CodeParkfunction ProfileLink({ user }) {
return <a href={user.website}>{user.name}</a>;
}
A value like
javascript:alert(document.cookie) runs script when someone clicks the linkA javascript: URL in href runs as script in your page when the link is clicked. React escapes the value, but escaping doesn't change the URL scheme. Fix it by parsing the URL and allowing only https: and http:.
"Nothing, because React escapes every value" is the tempting wrong answer. Escaping stops HTML injection, not a dangerous URL. "user.name can inject HTML" is wrong, because React renders it as text.