jsx-no-script-url

Prevent javascript: URLs in JSX. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.

Quick SummaryCopy Anchor Link

Rule DetailsCopy Anchor Link

Using javascript: URLs is a security risk and can lead to XSS vulnerabilities.

ExamplesCopy Anchor Link

❌ IncorrectCopy Anchor Link

<a href="javascript:void(0)">Click</a>

<a href="javascript:alert('XSS')">Click</a>

✅ CorrectCopy Anchor Link

<a href="#" onClick={handleClick}>Click</a>

<button onClick={handleClick}>Click</button>

What is checkedCopy Anchor Link

• Props: href, src, action, formAction, data, poster, background and SVG's xlink:href, plus the component props named by the options.
• Values: a string in any letter case, after the leading control characters and the embedded tab / newline characters the URL parser strips; braced ({'javascript:…'}); a template whose text before the first placeholder is the scheme; either branch of a conditional. A dynamic value is not judged.

OptionsCopy Anchor Link

{
  rules: {
    'react-features/jsx-no-script-url': ['error',
      // Component props to check, in addition to the URL props above
      [{ name: 'Link', props: ['to'] }],
      // Also read `settings.linkComponents` (eslint-plugin-react's shared setting:
      // `'Hyperlink'` checks its `href`; `{ name: 'Link', linkAttribute: 'to' }`
      // or `linkAttribute: ['to', 'href']` checks the named props)
      { includeFromSettings: true },
    ],
  },
}

Related RulesCopy Anchor Link

• jsx-no-target-blank - Require rel attributes

Use this rule

npm install -D oxlint-plugin-react-features

{  "jsPlugins": ["oxlint-plugin-react-features"],  "rules": {    "react-features/jsx-no-script-url": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-react-features'],    rules: {      'react-features/jsx-no-script-url': 'error',    },  },});