Dangerous strings can reach browser builtins

<!-- Note: if the issue is about documentation or the website, please file it at: https://github.com/reactjs/reactjs.org/issues/new --> **Do you want to request a *feature* or report a *bug*?** A bug, but a well known and worked-around one. **What is the current behavior?** ```jsx var x = 'javascript:alert(1)'; ReactDOM.render( (<a href={x}>Link</a>), document.getElementById('container') ); ``` produces a link that alerts. **If the current behavior is a bug, please provide the steps to reproduce and if possible a minimal demo of the problem. Your bug will get fixed much faster if we can run your code and it doesn't have dependencies other than React. Paste the link to your JSFiddle (https://jsfiddle.net/Luktwrdm/) or CodeSandbox (https://codesandbox.io/s/new) example below:** * [Load the code above in the codepen REPL](https://jsfiddle.net/Luktwrdm/202/) * After the REPL loads, click the "Run" button at the top left. * You should see a blue "link" in the bottom-right pane. * Click it. An alert will popup. The alert should not pop up. A simple string that reaches an `href` attribute should not cause arbitrary code execution even with user interaction. **What is the expected behavior?** A string that reaches a browser builtin like the `HTMLAElement.prototype.href` setter should not cause code execution. **Discussion** [Polymer Resin](https://docs.google.com/presentation/d/1hepAXMroHSNTM0NV1aGlntjHrw0a0QOM5X5JvfXv_N0/edit#slide=id.g227691820f_0_198) uses hooks in another webcomponents framework to intercept value before they reach browser builtins where they can be vetted. A similar approach could work for React. It allows values to reach browser builtins when they are innocuous or have a runtime type that indicates that the author intentionally marked them as safe for that kind of browser builtin. For example, an `instanceof SafeURL` would be allowed to reach `HTMLAElement.prototype.href` as would any string that is a relative URL, or one with a whitelisted …