Earlier quoted context omitted.
Any idea how to prevent this from happening? Google seems to have figured it out in their google images iframes, but I can't for the life of me figure out how they did it.
It looks like google parse the page serverside to detect break out of frames scripts. Here's a manually engineered example - I searched for a demo of a break out of frames script and forced the URL into a google images request: http://images.google.com/imgres?imgurl=http://www.internet.c... THe page just displays a "you are being redirected" message straight away, so it must be detected at the server level. Smart.
http://images.google.com/imgres?imgurl=http://a1.twimg.com/p...
google doesn't detect or stop that breaking out of frames. But maybe twitter are just managing to avoid detection by google's code..
The code on that page is:
//
which doesn't seem like it would be too hard to detect.