Disallow Script URLs (no-script-url)

Using javascript: URLs is considered by some as a form of eval. Code passed in javascript: URLs has to be parsed and evaluated by the browser in the same way that eval is processed.

Rule Details

The following patterns are considered problems:

/*eslint no-script-url: 2*/

location.href = "javascript:void(0)"; /*error Script URL is a form of eval.*/

Compatibility

• JSHint: This rule corresponds to scripturl rule of JSHint.

Further Reading

• What is the matter with script-targeted URLs?

Version

This rule was introduced in ESLint 0.0.9.

Resources

• Rule source
• Documentation source