From ec9763de66641e183e108d94d84267b508579db4 Mon Sep 17 00:00:00 2001
From: Lars <lars@serlo.org>
Date: Wed, 20 Mar 2024 12:07:47 +0100
Subject: [PATCH] feat(edusharing-asset): Render content where no type could be
 determined in iframe

Using an iframe as a backup might be safer compared to `dangerouslySetInnerHtml` because <script> tags will get executed.
---
 src/frontend/plugins/edusharing-asset/renderer.tsx | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/frontend/plugins/edusharing-asset/renderer.tsx b/src/frontend/plugins/edusharing-asset/renderer.tsx
index 4d1c16f9..6d8a7025 100644
--- a/src/frontend/plugins/edusharing-asset/renderer.tsx
+++ b/src/frontend/plugins/edusharing-asset/renderer.tsx
@@ -277,10 +277,13 @@ export function EdusharingAssetRenderer(props: {
       }
     }
 
-    // If the detailsSnipped was not handled by one of the handlers above, change nothing in html snippet
+    // Backup when content type could not be determined above -> Render in iframe with iframe-resizer.
+    // This will make sure <script> tags execute. They would not if using 'dangerously-set-inner-html'
     return {
-      html: detailsSnippet,
-      renderMethod: 'dangerously-set-inner-html',
+      html:
+        detailsSnippet +
+        '<script type="text/javascript" src="https://cdnjs.cloudflare.com/ajax/libs/iframe-resizer/4.3.9/iframeResizer.contentWindow.min.js"></script>',
+      renderMethod: 'iframe',
       defineContainerHeight: false,
     }
   }