How do ensure that one's exit node will not send one JS malware (like the forbes.com drive-by download attack?)
Tor Browser also comes with NoScript which would allow you to block any .js from loading and under the privacy and security settings you will find the security slider, which can be adjusted to reduce possible avenues of attack at the cost of possibly stopping some kinds web content from working.
Otherwise it is impossible to stop it from injecting or altering content, however volunteers run scans on exit nodes to look for signs of tampering. Nodes found to be altering or injecting content are given a "BadRelay" flag and ejected from the Tor Network. You can report any relays you see doing this by sending an email to email@example.com to be investigated.