I received a string response mixed with js code and html code from the server.

<script> do some with js code...</script>
<div>
  <h1>Page Title</h1>
</div>

I was worried about xss atack, so tried to render the code on the screen with iframe. However, when the file string was put in the srcdoc attribute of iframe, the script tag did not work.

I think this problem is because the srcdoc attribute parses only the html tag. Is there any other way to use the string script code with iframe?