Potential fix for code scanning alert no. 1821: DOM text reinterpreted as HTML

ajay-dhangar · github-advanced-security[bot] · web-flow · commit 43059410c59e · 2026-01-31T21:27:10.000+05:30
Co-authored-by: Copilot Autofix powered by AI &lt;62310815+github-advanced-security[bot]@users.noreply.github.com&gt;
diff --git a/src/pages/LiveEditor/BasicEditor.tsx b/src/pages/LiveEditor/BasicEditor.tsx
@@ -26,12 +26,6 @@ const BasicEditor = () => {
     }
 
     const iframe = iframeRef.current;
-    const document = iframe.contentDocument;
-
-    if (!document) {
-      alert("iframe contentDocument is not available");
-      return;
-    }
 
     const documentContents = `
       <!DOCTYPE html>
@@ -46,9 +40,7 @@ const BasicEditor = () => {
       </html>
     `;
 
-    document.open();
-    document.write(documentContents);
-    document.close();
+    iframe.srcdoc = documentContents;
   }, [html, css, js]);
 
   return (
@@ -210,7 +202,12 @@ const BasicEditor = () => {
           </div>
         </div>
 
-        <iframe ref={iframeRef} className="output_container" id="preview" />
+        <iframe
+          ref={iframeRef}
+          className="output_container"
+          id="preview"
+          sandbox="allow-scripts"
+        />
       </div>
     </div>
   );
