This is my code
window.open( ${process.env.REACT_APP_APACHE_SUPERSET_URL}/superset/sqllab/, "_blank" )

CodePudding user response：

The vulnerability is not only for React.JS but also it's dangerous for other frameworks when using it. The vulnerability can be explained as it occurs when an application allows a user to control a redirect or forward to another URL. If the app does not validate untrusted user input, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker’s phishing site.