[MessageBar] HTML and Script can be injected into MessageBar Title

src/Core/Components/MessageBar/FluentMessageBar.razor

@@ -17,15 +17,31 @@
             <div class="fluent-messagebar-message">
                 @if (!String.IsNullOrEmpty(Title))
                 {
-                    <span class="title">@((MarkupString)Title)</span>
+                    <span class="title">
+                        @if (Content?.UseMarkupString == true)
+                        {
+                            @((MarkupString)Title)
+                        }
+                        else
+                        {
+                            @Title
+                        }
+                    </span>
                 }
                 @if (ChildContent is not null)
                 {
                     @ChildContent
                 }
                 else
                 {
-                    @((MarkupString)Content!.Body!)
+                    @if (Content?.UseMarkupString == true)
+                    {
+                        @((MarkupString)Content!.Body!)
+                    }
+                    else
+                    {
+                        @(Content!.Body)
+                    }
                 }
                 @if (Link is not null)
                 {
@@ -84,7 +100,14 @@
             @if (!String.IsNullOrEmpty(Title))
             {
                 <div class="fluent-messagebar-notification-message" title="@Title">
-                    @((MarkupString)(Title))
+                    @if (Content?.UseMarkupString == true)
+                    {
+                        @((MarkupString)Title)
+                    }
+                    else
+                    {
+                        @Title
+                    }
                 </div>
             }
 
@@ -105,7 +128,14 @@
                 @ChildContent
                 @if (!String.IsNullOrEmpty(Content?.Body))
                 {
-                    @((MarkupString)Content.Body)
+                    @if (Content?.UseMarkupString == true)
+                    {
+                        @((MarkupString)Content.Body)
+                    }
+                    else
+                    {
+                        @Content?.Body
+                    }
                 }
                 @if (Link is not null)
                 {

src/Core/Components/MessageBar/Message.cs

@@ -52,6 +52,13 @@ public string? Title
         }
     }
 
+    /// <summary>
+    /// Indicates whether the title and body should be rendered as markup string.
+    /// Using MarkupString can introduce XSS vulnerabilities because it renders unencoded HTML.
+    /// Only use it with fully trusted, sanitized content.
+    /// </summary>
+    internal bool UseMarkupString => Options.UseMarkupString;
+
     /// <summary>
     /// Gets or sets the message to be shown in the message bar.
     /// </summary>

src/Core/Components/MessageBar/Services/IMessageService.cs

@@ -2,6 +2,8 @@
 // This file is licensed to you under the MIT License.
 // ------------------------------------------------------------------------
 
+using Microsoft.AspNetCore.Components;
+
 namespace Microsoft.FluentUI.AspNetCore.Components;
 
 /// <summary />
@@ -28,6 +30,9 @@ public interface IMessageService : IDisposable
     /// <summary />
     Message ShowMessageBar(string title, MessageIntent intent, string section);
 
+    /// <summary />
+    Message ShowMessageBar(MarkupString title, MessageIntent intent, string section);
+
     /// <summary />
     Task<Message> ShowMessageBarAsync(Action<MessageOptions> options);
 
@@ -40,6 +45,9 @@ public interface IMessageService : IDisposable
     /// <summary />
     Task<Message> ShowMessageBarAsync(string title, MessageIntent intent, string section);
 
+    /// <summary />
+    Task<Message> ShowMessageBarAsync(MarkupString title, MessageIntent intent, string section);
+
     /// <summary />
     void Clear(string? section = null);
 

src/Core/Components/MessageBar/Services/MessageOptions.cs

@@ -29,6 +29,13 @@ public class MessageOptions
     /// </summary>
     public string? Title { get; set; }
 
+    /// <summary>
+    /// Indicates whether the <see cref="Title"/> and <see cref="Body"/> should be rendered as markup string.
+    /// Using MarkupString can introduce XSS vulnerabilities because it renders unencoded HTML.
+    /// Only use it with fully trusted, sanitized content.
+    /// </summary>
+    public bool UseMarkupString { get; set; } = false;
+
     /// <summary>
     /// Gets or sets the message to be shown in the message bar after the title.
     /// </summary>

src/Core/Components/MessageBar/Services/MessageService.cs

@@ -125,6 +125,26 @@ public Message ShowMessageBar(string title, MessageIntent intent, string section
         });
     }
 
+    /// <summary>
+    /// Show a message based on the provided parameters in a message bar.
+    /// </summary>
+    /// <param name="title"> Main info. 
+    /// Using MarkupString can introduce XSS vulnerabilities because it renders unencoded HTML.
+    /// Only use it with fully trusted, sanitized content.</param>
+    /// <param name="intent">Intent of the message</param>
+    /// <param name="section">Section to show the message bar in </param>
+    /// <returns></returns>
+    public Message ShowMessageBar(MarkupString title, MessageIntent intent, string section)
+    {
+        return ShowMessageBar(options =>
+        {
+            options.Title = title.Value;
+            options.UseMarkupString = true;
+            options.Intent = intent;
+            options.Section = section;
+        });
+    }
+
     /// <summary>
     /// Show a message based on the provided options in a message bar.
     /// </summary>
@@ -200,6 +220,26 @@ public async Task<Message> ShowMessageBarAsync(string title, MessageIntent inten
         });
     }
 
+    /// <summary>
+    /// Show a message based on the provided parameters in a message bar.
+    /// </summary>
+    /// <param name="title"> Main info. 
+    /// Using MarkupString can introduce XSS vulnerabilities because it renders unencoded HTML.
+    /// Only use it with fully trusted, sanitized content.</param>
+    /// <param name="intent">Intent of the message</param>
+    /// <param name="section">Section to show the message bar in </param>
+    /// <returns></returns>
+    public async Task<Message> ShowMessageBarAsync(MarkupString title, MessageIntent intent, string section)
+    {
+        return await ShowMessageBarAsync(options =>
+        {
+            options.Title = title.Value;
+            options.UseMarkupString = true;
+            options.Intent = intent;
+            options.Section = section;
+        });
+    }
+
     /// <summary>
     /// Show a message based on the provided message options in a message bar.
     /// </summary>