');
 		JSON.parse(file);
-	} catch (error) {
+	} catch (error: unknown) {
 		if (fs.existsSync(domainJsonPath)) {
 			fs.unlinkSync(domainJsonPath);
 			dialog.showErrorBox(

app/renderer/js/utils/enterprise-util.ts

@@ -9,7 +9,7 @@ const logger = new Logger({
 });
 
 // TODO: replace enterpriseSettings type with an interface once settings are final
-let enterpriseSettings: {[key: string]: unknown};
+let enterpriseSettings: Record<string, unknown>;
 let configFile: boolean;
 
 reloadDB();
@@ -26,7 +26,7 @@ function reloadDB(): void {
 		try {
 			const file = fs.readFileSync(enterpriseFile, 'utf8');
 			enterpriseSettings = JSON.parse(file);
-		} catch (error) {
+		} catch (error: unknown) {
 			logger.log('Error while JSON parsing global_config.json: ');
 			logger.log(error);
 		}

app/renderer/js/utils/link-util.ts

@@ -3,7 +3,7 @@ import fs from 'fs';
 import os from 'os';
 import path from 'path';
 
-import escape from 'escape-html';
+import {htmlEscape} from 'escape-goat';
 
 export function isUploadsUrl(server: string, url: URL): boolean {
 	return url.origin === server && url.pathname.startsWith('/user_uploads/');
@@ -19,12 +19,12 @@ export async function openBrowser(url: URL): Promise<void> {
 			path.join(os.tmpdir(), 'zulip-redirect-')
 		);
 		const file = path.join(dir, 'redirect.html');
-		fs.writeFileSync(file, `\
+		fs.writeFileSync(file, htmlEscape`\
 <!DOCTYPE html>
 <html>
     <head>
         <meta charset="UTF-8" />
-        <meta http-equiv="Refresh" content="0; url=${escape(url.href)}" />
+        <meta http-equiv="Refresh" content="0; url=${url.href}" />
         <title>Redirecting</title>
         <style>
             html {
@@ -33,7 +33,7 @@ export async function openBrowser(url: URL): Promise<void> {
         </style>
     </head>
     <body>
-        <p>Opening <a href="${escape(url.href)}">${escape(url.href)}</a>…</p>
+        <p>Opening <a href="${url.href}">${url.href}</a>…</p>
     </body>
 </html>
 `);

app/renderer/js/utils/linux-update-util.ts

@@ -47,7 +47,7 @@ function reloadDB(): void {
 	try {
 		const file = fs.readFileSync(linuxUpdateJsonPath, 'utf8');
 		JSON.parse(file);
-	} catch (error) {
+	} catch (error: unknown) {
 		if (fs.existsSync(linuxUpdateJsonPath)) {
 			fs.unlinkSync(linuxUpdateJsonPath);
 			dialog.showErrorBox(

app/renderer/js/utils/logger-util.ts

@@ -133,7 +133,7 @@ export default class Logger {
 		}
 	}
 
-	trimLog(file: string): void{
+	trimLog(file: string): void {
 		fs.readFile(file, 'utf8', (err, data) => {
 			if (err) {
 				throw err;

app/renderer/js/utils/reconnect-util.ts

@@ -1,6 +1,7 @@
 import {ipcRenderer} from 'electron';
 
 import backoff from 'backoff';
+import {htmlEscape} from 'escape-goat';
 
 import type WebView from '../components/webview';
 
