frontend(apps): html component uses iframe for security

frontend/src/lib/components/apps/components/dataDisplay/AppHtml.svelte

@@ -12,17 +12,29 @@
 	export const staticOutputs: string[] = ['result', 'loading']
 
 	let result: string | undefined = undefined
+	let h: number | undefined = undefined
+	let w: number | undefined = undefined
 </script>
 
-<RunnableWrapper flexWrap bind:componentInput {id} bind:result>
-	<AlignWrapper {horizontalAlignment} {verticalAlignment}>
-		<div
-			on:pointerdown={(e) => {
-				e?.preventDefault()
-			}}
-			class="h-full relative w-full overflow-hidden"
+<div
+	on:pointerdown={(e) => {
+		e?.preventDefault()
+	}}
+	class="h-full w-full"
+	bind:clientHeight={h}
+	bind:clientWidth={w}
+>
+	<RunnableWrapper flexWrap bind:componentInput {id} bind:result>
+		<AlignWrapper {horizontalAlignment} {verticalAlignment}>
+			<iframe
+				frameborder="0"
+				style="height: {h}px; width: {w}px"
+				class="p-0"
+				title="sandbox"
+				srcdoc={result
+					? '<scr' + `ipt src="https://cdn.tailwindcss.com"></script>` + result
+					: 'No html'}
+			/></AlignWrapper
 		>
-			{@html result ?? 'No html'}
-		</div>
-	</AlignWrapper>
-</RunnableWrapper>
+	</RunnableWrapper>
+</div>