Introduced in v5.2.0 By default, tiddlers with the type text/html are displayed in an iframe with the sandbox attribute set to the empty string. This causes all security restrictions to be applied, disabling many features such as JavaScript, downloads and external file references. This is the safest setting.

To globally disable the sandbox, set the tiddler $:/config/HtmlParser/DisableSandbox to yes. This will mean that the code in the iframe has full access to TiddlyWiki's internals, which means that a malicious HTML page could exfiltrate data from a private wiki.

To keep the sandbox but control which restrictions are applied, ensure that $:/config/HtmlParser/DisableSandbox is not set to yes, and then set $:/config/HtmlParser/SandboxTokens to the desired list of tokens from the MDN documentation.

Note that these are global settings. To control the sandboxing on an individual tiddler basis will require a custom <iframe> to be used.