Using the <iframe> "sandbox" property. At least stops things like alert('hey') and a full-page redirect