feat: Disables HTML rendering in Toast by default (#21853)

(cherry picked from commit 47b1e0c)
apache · Nov 18, 2022 · 68a3896 · 68a3896
1 parent b238d04
commit 68a3896
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/superset-frontend/src/components/MessageToasts/Toast.tsx b/superset-frontend/src/components/MessageToasts/Toast.tsx
@@ -97,7 +97,7 @@ export default function Toast({ toast, onCloseToast }: ToastPresenterProps) {
       role="alert"
     >
       {icon}
-      <Interweave content={toast.text} />
+      <Interweave content={toast.text} noHtml={!toast.allowHtml} />
       <i
         className="fa fa-close pull-right pointer"
         role="button"

diff --git a/superset-frontend/src/components/MessageToasts/types.ts b/superset-frontend/src/components/MessageToasts/types.ts
@@ -31,4 +31,6 @@ export interface ToastMeta {
   /** Whether to skip displaying this message if there are another toast
    * with the same message. */
   noDuplicate?: boolean;
+  /** For security reasons, HTML rendering is disabled by default. Use this property to enable it. */
+  allowHtml?: boolean;
 }