.append() script string to iframe causes script execution in top window #4518
Description
index.html
<iframe id="frameID" width="200" height="200" srcdoc="<html><body></body></html>"></iframe>
<script>
var hello = 'hello';
window.onload = function() {
var script = "<script type=\"text\/javascript\" src=\"script.js\" async=\"async\"><\/script>";
$('#frameID').contents().find('body').append(script);
}
</script>
script.js
alert(hello)
I expect the script is executed in iframe body