Plugin: react-featuresRules
jsx-no-script-url
Prevent javascript: URLs in JSX. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
Prevent javascript: URLs in JSX. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
Quick Summary
| Aspect | Details |
|---|---|
| Severity | Error (security) |
| Auto-Fix | ❌ No auto-fix |
| Category | React Security |
| ESLint MCP | ✅ Optimized for ESLint MCP integration |
| Best For | All React/JSX projects |
Rule Details
Using javascript: URLs is a security risk and can lead to XSS vulnerabilities.
Examples
❌ Incorrect
<a href="javascript:void(0)">Click</a>
<a href="javascript:alert('XSS')">Click</a>✅ Correct
<a href="#" onClick={handleClick}>Click</a>
<button onClick={handleClick}>Click</button>Related Rules
jsx-no-target-blank- Require rel attributes
Use this rule
npm install -D oxlint-plugin-react-features{ "jsPlugins": ["oxlint-plugin-react-features"], "rules": { "react-features/jsx-no-script-url": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-react-features'], rules: { 'react-features/jsx-no-script-url': 'error', }, },});oxlint-plugin-react-features re-exports eslint-plugin-react-features/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.