The href content in a tag is 'data: image', which is not processed

[qsy0213]

</div><a href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22><script>alert('1')</script></svg>">//

By default, the browser will block the a-tag jump behavior of href=data: image, but iframe will not block it by default. When my page is in iframe, attackers can attack through the above code.