no-script-url

Full Name in eslint-plugin-react-dom

react-dom/no-script-url

Full Name in @eslint-react/eslint-plugin

@eslint-react/dom-no-script-url

Presets

dom recommended recommended-typescript recommended-type-checked strict strict-typescript strict-type-checked

Rule Details

javascript: URLs are a form of XSS attack. They allow an attacker to execute arbitrary JavaScript in the context of your website, which can be used to steal user data, deface your website, or perform other malicious actions.

Examples

Passing URLs to link or resource attributes

function MyComponent() {
  // Problem: `javascript:` URLs are a security risk and should be avoided
  return <a href="javascript:alert('Hello, world!')">Click me</a>;
  //        ^^^ Using a `javascript:` URL is a security risk and should be avoided.
}

function MyComponent() {
  // Recommended: Use a safe URL instead
  return <a href="/some-page">Click me</a>;
}

Versions

Resources

• Rule Source
• Test Source
• Rule Changelog

See Also

• react-dom/no-dangerously-set-innerhtml
  Disallows DOM elements from using dangerouslySetInnerHTML.
• react-dom/no-unsafe-target-blank
  Disallows target="_blank" without rel="noreferrer noopener".