{"record":{"id":"f596aecb391cbdc5","repo":"oxc-project/oxc","slug":"using-target-blank-without-rel-noreferrer-or","errorCode":null,"errorMessage":"Using target=`_blank` without rel=`noreferrer` or rel=`noopener` (the former implies the latter and is preferred due to wider support) is a security risk: see https://mathiasbynens.github.io/rel-noopener/#recommendations","messagePattern":"Using target=`_blank` without rel=`noreferrer` or rel=`noopener` \\(the former implies the latter and is preferred due to wider support\\) is a security risk: see https://mathiasbynens\\.github\\.io/rel-noopener/#recommendations","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/react/jsx_no_target_blank.rs","lineNumber":31,"sourceCode":"use oxc_str::CompactStr;\nuse schemars::JsonSchema;\nuse serde::{Deserialize, Serialize};\n\nuse crate::{\n    AstNode,\n    context::{ContextHost, LintContext},\n    rule::{DefaultRuleConfig, Rule},\n    utils::is_same_expression,\n};\n\nfn target_blank_without_noreferrer(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Using target=`_blank` without rel=`noreferrer` (which implies rel=`noopener`) is a security risk in older browsers: see https://mathiasbynens.github.io/rel-noopener/#recommendations\")\n        .with_help(\"add rel=`noreferrer` to the element\")\n        .with_label(span)\n}\n\nfn target_blank_without_noopener(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Using target=`_blank` without rel=`noreferrer` or rel=`noopener` (the former implies the latter and is preferred due to wider support) is a security risk: see https://mathiasbynens.github.io/rel-noopener/#recommendations\")\n        .with_help(\"add rel=`noreferrer` or rel=`noopener` to the element\")\n        .with_label(span)\n}\n\nfn explicit_props_in_spread_attributes(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"all spread attributes are treated as if they contain an unsafe combination of props, unless specifically overridden by props after the last spread attribute prop.\")\n        .with_help(\"add rel=`noreferrer` to the element\")\n        .with_label(span)\n}\n\n#[derive(Debug, Clone, JsonSchema, Deserialize, Serialize)]\n#[serde(rename_all = \"camelCase\", default, deny_unknown_fields)]\npub struct JsxNoTargetBlank {\n    /// Whether to enforce dynamic links or enforce static links.\n    enforce_dynamic_links: EnforceDynamicLinksEnum,\n    /// Whether to warn when spread attributes are used.\n    warn_on_spread_attributes: bool,\n    /// Whether to allow referrers.","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/react/jsx_no_target_blank.rs#L13-L49","documentation":"The looser variant of oxlint's react/jsx-no-target-blank diagnostic, emitted when `allowReferrers: true` is configured. It still flags `target=\"_blank\"` links missing protection, but accepts either rel=\"noreferrer\" or rel=\"noopener\" since you opted into sending referrers. The underlying risk is the same: without noopener semantics, the opened page can reach window.opener and redirect/navigate the originating tab.","triggerScenarios":"Same detector as the noreferrer variant — link element with target=\"_blank\", external or dynamic href (enforceDynamicLinks \"always\" by default) — but the `diagnostic()` helper routes to this message when `self.allow_referrer` is true and the rel attribute matches neither \"noopener\" nor \"noreferrer\" per `check_rel`.","commonSituations":"Analytics-driven products that require referrer headers on outbound links; teams that consciously enabled allowReferrers and then still forgot any rel attribute; mixed states after a partial migration to rel=\"noopener\".","solutions":["Add `rel=\"noopener\"` (minimal fix) or `rel=\"noreferrer\"` (preferred, wider support).","Audit all target=\"_blank\" usages at once: `rg 'target=[\"'\\''_]blank'` to fix them in a batch.","If dynamic external hrefs are impossible to validate, consider `\"enforceDynamicLinks\": \"never\"` while keeping static-link enforcement."],"exampleFix":"// before\n<a href=\"https://example.com\" target=\"_blank\">Docs</a>\n\n// after\n<a href=\"https://example.com\" target=\"_blank\" rel=\"noopener\">Docs</a>","handlingStrategy":"validation","validationCode":"oxlint --react-plugin src/\nrg -n --no-ignore 'target=[\"'\"']_blank' src/ | grep -v 'noopener\\|noreferrer' || echo OK","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Default to rel=\"noreferrer\" even when allowReferrers is on — it is the strictly safer default.","Document WHY allowReferrers was enabled so future maintainers do not remove rel wholesale.","Pair the rule with a code-review checklist item for any new external link."],"tags":["react","security","tabnabbing","noopener","oxlint","lint"],"backgroundTag":"target-blank-tabnabbing","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}