Disallow Script URLs (no-script-url)
Using javascript:
URLs is considered by some as a form of eval
. Code passed in javascript:
URLs has to be parsed and evaluated by the browser in the same way that eval
is processed.
Rule Details
The following patterns are considered warnings:
location.href = "javascript:void(0)";
Compatibility
- JSHint: This rule corresponds to
scripturl
rule of JSHint.
Further Reading
Version
This rule was introduced in ESLint 0.0.9.