XSS via <iframe srcdoc>

[tosmolka]

Hi, not sure if this a known issue and accepted risk for this library or not.

It seems the playground environment at https://markdown-to-jsx.quantizor.dev/ permits <iframe> element and srcdoc tag. This can be turned into XSS/arbitrary JS code execution.

How can an app that uses markdown-to-jsx library protect against these types of threats? Set disableParsingRawHTML to true? Anything else?

Is this dangerous behavior enabled by default? Would it be possible to implement secure defaults (a.k.a. "Secure by Default") so that security protections are enabled and enforced by default and users have a way to opt-out if needed?

Thank you.

[Akshay090]

another test snippet for this issue

<IFRAME
SRC="javascript:alert(document
.domain);"></IFRAME>