A "visit link" component takes a user-supplied URL and uses it directly as an href.
The bug: javascript:alert(document.cookie) is a perfectly valid URL as far as the browser is concerned — clicking a link with that href executes the script, no <script> tag required. This is exactly Juice Shop's DOM-based XSS challenge category.
Your task: fix solve(url) so any URL using the javascript: scheme (case-insensitively, with or without leading whitespace) is replaced with the safe fallback '#' — everything else passes through trimmed but otherwise unchanged.
Sample tests