← Back to rules

eslint/no-script-url Style

What it does

Disallow javascript: URLs.

Why is this bad?

Using javascript: URLs is considered by some as a form of eval. Code passed in javascript: URLs must be parsed and evaluated by the browser in the same way that eval is processed. This can lead to security and performance issues.

Examples

Examples of incorrect code for this rule:

location.href = "javascript:void(0)";

location.href = `javascript:void(0)`;

How to use

To enable this rule using the config file or in the CLI, you can use:

Config (.oxlintrc.json)

{
  "rules": {
    "no-script-url": "error"
  }
}

Config (oxlint.config.ts)

import { defineConfig } from "oxlint";

export default defineConfig({
  rules: {
    "no-script-url": "error",
  },
});

CLI

oxlint --deny no-script-url

Version

This rule was added in v0.2.15.

References

• Rule Source
• Upstream rule docs
• Open rule in Oxc Playground