plugins/bootstrap-wysihtml5/bootstrap3-wysihtml5.all.js
function() {
      var that   = this,
          iframe = doc.createElement("iframe");
      iframe.className = "wysihtml5-sandbox";
      wysihtml5.dom.setAttributes({
        "security":           "restricted",
        "allowtransparency":  "true",
        "frameborder":        0,
        "width":              0,
        "height":             0,
        "marginwidth":        0,
        "marginheight":       0
      }).on(iframe);

      // Setting the src like this prevents ssl warnings in IE6
      if (wysihtml5.browser.throwsMixedContentWarningWhenIframeSrcIsEmpty()) {
        iframe.src = "javascript:'<html></html>'";
      }

      iframe.onload = function() {
        iframe.onreadystatechange = iframe.onload = null;
        that._onLoadIframe(iframe);
      };

      iframe.onreadystatechange = function() {
        if (/loaded|complete/.test(iframe.readyState)) {
          iframe.onreadystatechange = iframe.onload = null;
          that._onLoadIframe(iframe);
        }
      };

      return iframe;
    }
function() {
      var that   = this,
          iframe = doc.createElement("iframe");
      iframe.className = "wysihtml5-sandbox";
      wysihtml5.dom.setAttributes({
        "security":           "restricted",
        "allowtransparency":  "true",
        "frameborder":        0,
        "width":              0,
        "height":             0,
        "marginwidth":        0,
        "marginheight":       0
      }).on(iframe);

      // Setting the src like this prevents ssl warnings in IE6
      if (wysihtml5.browser.throwsMixedContentWarningWhenIframeSrcIsEmpty()) {
        iframe.src = "javascript:'<html></html>'";
      }

      iframe.onload = function() {
        iframe.onreadystatechange = iframe.onload = null;
        that._onLoadIframe(iframe);
      };

      iframe.onreadystatechange = function() {
        if (/loaded|complete/.test(iframe.readyState)) {
          iframe.onreadystatechange = iframe.onload = null;
          that._onLoadIframe(iframe);
        }
      };

      return iframe;
    }
function ( ) { var that = this , iframe = doc . createElement ( "iframe" ) ; iframe . className = "wysihtml5-sandbox" ; wysihtml5 . dom . setAttributes ( { "security" : "restricted" , "allowtransparency" : "true" , "frameborder" : 0 , "width" : 0 , "height" : 0 , "marginwidth" : 0 , "marginheight" : 0 } ) . on ( iframe ) ; // Setting the src like this prevents ssl warnings in IE6 if ( wysihtml5 . browser . throwsMixedContentWarningWhenIframeSrcIsEmpty ( ) ) { iframe . src = "javascript:'<html></html>'" ; } iframe . onload = function ( ) { iframe . onreadystatechange = iframe . onload = null ; that . _onLoadIframe ( iframe ) ; } ; iframe . onreadystatechange = function ( ) { if ( / loaded|complete / . test ( iframe . readyState ) ) { iframe . onreadystatechange = iframe . onload = null ; that . _onLoadIframe ( iframe ) ; } } ; return iframe ; }
Creates the sandbox iframe

Some important notes:
- We can't use HTML5 sandbox for now:
setting it causes that the iframe's dom can't be accessed from the outside
Therefore we need to set the "allow-same-origin" flag which enables accessing the iframe's dom
But then there's another problem, DOM events (focus, blur, change, keypress, ...) aren't fired.
In order to make this happen we need to set the "allow-scripts" flag.
A combination of allow-scripts and allow-same-origin is almost the same as setting no sandbox attribute at all.
- Chrome & Safari, doesn't seem to support sandboxing correctly when the iframe's html is inlined (no physical document)
- IE needs to have the security="restricted" attribute set before the iframe is
inserted into the dom tree
- Believe it or not but in IE "security" in document.createElement("iframe") is false, even
though it supports it
- When an iframe has security="restricted", in IE eval() & execScript() don't work anymore
- IE doesn't fire the onload event when the content is inlined in the src attribute, therefore we rely
on the onreadystatechange event
Creates the sandbox iframe