no-script-url

Full Name in eslint-plugin-react-dom

react-dom/no-script-url

Full Name in @eslint-react/eslint-plugin

@eslint-react/dom/no-script-url

Presets

dom recommended recommended-typescript recommended-type-checked strict strict-typescript strict-type-checked

Rule Details

javascript: URLs are a form of XSS attack. They allow an attacker to execute arbitrary JavaScript in the context of your website, which can be used to steal user data, deface your website, or perform other malicious actions.

Common Violations

Invalid

function MyComponent() {
  return <a href="javascript:alert('Hello, world!')">Click me</a>;
  //        ^^^ Using a `javascript:` URL is a security risk and should be avoided.
}

Valid

function MyComponent() {
  return <a href="/some-page">Click me</a>;
}

Resources

• Rule Source
• Test Source

See Also

• react-dom/no-dangerously-set-innerhtml
  Disallows DOM elements from using dangerouslySetInnerHTML.
• react-dom/no-unsafe-target-blank
  Disallows target="_blank" without rel="noreferrer noopener".