title: textarea sets content of iframe - security with CodeMirror
body: <p>I'm using CodeMirror to make a project similar to JSFiddle. Referencing <a href="https://codemirror.net/demo/preview.html" rel="nofollow noreferrer">this example file</a> from CodeMirror, I'm rendering full HTML content from a textarea (including script tags from external javascript files). </p>
  
  <p>It's all working well locally, but before deploying, isn't there a security threat to rendering a full HTML page from user-defined input? How is the example above not a security threat? </p>