feat: Disables HTML rendering in Toast by default (#21853)

superset-frontend/src/components/MessageToasts/Toast.tsx

@@ -97,7 +97,7 @@ export default function Toast({ toast, onCloseToast }: ToastPresenterProps) {
       role="alert"
     >
       {icon}
-      <Interweave content={toast.text} />
+      <Interweave content={toast.text} noHtml={!toast.allowHtml} />
       <i
         className="fa fa-close pull-right pointer"
         role="button"

superset-frontend/src/components/MessageToasts/types.ts

@@ -31,4 +31,6 @@ export interface ToastMeta {
   /** Whether to skip displaying this message if there are another toast
    * with the same message. */
   noDuplicate?: boolean;
+  /** For security reasons, HTML rendering is disabled by default. Use this property to enable it. */
+  allowHtml?: boolean;
 }