[roywiggins]

It seems like a losing battle to me. You'd have to prevent Javascript inserting links into the DOM (it could stick parameters in the URL), inserting images (similar), loading any assets from anywhere programmatically, any AJAX requests, any redirects, setting any cookies... and probably more besides.

...and eventually you'd have some chap like the OP here who will come up with a clever way to exfiltrate information somehow anyway.