From c5adb2c35fea6a625d28b1ce32fc25d13e65312f Mon Sep 17 00:00:00 2001
From: siigure <siiigureouo@gmail.com>
Date: Mon, 29 Jun 2026 01:54:57 +0800
Subject: [PATCH] fix: update iframe sandbox attributes to allow scripts for
 HTML preview

---
 projects/app/src/components/Markdown/codeBlock/iframe-html.tsx | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/projects/app/src/components/Markdown/codeBlock/iframe-html.tsx b/projects/app/src/components/Markdown/codeBlock/iframe-html.tsx
index cacfb57c351a..4668593b17ea 100644
--- a/projects/app/src/components/Markdown/codeBlock/iframe-html.tsx
+++ b/projects/app/src/components/Markdown/codeBlock/iframe-html.tsx
@@ -123,7 +123,8 @@ const StyledButton = ({
 const HtmlPreviewIframe = ({ code }: { code: string }) => (
   <iframe
     srcDoc={code}
-    sandbox="allow-popups"
+    // 预览需要执行用户生成 HTML 内的 JS，但不开放 allow-same-origin，避免脚本拿到主站上下文。
+    sandbox="allow-scripts allow-popups"
     referrerPolicy="no-referrer"
     style={{
       display: 'block',