Identify "href" usages in SPAs (ReactJS), i.e., free javascript: XSS

hrefs.py

import re
import sys

VULNERABLE_HREF = r'href: [^"].+[^\s;,]'
STATE_VALUES = r'\.setState\({([\s\S]*?)}\)'

#false_positives = ("this.props.team.", "constants.")

def find_state_candidates(name, states):
        candidates = []

        for state in states:
            for param in state.split('\n'):
                param = param.rstrip(',;').strip()
                if param.split(':')[0] == name:
                    candidates.append(param.split(':')[1].strip())

        return candidates

if __name__ == '__main__':
    if len(sys.argv) != 2:
        print("Usage: %s beautified.js" % sys.argv[0])
        sys.exit()

    with open(sys.argv[1], 'r', errors="ignore") as f:
        content = f.read()
  
    hrefs = re.findall(VULNERABLE_HREF, content)
    states = re.findall(STATE_VALUES, content, flags=re.MULTILINE)
    states = [re.sub(' +', ' ', state).strip() for state in states]

    for href in hrefs:
        value = href.split(' ')[1]
#        if not value.startswith(false_positives):
        if value.startswith('this.state.'):
            print("%s (%s)" % (href, find_state_candidates(value.split('.')[2], states)))
        else:
            print(href)