Why window.open(someURL) throwing open redirects security vurnerability in React?

Question

This is my code
window.open( ${process.env.REACT_APP_APACHE_SUPERSET_URL}/superset/sqllab/, "_blank" )

Answer 1

The vulnerability is not only for React.JS but also it's dangerous for other frameworks when using it. The vulnerability can be explained as it occurs when an application allows a user to control a redirect or forward to another URL. If the app does not validate untrusted user input, an attacker could supply a URL that redirects an unsuspecting victim from a legitimate domain to an attacker’s phishing site.