inserting html into iframe evals scripts in parent context

[codekitchen]

Related to the new contents() function in jQuery 1.2, domManip doesn't have any idea that the HTML snippet you are inserting is going into an iframe on the page, and it evals any script tags in the parent context, not the iframe context. For example:

$.get("/some/page", function(h) {
  $("iframe").contents().find("#remote").append(h)
})

If the html returned by the ajax request has any script tags, those will be eval'd in the full page even though the html is inserted into the iframe. This happens regardless of whether the html comes from an ajax request or whatever, of course.

[dmethvin]

This is a close cousin of #3105, but with the twist regarding an iframe.

[jitter]

​test case for completeness

[snover]

I believe we decided we are not going to go out of our way to provide fixes for cross-frame activity, such as that which is being described here. This can be reopened by someone else on the team if this is not the case. We’ll be happy to accept any reasonable patches, however.