Update HTML parser to use an IFRAME

Gives us better sandboxing of unsafe HTML content

core/modules/parsers/htmlparser.js

@@ -13,9 +13,18 @@ The HTML parser displays text as raw HTML
 "use strict";
 
 var HtmlParser = function(type,text,options) {
+	var src;
+	if(options._canonical_uri) {
+		src = options._canonical_uri;
+	} else if(text) {
+		src = "data:text/html," + encodeURIComponent(text);
+	}
 	this.tree = [{
-		type: "raw",
+		type: "element",
-		html: text
+		tag: "iframe",
+		attributes: {
+			src: {type: "string", value: src}
+		}
 	}];
 };
 

themes/tiddlywiki/vanilla/base.tid

@@ -117,11 +117,16 @@ table tfoot tr td {
 	white-space: nowrap;
 }
 
-.tw-tiddler-frame img, .tw-tiddler-frame svg, .tw-tiddler-frame canvas, .tw-tiddler-frame embed {
+.tw-tiddler-frame img,
+.tw-tiddler-frame svg,
+.tw-tiddler-frame canvas,
+.tw-tiddler-frame embed,
+.tw-tiddler-frame iframe {
 	max-width: 100%;
 }
 
-.tw-tiddler-frame embed {
+.tw-tiddler-frame embed,
+.tw-tiddler-frame iframe {
 	width: 100%;
 	height: 600px;
 }