@@ -60,7 +61,7 @@ export default class ReconnectUtil {
 		logger.log('There is no internet connection, try checking network cables, modem and router.');
 		const errorMessageHolder = document.querySelector('#description');
 		if (errorMessageHolder) {
-			errorMessageHolder.innerHTML = `
+			errorMessageHolder.innerHTML = htmlEscape`
 						<div>Your internet connection doesn't seem to work properly!</div>
 						<div>Verify that it works and then click try again.</div>`;
 		}

app/renderer/main.html

@@ -61,5 +61,4 @@
         // it messes up require module path resolution
         require('./js/main');
     </script>
-    <script>require('./js/shared/preventdrag.js')</script>
 </html>

app/renderer/preference.html

@@ -16,6 +16,5 @@
     <script>
         document.querySelector('#tagify-css').href = require.resolve('@yaireo/tagify/dist/tagify.css');
         require('./js/pages/preference/preference.js');
-        require('./js/shared/preventdrag.js')
     </script>
 </html>

app/resources/messages.ts

@@ -8,7 +8,7 @@ export function invalidZulipServerError(domain: string): string {
 		\n • You can connect to that URL in a web browser.\
 		\n • If you need a proxy to connect to the Internet, that you've configured your proxy in the Network settings.\
 		\n • It's a Zulip server. (The oldest supported version is 1.6).\
-		\n • The server has a valid certificate. (You can add custom certificates in Settings > Organizations). \
+		\n • The server has a valid certificate. \
 		\n • The SSL is correctly configured for the certificate. Check out the SSL troubleshooting guide -
 		\n https://zulip.readthedocs.io/en/stable/production/ssl-certificates.html`;
 }
@@ -18,15 +18,6 @@ export function noOrgsError(domain: string): string {
 	\nPlease contact your server administrator.`;
 }
 
-export function certErrorMessage(domain: string, error: string): string {
-	return `Certificate error for ${domain}\n${error}`;
-}
-
-export function certErrorDetail(): string {
-	return `The organization you're connecting to is either someone impersonating the Zulip server you entered, or the server you're trying to connect to is configured in an insecure way.
-	\nIf you have a valid certificate please add it from Settings>Organizations and try to add the organization again.`;
-}
-
 export function enterpriseOrgError(length: number, domains: string[]): DialogBoxError {
 	let domainList = '';
 	for (const domain of domains) {

changelog.md

@@ -2,6 +2,41 @@
 
 All notable changes to the Zulip desktop app are documented in this file.
 
+### v5.5.0 --2020-12-01
+
+**Removed features**:
+* Removed legacy handling of custom certificates. Custom certificates can be configured in the same system certificate store that Chrome uses ([instructions](https://zulip.com/help/custom-certificates#desktop)).
+* Removed the unmaintained notification inline replies feature on macOS. We believe the `node-mac-notifier` library used by this feature had been responsible for the grey screen crash issue.
+
+**Fixes**:
+* Fixed a regression with the factory reset function.
+* Fixed the grey screen crash issue on macOS ([#1016](https://github.com/zulip/zulip-desktop/issues/1016)).
+* Whitespace is now stripped from the organization URL when adding a new organization.
+
+**Dependencies**:
+* Upgraded all dependencies, including Electron 11.0.3.
+
+### v5.4.3 --2020-09-10
+
+**Security fixes**:
+* CVE-2020-24582: Escape all strings interpolated into HTML to close cross-site scripting vulnerabilities that a malicious server could exploit.
+
+**Dependencies**:
+* Upgrade dependencies, including Electron 9.3.0.
+
+### v5.4.2 --2020-08-12
+
+**Dependencies**:
+* Upgrade all dependencies, including Electron 9.2.0.
+
+### v5.4.1-beta --2020-07-29
+
+**Fixes**:
+* Resized the large application icon on macOS dock to be coherent with other icons.
+
+**Dependencies**:
+* Upgrade all dependencies, including Electron 9.1.1.
+
 ### v5.4.0 --2020-07-21
 
