Browser & Web Performance · Middle · Question 58 of 75
Why is <a href={userUrl}> dangerous if userUrl isn't validated?
- ✓Correct answer: A value like
javascript:alert(1)runs script when clicked - 2Long URLs crash the browser
- 3Links to other domains leak cookies
Explanation
Escaping text doesn't help with URLs. Allow only http: and https: (and maybe mailto:) schemes.