JSFiddle - React, Tailwind, and code Playground

by philfreo

HTML

Iframe without CSP:<br>
<iframe
sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"></iframe>

<br>

Iframe without sandbox:<br>
<iframe csp="script-src 'none'"></iframe>

JavaScript

const payload = `
Showing <b>HTML</b> email<br>

<base target="_blank">

<a href="javascript:alert(1)">link 1</a>
<br>
<a href="javascript:window.opener.parent.eval('alert(1)')">link 2</a>
`;


const iframes = document.getElementsByTagName('iframe');

Array.prototype.forEach.call(iframes, (iframe) => {
	iframe.setAttribute('srcdoc', payload);
});