Turn on disableJavaScriptURLs for experimental (facebook#28462)

This is on everywhere, ready to turn on in the next major.

Author: rickhanlonii

packages/react-dom/src/__tests__/ReactDOMServerIntegrationUntrustedURL-test.js

@@ -195,8 +195,6 @@ describe('ReactDOMServerIntegration - Untrusted URLs - disableJavaScriptURLs', (
 
   function initModules() {
     jest.resetModules();
-    const ReactFeatureFlags = require('shared/ReactFeatureFlags');
-    ReactFeatureFlags.disableJavaScriptURLs = true;
 
     React = require('react');
     ReactDOMClient = require('react-dom/client');

packages/shared/ReactFeatureFlags.js

@@ -145,7 +145,7 @@ export const disableLegacyContext = false;
 
 // Not ready to break experimental yet.
 // Disable javascript: URL strings in href for XSS protection.
-export const disableJavaScriptURLs = false;
+export const disableJavaScriptURLs = __NEXT_MAJOR__;
 
 // Not ready to break experimental yet.
 // Modern <StrictMode /> behaviour aligns more with what components

packages/shared/forks/ReactFeatureFlags.test-renderer.js

@@ -28,7 +28,7 @@ export const enableFormActions = true; // Doesn't affect Test Renderer
 export const enableBinaryFlight = true;
 export const enableTaint = true;
 export const enablePostpone = false;
-export const disableJavaScriptURLs = false;
+export const disableJavaScriptURLs = true;
 export const disableCommentsAsDOMContainers = true;
 export const disableInputAttributeSyncing = false;
 export const disableIEWorkarounds = true;

packages/shared/forks/ReactFeatureFlags.test-renderer.www.js

@@ -28,7 +28,7 @@ export const enableFormActions = true; // Doesn't affect Test Renderer
 export const enableBinaryFlight = true;
 export const enableTaint = true;
 export const enablePostpone = false;
-export const disableJavaScriptURLs = false;
+export const disableJavaScriptURLs = true;
 export const disableCommentsAsDOMContainers = true;
 export const disableInputAttributeSyncing = false;
 export const disableIEWorkarounds = true;