The sandbox attribute enables an extra set of restrictions for the content in the iframe and should always be specified.
Additional functionality such as the ability to run scripts should be enabled only in justifiable cases after thorough security review.