 **New features**:

package.json

@@ -1,7 +1,7 @@
 {
   "name": "zulip",
   "productName": "Zulip",
-  "version": "5.4.1-beta",
+  "version": "5.5.0",
   "main": "./app/main",
   "description": "Zulip Desktop App",
   "license": "Apache-2.0",
@@ -24,7 +24,7 @@
     "start": "tsc && electron .",
     "clean-ts-files": "git clean app/*.js -e node_modules -xf",
     "watch-ts": "tsc -w",
-    "reinstall": "node ./tools/reinstall-node-modules.js",
+    "reinstall": "rimraf node_modules && npm install",
     "postinstall": "electron-builder install-app-deps",
     "lint-css": "stylelint app/renderer/css/*.css",
     "lint-html": "./node_modules/.bin/htmlhint \"app/renderer/*.html\" ",
@@ -146,58 +146,50 @@
   ],
   "dependencies": {
     "@electron-elements/send-feedback": "^2.0.3",
-    "@sentry/electron": "^1.5.0",
-    "@yaireo/tagify": "^3.15.4",
-    "adm-zip": "^0.4.16",
+    "@sentry/electron": "^2.0.4",
+    "@yaireo/tagify": "^3.21.5",
+    "adm-zip": "^0.5.1",
     "auto-launch": "^5.0.5",
     "backoff": "^2.5.0",
     "electron-is-dev": "^1.2.0",
-    "electron-log": "^4.2.2",
-    "electron-updater": "^4.3.1",
+    "electron-log": "^4.3.0",
+    "electron-updater": "^4.3.5",
     "electron-window-state": "^5.0.3",
-    "escape-html": "^1.0.3",
+    "escape-goat": "^3.0.0",
     "fs-extra": "^9.0.1",
-    "get-stream": "^5.1.0",
-    "i18n": "^0.10.0",
-    "iso-639-1": "^2.1.3",
-    "nan": "^2.14.0",
+    "get-stream": "^6.0.0",
+    "i18n": "^0.13.2",
+    "iso-639-1": "^2.1.4",
     "node-json-db": "^1.1.0",
-    "semver": "^7.3.2"
-  },
-  "optionalDependencies": {
-    "node-mac-notifier": "^1.1.0"
+    "semver": "^7.3.4"
   },
   "devDependencies": {
     "@types/adm-zip": "^0.4.33",
     "@types/auto-launch": "^5.0.1",
     "@types/backoff": "^2.5.1",
-    "@types/escape-html": "^1.0.0",
-    "@types/fs-extra": "^9.0.1",
-    "@types/i18n": "^0.8.6",
-    "@types/node": "^14.0.25",
+    "@types/fs-extra": "^9.0.4",
+    "@types/i18n": "^0.8.8",
+    "@types/node": "^14.14.10",
     "@types/requestidlecallback": "^0.3.1",
-    "@typescript-eslint/eslint-plugin": "^3.7.0",
-    "@typescript-eslint/parser": "^3.7.0",
-    "devtron": "^1.4.0",
     "dotenv": "^8.2.0",
-    "electron": "^9.1.1",
-    "electron-builder": "^22.8.0",
+    "electron": "^11.0.3",
+    "electron-builder": "^22.9.1",
     "electron-connect": "^0.6.3",
     "electron-notarize": "^1.0.0",
     "glob": "^7.1.6",
     "gulp": "^4.0.2",
     "gulp-tape": "^1.0.0",
     "gulp-typescript": "^6.0.0-alpha.1",
-    "htmlhint": "^0.14.1",
-    "nodemon": "^2.0.4",
+    "htmlhint": "^0.14.2",
+    "nodemon": "^2.0.6",
     "pre-commit": "^1.2.2",
     "rimraf": "^3.0.2",
-    "spectron": "^11.1.0",
-    "stylelint": "^13.6.1",
+    "spectron": "^13.0.0",
+    "stylelint": "^13.8.0",
     "tap-colorize": "^1.2.0",
     "tape": "^5.0.1",
-    "typescript": "^3.9.7",
-    "xo": "^0.32.1"
+    "typescript": "^4.1.2",
+    "xo": "^0.35.0"
   },
   "xo": {
     "rules": {
@@ -237,8 +229,7 @@
           "app/renderer/js/injected.ts",
           "gulpfile.js",
           "scripts/notarize.js",
-          "tests/**/*.js",
-          "tools/reinstall-node-modules.js"
+          "tests/**/*.js"
         ],
         "parserOptions": {
           "sourceType": "script"

