File contents for added or removed files are displayed using a sandboxed `iframe`. HTML is rendered rather than displayed as text. Replace appropriate special characters with HTML entities (`<` with `<`, etc.) and it should be possible to see the raw HTML.