It differs. Angular sanitizes URL bindings by default. React warned about javascript: URLs from 16.9 and, per OWASP, React 19 blocks them in src and href. Vue's guide says to sanitize URLs on the backend. In every case you still need to validate where a link goes.
Why a link can run code
A javascript: URL in an anchor href runs script when someone clicks it. If your app shows a user profile with a website field, and you drop that field straight into an href, an attacker can save a javascript: value as their "website". Anyone who clicks the link runs the attacker's code in your origin. That is XSS through a URL context, and it ignores text escaping because the value is a legitimate attribute, just a dangerous one.
What each framework does
| Framework | Behavior for URL bindings | Source |
|---|---|---|
| React | 16.9 logged a warning and announced a future error. OWASP states React 19 blocks javascript: in src and href | React blog, OWASP |
| Vue | Escapes the attribute but does not remove a javascript: scheme. The guide says sanitize on the backend | Vue guide |
| Angular | Sanitizes untrusted URL values, and logs a console warning in development when it changes one | Angular guide |
Two cautions from the docs matter here. OWASP notes that React's block does not replace application-specific URL validation. The Vue guide adds that even a sanitized URL cannot be guaranteed to lead to a safe destination. Blocking one scheme does not make a link trustworthy.
Where to sanitize
Vue's guide makes a point worth copying for any framework: if you ever sanitize URLs on the frontend, you already have a problem. User-provided URLs should be sanitized by the backend before they are saved, so every client benefits, including native mobile apps. Frontend checks are a backup, not the main control.
What a good URL check looks like
- Parse the value with the URL parser instead of testing it with string tricks.
- Allow only the schemes you expect, usually https, and sometimes mailto.
- Compare the host against an allowlist when the link should stay on known sites.
- Reject, rather than repair, anything else.
- Store the validated value, so rendering code has nothing risky to render.
Be careful with Angular's bypassSecurityTrustUrl, which exists to switch this protection off. See when bypassSecurityTrust is safe.
Try it yourself
Click through it at your own pace, or open it full screen. Notice how a data flow finding connects an input to the place it is used.
Safeguard also offers a free dependency scan at gold.safeguard.sh/scan, useful for checking the sanitizer packages your app relies on.
Quick check
Is a blocked javascript: scheme enough?
No. A link can still point to a phishing page or an attacker controlled host. Validate scheme and destination.
Should the frontend or the backend validate user URLs?
Both can, but the Vue guide recommends the backend, because it protects every client that reads the data.
Sources
- React v16.9.0 release notes
- OWASP Cross Site Scripting Prevention Cheat Sheet
- Vue security guide
- Angular security guide
Last reviewed: 19 October 2026.
