fix(lint): suppress no-control-regex on intentional C0 control char strip in sanitizeHref

Author: sschupbach-salesforce

packages/react-bridge/src/utils/sanitizeHref.ts

@@ -39,10 +39,9 @@ const SAFE_PROTOCOLS = new Set(['https:', 'http:', 'mailto:', 'tel:']);
 export function sanitizeHref(href: string | undefined | null): string {
   if (!href) return '#';
 
-  // Strip null bytes and C0 control characters that prefix-bypass protocol checks.
-  // Range \x00-\x1f covers NUL through US (C0), \x7f is DEL.
-  // NOTE: do NOT use /[ -]/ here — that character class range (space 0x20 to
-  // hyphen 0x2D) would silently strip hyphens from all URLs.
+  // Strip null bytes and C0 control characters (\x00-\x1f) and DEL (\x7f)
+  // that prefix-bypass protocol checks (e.g. \0javascript:).
+  // eslint-disable-next-line no-control-regex
   const trimmed = href.replace(/[\x00-\x1f\x7f]/g, '').trim();
   if (!trimmed) return '#';