html(str) shouldn't try so hard to insert script tags - especially in iframes

[kapouer@…]

I've been bitten by this behaviour two times :

• one doing server-side scripting using jsdom, resulting in having foreign script tags executed in an environment they shouldn't have been,
• one doing $(mySandboxedIframeContentDocument).html(str), jquery is inserting the <script> in str in the current window when i am trying hard at inserting html safely in a sandboxed iframe.

Shouldn't we at least have a global option to disable this script insertion ?

[mikesherov]

Duplicate of #11795.