Draft: Frontend <iframe> hardening

Asherah Connorrequested to merge
kiv/frontend-iframe-hardening into kiv/remove-dead-iframe-transform-code

What does this MR do and why?

MR stack

MR 6/9 of Rework <iframe> embed configuration (#599713):

  1. Add `<iframe>` provider model and parser (!254943 - merged)
  2. Add `<iframe>` provider loader and base config (!254944 - merged)
  3. Convert `<iframe>` allowlist setting to provide... (!254945)
  4. Draft: Move to `<iframe>` providers (!254946)
  5. Draft: Remove dead `<iframe>` transform code (!254947)
  6. Draft: Frontend `<iframe>` hardening (!254948) ⬅️ you are here
  7. Draft: Click-to-activate functionality for `<if... (!254949)
  8. Draft: Admin UI for `<iframe>` providers (!254950)
  9. Draft: Mark `<iframe>` provider loader and conf... (!255246)

Part of <iframe> embeds in Markdown content (#282443).

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Edited by Asherah Connor

Merge request reports