Avoid `javascript:` URLs
Do not use `javascript:` URLs in string literals, template literals, or JSX link attributes.
#Metadata
#Why it matters
`javascript:` URLs execute attacker-controlled code when used as navigation targets.
#Remediation
Use safe HTTPS links, in-app handlers, or explicit event callbacks instead of `javascript:` URLs.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.no-javascript-url.rule.yaml.