textarea设置iframe的内容-CodeMirror的安全性

Question

I'm using CodeMirror to make a project similar to JSFiddle. Referencing this example file from CodeMirror, I'm rendering full HTML content from a textarea (including script tags from external javascript files).

It's all working well locally, but before deploying, isn't there a security threat to rendering a full HTML page from user-defined input? How is the example above not a security threat?

Answer 1

It can be a security issue if you execute user-defined input inside on your application domain.

For example, 1) JS Bin executes user code on a different domain. The given code will make it clear. alert(document.URL) https://jsbin.com/xezusur/edit?html,js,output

2) Even, JS Fiddle executes code in an iframe on a different URL https://jsfiddle.net/djadmin/zrks3reg/

As you can see in both the examples given above, the user code is executed on a different domain. Thus, it prevents user input from accessing resources on different domain due to Same Origin Policy.