Add html component

[wwwillchen]

This allows you to render sanitized HTML, however it doesn't allow potentially dangerous HTML like JavaScript.

In a separate PR, I'll update the embed component so you can essentially do an <iframe srcdoc="$htmlcontent">, which will allow you to run arbitrary JS in a sandboxed way.

Partially addresses #156.

[richard-to]

1. There's no styling inside the iframe. Should we inject the stylesheet in here?

What do you mean by "inject the stylesheet"?

When using the iframe with source doc, is the user able to reference assets (Javascript, CSS) from other domains or would they need to reference from same domain? Or is that not allowed for security reasons?

I guess if linking to external resources is not allowed, then one could write the js/css in the html head. Probably not that user friendly, but since this is an advanced use case, probably ok. Although would be hard to manage.

2. The iframe height is arbitrary (browser default). Should we try to automatically resize the iframe based on the content or should Mesop app developers set a height?

I think the app developer should able to set the height. So if there is auto resize as a default and the user could resize as an override, that may be more convenient.

[richard-to]

LGTM

[richard-to]

[nit] Looks like these are pointing to "link" when it should be html?

[wwwillchen]

will re-open once I've been able to address the comments.

[wwwillchen]

@richard-to could you take another look? I updated this PR quite a bit and switched to sanitizing the HTML instead of iframing the HTML (I'll try this approach in a separate #405). This is better for some use cases because it gets rendered in the same frame, but it doesn't support JS so it's not that flexible.

[richard-to]

LGTM - Just to make sure I understand. The HTML component here renders HTML directly without an iframe. But it is sanitized so no javascript and other malicious stuff can be added?

[wwwillchen]

LGTM - Just to make sure I understand. The HTML component here renders HTML directly without an iframe. But it is sanitized so no javascript and other malicious stuff can be added?

Yup, that's right. Right now we've been telling people to use me.markdown as a way to render sanitized HTML, which is 1) kind of confusing (since it's not obvious to most developers) and 2) kind of annoying since markdown adds a <p> which adds margin, and having a raw div makes it more straightforward to style.

I think we still need JS for a bunch of use cases, so we'll need to handle that separately.