Skip to content

Commit

Permalink
u
Browse files Browse the repository at this point in the history
  • Loading branch information
Boshen committed Nov 26, 2024
1 parent 3172fce commit 4f2eb1f
Showing 1 changed file with 4 additions and 4 deletions.
8 changes: 4 additions & 4 deletions src/docs/guide/usage/linter/rules/react/jsx-no-script-url.md
Original file line number Diff line number Diff line change
Expand Up @@ -14,9 +14,9 @@ Disallow usage of `javascript:` URLs

### Why is this bad?

URLs starting with javascript: are a dangerous attack surface because it’s easy to accidentally include unsanitized output in a tag like <a href> and create a security hole.
In React 16.9 any URLs starting with javascript: scheme log a warning.
In a future major release, React will throw an error if it encounters a javascript: URL.
URLs starting with `javascript:` are a dangerous attack surface because it’s easy to accidentally include unsanitized output in a tag like `<a href>` and create a security hole.
In React 16.9 any URLs starting with `javascript:` scheme log a warning.
In a future major release, React will throw an error if it encounters a `javascript:` URL.

### Examples

Expand All @@ -28,7 +28,7 @@ Examples of **incorrect** code for this rule:

Examples of **correct** code for this rule:

```text
```jsx
<Foo test="javascript:void(0)" />
```

Expand Down

0 comments on commit 4f2eb1f

Please sign in to comment.