Purify iframe using sanitizer

[Mr. NiceGuy]

Hi, 

I am working on a site where people can enter iframes which will be saved and displayed to other users. 

I want to prevent XSS but at the same time I want that any site can be embedded as iframe. 

I want to prevent something like 

<iframe src="javascript:alert(0)"></iframe>

but it should still be possible to use any src url for the iframe. I know that one can use the sanitizer with htmlpurifier options to only allow safe origins (say youtube, vimeo). 

echo $sanitizer->purify($str, $options = ["HTML.SafeIframe" =>true, "URI.SafeIframeRegexp" =>'%^https://(www.youtube.com/embed/|player.vimeo.com/video/)%'] );

Is there are smart way to have a minimal level of protection whilst allowing any url for the iframe? 

Expanding the RegEx in the options obviously works but is this already enough? 

echo $sanitizer->purify($str, $options = ["HTML.SafeIframe" =>true, "URI.SafeIframeRegexp" =>'%^https://%'] );

Would love to hear some other opinions.