To add to Matthew Herbst's answer, we also use HTML 5 sandboxed iframes allowing only scripts as a redundant security feature. Any browser that doesn't support sandboxing won't render Stack Snippets at all. Additionally, running the code on a different domain prevents the same-origin policy from being in effect, blocking all access to your user information on Stack Exchange sites. As for XSS - someone could try to write a Stack Snippet that XSS'd a third site, however form submission is disabled as well.
HTML 5 sandboxed iframes create the following restrictions on Stack Snippets code:
- The framed document is loaded into a unique origin, which means that all same-origin checks will fail; unique origins match no other origins ever, not even themselves. Among other impacts, this means that the document has no access to data stored in any origin’s cookies or any other storage mechanisms (DOM storage, Indexed DB, etc.).
- The framed document cannot create new windows or dialogs (via window.open or target="_blank", for instance).
- Forms cannot be submitted.
- Plugins will not load.
- The framed document can only navigate itself, not its top-level parent. Setting window.top.location will throw an exception, and clicking on link with target="_top" will have no effect.
- Pointer lock cannot be obtained.
- The seamless attribute is ignored on iframes the framed document contains.
Read a bit more on sandboxed iframes here