only flag React elements in ClientSideUrlRedirect if it's a HTML element, or known link class

javascript/ql/src/semmle/javascript/JSX.qll

@@ -65,6 +65,12 @@ class JSXElement extends JSXNode {
   }
 
   override string getAPrimaryQlClass() { result = "JSXElement" }
+
+  /**
+   * Holds if this JSX element is a HTML element.
+   * That is, the name starts with a lowercase letter.
+   */
+  predicate isHTMLElement() { getName().regexpMatch("[a-z].*") }
 }
 
 /**

javascript/ql/src/semmle/javascript/security/dataflow/ClientSideUrlRedirectCustomizations.qll

@@ -173,7 +173,10 @@ module ClientSideUrlRedirect {
   class ReactAttributeWriteUrlSink extends ScriptUrlSink {
     ReactAttributeWriteUrlSink() {
       exists(JSXAttribute attr |
-        attr.getName() = DOM::getAPropertyNameInterpretedAsJavaScriptUrl()
+        attr.getName() = DOM::getAPropertyNameInterpretedAsJavaScriptUrl() and
+        attr.getElement().isHTMLElement()
+        or
+        DataFlow::moduleImport("next/link").flowsToExpr(attr.getElement().getNameExpr())
       |
         this = attr.getValue().flow()
       )