Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[New] Add jsx-no-script-url to prevent usage of javascript: URLs #2419

Merged
merged 1 commit into from Nov 30, 2019

Conversation

@sergei-startsev
Copy link
Contributor

@sergei-startsev sergei-startsev commented Sep 25, 2019

In React 16.9 any URLs starting with javascript: scheme log a warning. React considers the pattern as a dangerous attack surface, see details and in a future major release it will throw an error if it encounters a javascript: URL.

The rule prevents usage of javascript: URLs in JSX.

@sergei-startsev sergei-startsev force-pushed the sergei-startsev:jsx-no-script-url branch from 9ec97c4 to 92f3cef Sep 25, 2019
@ljharb ljharb added the new rule label Oct 1, 2019
@ljharb ljharb requested a review from gaearon Oct 1, 2019
@sergei-startsev sergei-startsev force-pushed the sergei-startsev:jsx-no-script-url branch 4 times, most recently from 3285ca7 to 01d9fec Oct 1, 2019
@sergei-startsev sergei-startsev requested a review from ljharb Oct 6, 2019
@sergei-startsev sergei-startsev force-pushed the sergei-startsev:jsx-no-script-url branch from 01d9fec to 2f267ca Oct 9, 2019
lib/rules/jsx-no-script-url.js Show resolved Hide resolved
lib/rules/jsx-no-script-url.js Outdated Show resolved Hide resolved
lib/rules/jsx-no-script-url.js Outdated Show resolved Hide resolved
@ljharb ljharb force-pushed the sergei-startsev:jsx-no-script-url branch from 2f267ca to 7c44126 Nov 29, 2019
@sergei-startsev sergei-startsev force-pushed the sergei-startsev:jsx-no-script-url branch 2 times, most recently from c435347 to 24ab5df Nov 29, 2019
@ljharb
ljharb approved these changes Nov 30, 2019
@ljharb ljharb force-pushed the sergei-startsev:jsx-no-script-url branch from 24ab5df to 2ecdf36 Nov 30, 2019
@ljharb ljharb merged commit 2ecdf36 into yannickcr:master Nov 30, 2019
2 checks passed
2 checks passed
continuous-integration/travis-ci/pr The Travis CI build passed
Details
coverage/coveralls Coverage increased (+0.01%) to 97.53%
Details
@erunion
Copy link

@erunion erunion commented Jan 21, 2020

Should this be added to the recommended config?

@ljharb
Copy link
Collaborator

@ljharb ljharb commented Jan 21, 2020

Not at this time, adding things to the recommended config is a breaking change.

If we ever are forced to do a semver-major, then we'll re-evaluate the recommended config.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

3 participants