set sandbox to "allow-..." only when a noscript tag is found

lib/single-file/single-file-core.js

@@ -280,6 +280,7 @@ this.SingleFileCore = this.SingleFileCore || (() => {
 	// ------------
 	const EMPTY_DATA_URI = "data:base64,";
 	const EMPTY_IMAGE = "data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==";
+	const NOSCRIPT_TAG_FOUND = /<noscript/gi;
 
 	class DOMProcessor {
 		constructor(options, batchRequest) {
@@ -711,7 +712,6 @@ this.SingleFileCore = this.SingleFileCore || (() => {
 				const frameElements = Array.from(this.doc.querySelectorAll("iframe, frame, object[type=\"text/html\"][data]"));
 				await Promise.all(frameElements.map(async frameElement => {
 					DomProcessorHelper.setFrameEmptySrc(frameElement);
-					frameElement.setAttribute("sandbox", "allow-scripts allow-same-origin");
 					const frameWindowId = frameElement.getAttribute(DOM.windowIdAttributeName(this.options.sessionId));
 					if (frameWindowId) {
 						const frameData = this.options.framesData.find(frame => frame.windowId == frameWindowId);
@@ -756,6 +756,11 @@ this.SingleFileCore = this.SingleFileCore || (() => {
 								await frameData.processor.preparePageData();
 								const pageData = await frameData.processor.getPageData();
 								frameElement.removeAttribute(DOM.windowIdAttributeName(this.options.sessionId));
+								if (pageData.content.match(NOSCRIPT_TAG_FOUND)) {
+									frameElement.setAttribute("sandbox", "allow-scripts allow-same-origin");
+								} else {
+									frameElement.setAttribute("sandbox", "");
+								}
 								DomProcessorHelper.setFrameContent(frameElement, pageData.content);
 								this.stats.addAll(pageData);
 							} else {