The js in the < script > tag added within iframe does not execute?

I created an iframe element to add to the page, and added the acquired html content and the js script to the body of iframe, but the script in script will not be executed. is this the security policy of iframe in the browser? Is there a way to make scripts in script execute?

Mar.24,2021

is indeed a new security policy for HTML 4.01.


through dynamic insertion, the script can be executed, but it cannot be executed directly.

var ifr = document.createElement('iframe');
    ifr.id = 'uiui'
    document.body.append(ifr)
    var ifrBody = document.getElementById('uiui').contentDocument.body;
    var script = document.getElementById('uiui').contentDocument.createElement('script');
    script.innerHTML = `
      var p = document.createElement('p');
      p.innerHTML = 'o_o'
      document.body.appendChild(p);
    `;
    document.getElementById('uiui').contentDocument.body.appendChild(script);
Menu