I think forcing height and width for the iframe is reasonable. Though I have general concerns around all iframe oneboxes.
Now that we have integrated onebox we should probably list exhaustively all the IFRAMEs we are allowing out of the box in a setting, so we call this out.
I kind of feel like allowed onebox iframes should not be * out of the box, instead it should call out all the iframes we are allowing.