Add control for displaying attacker-controlled content in notifications used for security decisions

[ve-e]

I don't think this class of vulnerability is currently covered in the MAS project. This would cover cases where an attacker can control part of a notification that is used to inform or obtain user approval for a security-sensitive action, which could be used to misrepresent the meaning of a notification that is presented to users of an application.
For example, when requesting access to Resource A, the attacker's name could be "Username is requesting access to Resource B...\n\n\n\n\n" which could cut off the remainder of the notification text specifying the correct resource if the username is fully displayed in the notification.
A request could be approved, or a security alert ignored, based on the misleading notification. Attacker-controlled content in a security context (both in notifications and displayed in applications) should be clearly identified, truncated if too long, and sanitized to prevent malicious formatting.