Allow HTML in alert modals

[abidlabs]

Allows HTML in gr.Info(), gr.Warning(), gr.Error(), etc.

import gradio as gr
import time

def show():
    gr.Info("Please visit <a href='https://hf.co' target='_blank'>Hugging Face</a> for free datasets.", duration=100)
    time.sleep(1)
    return "Hello"


gr.Interface(show, None, "textbox").launch()

Context: internal link. cc @gary149 @julien-c

Note: downstream clients who receive a gr.Error will see the original raw html string, but I don't think that's a problem.

[gradio-pr-bot]

🪼 branch checks and previews

•	Name	Status	URL
	Spaces	ready!	Spaces preview
	Website	failed!	Details
	Storybook	ready!	Storybook preview
🦄	Changes	detecting...

---

Install Gradio from this PR

pip install https://gradio-builds.s3.amazonaws.com/e732b3b6a8f375788e18979e3e6fab1bc064aaa7/gradio-4.38.1-py3-none-any.whl

Install Gradio Python Client from this PR

pip install "gradio-client @ git+https://github.com/gradio-app/gradio@e732b3b6a8f375788e18979e3e6fab1bc064aaa7#subdirectory=client/python"

Install Gradio JS Client from this PR

npm install https://gradio-builds.s3.amazonaws.com/e732b3b6a8f375788e18979e3e6fab1bc064aaa7/gradio-client-1.3.0.tgz

[gradio-pr-bot]

🦄 change detected

This Pull Request includes changes to the following packages.

Package	Version
@gradio/statustracker	patch
gradio	patch

• Maintainers can select this checkbox to manually select packages to update.

With the following changelog entry.

Allow HTML in alert modals

Maintainers or the PR author can modify the PR title to modify this entry.

Something isn't right?

• Maintainers can change the version label to modify the version bump.
• If the bot has failed to detect any changes, or if this pull request needs to update multiple packages to different versions or requires a more comprehensive changelog entry, maintainers can update the changelog file directly.

[pngwn]

Is this safe? Is there a scenario in which an error message is being embedded in the returned HTML and a user could manipulate this process and inject something harmful, either directly or via a mitm attack?

At the very least we need to escape the HTML.

[abidlabs]

Ok @pngwn I am now sanitizing the HTML, which at least makes this consistent with our other Markdown or HTML-based components. Let me know if you have any further suggestions, thanks!

[pngwn]

Looks great. Thanks @abidlabs!