Eval should be blocked in the iframe, but inline script should be allowed.