tests/index.js

@@ -10,7 +10,7 @@ test('app runs', async t => {
 	try {
 		await setup.waitForLoad(app, t);
 		await app.client.windowByIndex(1); // Focus on webview
-		await app.client.waitForExist('//*[@id="connect"]'); // Id of the connect button
+		await (await app.client.$('//*[@id="connect"]')).waitForExist(); // Id of the connect button
 		await setup.endTest(app, t);
 	} catch (error) {
 		await setup.endTest(app, t, error || 'error');

tests/setup.js

@@ -67,6 +67,7 @@ async function wait(ms) {
 
 // Quit the app, end the test, either in success (!err) or failure (err)
 async function endTest(app, t, err) {
+	await app.client.windowByIndex(0);
 	await app.stop();
 	t.end(err);
 }

tests/test-add-organization.js

@@ -10,12 +10,12 @@ test('add-organization', async t => {
 	try {
 		await setup.waitForLoad(app, t);
 		await app.client.windowByIndex(1); // Focus on webview
-		await app.client.setValue('.setting-input-value', 'chat.zulip.org');
-		await app.client.click('#connect');
+		await (await app.client.$('.setting-input-value')).setValue('chat.zulip.org');
+		await (await app.client.$('#connect')).click();
 		await setup.wait(5000);
 		await app.client.windowByIndex(0); // Switch focus back to main win
 		await app.client.windowByIndex(1); // Switch focus back to org webview
-		await app.client.waitForExist('//*[@id="id_username"]');
+		await (await app.client.$('//*[@id="id_username"]')).waitForExist();
 		await setup.endTest(app, t);
 	} catch (error) {
 		await setup.endTest(app, t, error || 'error');

tests/test-new-organization.js

@@ -12,7 +12,7 @@ test('new-org-link', async t => {
 	try {
 		await setup.waitForLoad(app, t);
 		await app.client.windowByIndex(1); // Focus on webview
-		await app.client.click('#open-create-org-link'); // Click on new org link button
+		await (await app.client.$('#open-create-org-link')).click(); // Click on new org link button
 		await setup.wait(5000);
 		await setup.endTest(app, t);
 	} catch (error) {

tools/reinstall-node-modules

@@ -1,9 +0,0 @@
-#!/bin/bash
-set -e
-set -x
-
-echo "Removing node_modules"
-rm -rf node_modules
-
-echo "node_modules removed reinstalling npm packages"
-npm i

tools/reinstall-node-modules.cmd

@@ -1,7 +0,0 @@
-@echo off
-
-echo "Removing node_modules"
-rmdir /s /q node_modules
-
-echo "node_modules removed reinstalling npm packages"
-npm i

tools/reinstall-node-modules.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-const {exec} = require('child_process');
-const path = require('path');
-
-const isWindows = process.platform === 'win32';
-const command = path.join(__dirname, `reinstall-node-modules${isWindows ? '.cmd' : ''}`);
-
-const proc = exec(command, error => {
-	if (error) {
-		console.error(error);
-	}
-});
-
-proc.stdout.on('data', data => console.log(data.toString()));
-proc.stderr.on('data', data => console.error(data.toString()));
-proc.on('exit', code => {
-	process.exit(code);
-});

typings.d.ts

@@ -21,8 +21,6 @@ declare module '@electron-elements/send-feedback' {
 
 declare module 'electron-connect';
 
-declare module 'node-mac-notifier';
-
 declare module '@yaireo/tagify';
 
 interface ClipboardDecrypter {
@@ -32,7 +30,7 @@ interface ClipboardDecrypter {
 }
 
 interface ElectronBridge {
-	send_event: (eventName: string | symbol, ...args: unknown[]) => void;
+	send_event: (eventName: string | symbol, ...args: unknown[]) => boolean;
 	on_event: (eventName: string, listener: ListenerType) => void;
 	new_notification: (
 		title: string,