Force the contents to be executed in a sandbox

Author: dtdesign

ts/WoltLabSuite/Core/Ajax/Error.ts

@@ -93,6 +93,7 @@ async function getErrorHtml(error: ApiError): Promise<string | HTMLIFrameElement
         // The content is possibly HTML, use an iframe for rendering.
         const iframe = document.createElement("iframe");
         iframe.classList.add("dialog__iframe");
+        iframe.sandbox = "";
         iframe.srcdoc = message;
 
         return iframe;

ts/WoltLabSuite/Core/Ajax/Request.ts

@@ -350,6 +350,7 @@ class AjaxRequest {
       // The content is possibly HTML, use an iframe for rendering.
       const iframe = document.createElement("iframe");
       iframe.classList.add("dialog__iframe");
+      iframe.sandbox = "";
       iframe.srcdoc = xhr.responseText;
 
       return iframe;