From 110d4e1d7e150ccb829771c7319d31ce777d102f Mon Sep 17 00:00:00 2001
From: snowbitx <109521682+snowbitx@users.noreply.github.com>
Date: Fri, 15 Aug 2025 14:15:02 +0800
Subject: [PATCH] docs(components): [link] add security warning (#21711)

* docs(components): [link] add security warning

* chore: position adjustment

* chore: fold js example
---
 docs/en-US/component/link.md | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/docs/en-US/component/link.md b/docs/en-US/component/link.md
index c478fbea7c..f18664c896 100644
--- a/docs/en-US/component/link.md
+++ b/docs/en-US/component/link.md
@@ -7,6 +7,30 @@ lang: en-US
 
 Text hyperlink
 
+:::warning Security Warning
+The `href` prop will be rendered directly to an `<a>` tag. If you pass a value such as `javascript:alert(1)` or a malicious URL, it may cause **XSS** or **open redirect vulnerabilities**.
+
+Always validate and sanitize the URL before use. For example:
+
+<details>
+<summary>Show code example</summary>
+
+```js
+function sanitizeUrl(url) {
+  const allowedProtocols = ['http:', 'https:']
+  try {
+    const parsed = new URL(url, window.location.origin)
+    return allowedProtocols.includes(parsed.protocol) ? parsed.href : '#'
+  } catch {
+    return '#'
+  }
+}
+```
+
+</details>
+
+:::
+
 ## Basic
 
 Basic text link