From 0893afd26b7df8cfd30d1342d3c89830a2b67840 Mon Sep 17 00:00:00 2001
From: AnnMarieW <amward@fastmail.us>
Date: Sun, 27 Jun 2021 09:27:25 -0700
Subject: [PATCH 1/3] Allow HTML content in Markdown cells

---
 src/dash-table/components/Table/props.ts |  1 +
 src/dash-table/dash/DataTable.js         |  9 ++++--
 tests/selenium/test_markdown_html.py     | 38 ++++++++++++++++++++++++
 3 files changed, 46 insertions(+), 2 deletions(-)
 create mode 100644 tests/selenium/test_markdown_html.py

diff --git a/src/dash-table/components/Table/props.ts b/src/dash-table/components/Table/props.ts
index aa7249bd7..71aef1894 100644
--- a/src/dash-table/components/Table/props.ts
+++ b/src/dash-table/components/Table/props.ts
@@ -163,6 +163,7 @@ export interface INumberLocale {
 
 export interface IMarkdownOptions {
     link_target: '_blank' | '_parent' | '_self' | '_top' | string;
+    html?: boolean;
 }
 
 export type NumberFormat =
diff --git a/src/dash-table/dash/DataTable.js b/src/dash-table/dash/DataTable.js
index 53ca225e3..c75132b86 100644
--- a/src/dash-table/dash/DataTable.js
+++ b/src/dash-table/dash/DataTable.js
@@ -67,7 +67,8 @@ export const defaultProps = {
     },
 
     markdown_options: {
-        link_target: '_blank'
+        link_target: '_blank',
+        html: false
     },
 
     tooltip: {},
@@ -483,7 +484,11 @@ export const propTypes = {
         link_target: PropTypes.oneOfType([
             PropTypes.string,
             PropTypes.oneOf(['_blank', '_parent', '_self', '_top'])
-        ]).isRequired
+        ]),
+        /**
+         * (default: False)  If True, html may be used in markdown cells
+         */
+        html: PropTypes.bool
     }),
 
     /**
diff --git a/tests/selenium/test_markdown_html.py b/tests/selenium/test_markdown_html.py
new file mode 100644
index 000000000..b9a316302
--- /dev/null
+++ b/tests/selenium/test_markdown_html.py
@@ -0,0 +1,38 @@
+import dash
+from dash_table import DataTable
+
+
+def get_app(markdown_options):
+
+    app = dash.Dash(__name__)
+
+    props = dict(
+        id="table",
+        columns=[dict(name="a", id="a", type="text", presentation="markdown")],
+        data=[dict(a="<h1>html h1 heading</h1>")],
+    )
+
+    if markdown_options is not None:
+        props["markdown_options"] = markdown_options
+
+    app.layout = DataTable(**props)
+
+    return app
+
+
+def test_tmdh001_html_not_allowed(test):
+    test.start_server(get_app(None))
+
+    h1_elements = test.find_elements("h1")
+
+    assert len(h1_elements) == 0
+    assert test.get_log_errors() == []
+
+
+def test_tmdh002_html_allowed(test):
+    test.start_server(get_app(dict(html=True)))
+
+    h1_elements = test.find_elements("h1")
+
+    assert len(h1_elements) == 1
+    assert test.get_log_errors() == []

From ccac755b23d8f57315aa0a1b21ecd32720b5357b Mon Sep 17 00:00:00 2001
From: AnnMarieW <amward@fastmail.us>
Date: Mon, 28 Jun 2021 08:36:30 -0700
Subject: [PATCH 2/3] Allow HTML content in Markdown cells - Changelog

---
 CHANGELOG.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 628299e9f..daa95ba03 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,9 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 
 ### Added
+- [#916](https://github.com/plotly/dash-table/pull/916) 
+  - Added `html` option to `markdown_options` prop. This enables the use of html tags in markdown text.
+  
 - [#545](https://github.com/plotly/dash-table/issues/545)
     - Case insensitive filtering
     - New props: `filter_options` - to control case of all filters, `columns.filter_options` - to control filter case for each column

From a9c3981dbe05c8ed8367b6f730a165503702a7f5 Mon Sep 17 00:00:00 2001
From: AnnMarieW <72614349+AnnMarieW@users.noreply.github.com>
Date: Mon, 28 Jun 2021 09:14:30 -0700
Subject: [PATCH 3/3] Update src/dash-table/dash/DataTable.js

Add XSS vulnerability warning

Co-authored-by: Alex Johnson <johnson.alex.c@gmail.com>
---
 src/dash-table/dash/DataTable.js | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/dash-table/dash/DataTable.js b/src/dash-table/dash/DataTable.js
index c75132b86..0132fb62b 100644
--- a/src/dash-table/dash/DataTable.js
+++ b/src/dash-table/dash/DataTable.js
@@ -487,6 +487,8 @@ export const propTypes = {
         ]),
         /**
          * (default: False)  If True, html may be used in markdown cells
+         * Be careful enabling html if the content being rendered can come
+         * from an untrusted user, as this may create an XSS vulnerability.
          */
         html: PropTypes.bool
     }),