dillon1000/react

Commit

[Breaking] Remove disableJavaScriptURLs (#28615)

## Overview

This has landed, so we can remove the flag

## Changelog

This change blocks using javascript URLs such as:

```html
<a href="javascript:notfine">p0wned</a>
```

We previously announced dropping support for this via a warning:

> A future version of React will block javascript: URLs as a security
precaution. Use event handlers instead if you can. If you need to
generate unsafe HTML try using dangerouslySetInnerHTML instead.
Browse files
Changed paths8 files
First-parent comparison
M packages/react-dom-bindings/src/shared/sanitizeURL.js ModifiedM packages/react-dom/src/__tests__/ReactDOMServerIntegrationUntrustedURL-test.js ModifiedM packages/shared/ReactFeatureFlags.js ModifiedM packages/shared/forks/ReactFeatureFlags.native-fb.js ModifiedM packages/shared/forks/ReactFeatureFlags.test-renderer.js ModifiedM packages/shared/forks/ReactFeatureFlags.test-renderer.native.js ModifiedM packages/shared/forks/ReactFeatureFlags.test-renderer.www.js ModifiedM packages/shared/forks/ReactFeatureFlags.www.js Modified
Patch

Files changed

Rendering syntax-highlighted changes…