Preventing iFrame injection in web app

There is an issue that an malicious attacker can inject iframes within the app so that the iframe can have a source to an external application that is outside of the parent app's domain. Ex: Lets consider the app to be hosted at https://app.com/. The attacker could inject an iframe that will contain a source …