XSS vulnerability found via <iframe> src attribute #701

Test Environment:
Firefox Quantum 67.0.3/Chrome 75.0.3770.100/Safari 12.1.1

Description:
User can use <iframe> src attribute to insert malicious javascript codes, and then execute it.

Reproduce steps

1. go to https://pandao.github.io/editor.md/en.html or any open editor.md apps
2. in the edit mode, input the following malicious codes

<iframe src=javascript://%0aalert(document.cookie)>

Expected Results
No malicious javascript codes should be executed

Actual Results
The malicious codes are executed