Potential sandbox bypass in docs iframe examples

Summary

A documentation example iframe is rendered without a restrictive sandbox attribute. Because the iframe content executes script from the example source, a malicious snippet could access the parent window and modify the surrounding documentation page.

Impact

A crafted example could potentially manipulate the parent DOM, alter page content, or trigger unexpected behavior for users viewing the docs.

Steps to reproduce

1. Open a documentation page that renders a code block example inside the iframe-based chart component.
2. Include a snippet that runs in the iframe context, for example:
   javascript复制

   window.parent.document.body.innerHTML = "<h1>pwned</h1>";

3. Observe that the parent page can be modified.

Proposed mitigation

Add a sandbox attribute to the iframe, for example:

<iframe
  srcDoc={srcDoc}
  sandbox="allow-scripts"
/>

Notes

I also added a regression test to ensure the sandbox attribute remains present.