Verhindern von JavaScript-Pseudo-Protokoll-XSS in dynamischen Link-URLs

import React from 'react';
 
function isSafeUrl(rawUrl) {
  try {
    const parsed = new URL(rawUrl, window.location.origin);
    return parsed.protocol === 'http:' || parsed.protocol === 'https:';
  } catch {
    return false;
  }
}
 
export function SafeExternalLink({ href, children }) {
  const safeHref = isSafeUrl(href) ? href : '#';
 
  return (
    <a
      href={safeHref}
      target="_blank"
      rel="noopener noreferrer"
      className={safeHref === '#' ? 'disabled-link' : ''}
    >
      {children}
    </a>
  );
}