Plugin: react-featuresRules
jsx-no-target-blank
Require rel='noopener noreferrer' with target='_blank'. This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
Require rel="noopener noreferrer" with target="_blank". This rule is part of eslint-plugin-react-features and provides LLM-optimized error messages.
Quick Summary
| Aspect | Details |
|---|---|
| Severity | Warning (security) |
| Auto-Fix | 💡 Suggests fixes |
| Category | React Security |
| ESLint MCP | ✅ Optimized for ESLint MCP integration |
| Best For | All React/JSX projects |
Rule Details
Links with target="_blank" without rel="noopener noreferrer" are vulnerable to tabnabbing attacks.
Examples
❌ Incorrect
<a target="_blank" href="https://example.com">Link</a>
<a target="_blank" href={url}>External</a>✅ Correct
<a target="_blank" rel="noopener noreferrer" href="https://example.com">Link</a>
<a target="_blank" rel="noopener" href="https://example.com">Link</a>Related Rules
jsx-no-script-url- Prevent javascript URLs
Use this rule
npm install -D oxlint-plugin-react-features{ "jsPlugins": ["oxlint-plugin-react-features"], "rules": { "react-features/jsx-no-target-blank": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-react-features'], rules: { 'react-features/jsx-no-target-blank': 'error', }, },});oxlint-plugin-react-features re-exports eslint-plugin-react-features/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.