JSFiddle - React, Tailwind, and code Playground

by philfreo

HTML

Iframe without CSP:<br>
<iframe
  xsandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox">
  </iframe>

JavaScript

const payload = `
Showing <b>HTML</b> email

<a href="javascript:alert(1)">link 1</a>
<br>
<a href="javascript:window.opener.parent.eval('alert(1)')">link 2</a>
`;


const iframe = document.getElementsByTagName('iframe')[0];

iframe.setAttribute('srcdoc', payload);