{"record":{"id":"153d54ad0a2293f0","repo":"oxc-project/oxc","slug":"react-19-disallows-javascript-urls-as-a-securit","errorCode":null,"errorMessage":"React 19 disallows `javascript:` URLs as a security precaution.","messagePattern":"React 19 disallows `javascript:` URLs as a security precaution\\.","errorType":"validation","errorClass":"OxcDiagnostic","httpStatus":null,"severity":"error","filePath":"crates/oxc_linter/src/rules/react/jsx_no_script_url.rs","lineNumber":25,"sourceCode":"    },\n};\nuse serde::Deserialize;\nuse serde_json::Value;\n\nuse oxc_ast::{AstKind, ast::JSXAttributeItem};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_span::{GetSpan, Span};\nuse oxc_str::CompactStr;\n\nuse crate::{\n    AstNode,\n    context::{ContextHost, LintContext},\n    rule::{MixedTupleRuleConfig, Rule},\n};\n\nfn jsx_no_script_url_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"React 19 disallows `javascript:` URLs as a security precaution.\")\n        .with_help(\"Use event handlers instead if you can.\")\n        .with_label(span)\n}\n\nstatic JS_SCRIPT_REGEX: Lazy<Regex> = lazy_regex!(\n    r\"(j|J)[\\r\\n\\t]*(a|A)[\\r\\n\\t]*(v|V)[\\r\\n\\t]*(a|A)[\\r\\n\\t]*(s|S)[\\r\\n\\t]*(c|C)[\\r\\n\\t]*(r|R)[\\r\\n\\t]*(i|I)[\\r\\n\\t]*(p|P)[\\r\\n\\t]*(t|T)[\\r\\n\\t]*:\"\n);\n\n#[derive(Debug, Default, Clone)]\npub struct JsxNoScriptUrl(Box<JsxNoScriptUrlConfig>);\n\n#[derive(Debug, Default, Clone)]\npub struct JsxNoScriptUrlConfig {\n    include_from_settings: bool,\n    components: FxHashMap<String, Vec<String>>,\n}\n\n#[derive(Debug, Default, Clone, Deserialize)]","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/react/jsx_no_script_url.rs#L7-L43","documentation":"Diagnostic from react/jsx-no-script-url (category: suspicious). It flags javascript: URLs in link attributes — <a href=\"javascript:void(0)\"> — because such URLs are an XSS vector when unsanitized data reaches them. The matcher (JS_SCRIPT_REGEX) tolerates mixed case and embedded \\r/\\n/\\t between the letters, so obfuscated variants like 'jav\\tascript:...' are still caught. React 16.9 warned about these URLs and React 19 disallows them entirely, hence the message; the help suggests using event handlers instead.","triggerScenarios":"href=\"javascript:void(0)\" or javascript:-prefixed values on <a>, plus custom link components/props configured via the rule's components option or settings linkComponents (includeFromSettings). React 19 upgrade audits where legacy javascript: hrefs now throw at runtime.","commonSituations":"Legacy codebases with <a href=\"javascript:void(0)\" onclick=...> patterns pre-React-16; upgrading to React 19 where such URLs are hard-disallowed and crash rendering; link-like custom components (<Link to=...>, <NavLink href=...>) that need to be registered in settings so their URL props are checked.","solutions":["Replace the javascript: URL with a real handler: <button onClick={...}> or <a href=\"#\" onClick={e => { e.preventDefault(); fn(); }}>","If the element only triggers behavior, change the tag to <button type=\"button\"> for correct semantics and a11y","Register custom link components/props via the rule's components config or linkComponents settings so their URLs are validated too","Search the codebase for obfuscated variants (mixed case, embedded whitespace) — the regex catches them, so trust the linter over a plain grep"],"exampleFix":"// before\n<a href=\"javascript:void(0)\" onClick={open}>Open</a>\n\n// after\n<button type=\"button\" onClick={open}>Open</button>","handlingStrategy":"validation","validationCode":"npx oxlint -D react/jsx-no-script-url src/  # also run a security review on link attributes","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never construct href values by string concatenation with user input; use event handlers for behavior","Before a React 19 upgrade, grep the codebase for javascript: URLs — React 19 refuses them at runtime","Register custom link components (via the rule's components config or linkComponents settings) so their URL props are checked too"],"tags":["react","jsx","security","xss","javascript-url","react-19","oxlint","lint"],"backgroundTag":"javascript-url-xss","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}