{"record":{"id":"f81fa13b6296ac6e","repo":"oxc-project/oxc","slug":"all-spread-attributes-are-treated-as-if-they-conta","errorCode":null,"errorMessage":"all spread attributes are treated as if they contain an unsafe combination of props, unless specifically overridden by props after the last spread attribute prop.","messagePattern":"all spread attributes are treated as if they contain an unsafe combination of props, unless specifically overridden by props after the last spread attribute prop\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/react/jsx_no_target_blank.rs","lineNumber":37,"sourceCode":"    context::{ContextHost, LintContext},\n    rule::{DefaultRuleConfig, Rule},\n    utils::is_same_expression,\n};\n\nfn target_blank_without_noreferrer(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Using target=`_blank` without rel=`noreferrer` (which implies rel=`noopener`) is a security risk in older browsers: see https://mathiasbynens.github.io/rel-noopener/#recommendations\")\n        .with_help(\"add rel=`noreferrer` to the element\")\n        .with_label(span)\n}\n\nfn target_blank_without_noopener(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Using target=`_blank` without rel=`noreferrer` or rel=`noopener` (the former implies the latter and is preferred due to wider support) is a security risk: see https://mathiasbynens.github.io/rel-noopener/#recommendations\")\n        .with_help(\"add rel=`noreferrer` or rel=`noopener` to the element\")\n        .with_label(span)\n}\n\nfn explicit_props_in_spread_attributes(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"all spread attributes are treated as if they contain an unsafe combination of props, unless specifically overridden by props after the last spread attribute prop.\")\n        .with_help(\"add rel=`noreferrer` to the element\")\n        .with_label(span)\n}\n\n#[derive(Debug, Clone, JsonSchema, Deserialize, Serialize)]\n#[serde(rename_all = \"camelCase\", default, deny_unknown_fields)]\npub struct JsxNoTargetBlank {\n    /// Whether to enforce dynamic links or enforce static links.\n    enforce_dynamic_links: EnforceDynamicLinksEnum,\n    /// Whether to warn when spread attributes are used.\n    warn_on_spread_attributes: bool,\n    /// Whether to allow referrers.\n    allow_referrer: bool,\n    /// Whether to check link elements.\n    links: bool,\n    /// Whether to check form elements.\n    forms: bool,\n}","sourceCodeStart":19,"sourceCodeEnd":55,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/react/jsx_no_target_blank.rs#L19-L55","documentation":"Spread-attribute variant of oxlint's react/jsx-no-target-blank rule. When `warnOnSpreadAttributes: true` (off by default) is enabled and a target=\"_blank\" element contains a spread (`{...props}`), the rule cannot see whether the spread injects an href, so it treats the element as unsafe: the diagnostic says all spread attributes are assumed to contain the unsafe combination unless explicitly overridden by props after the last spread.","triggerScenarios":"`<a target=\"_blank\" {...rest} />` with warnOnSpreadAttributes enabled: the spread resets the recorded target/rel state and forces href-valid=true, so unless a later explicit valid href or a valid rel attribute appears after the spread, `explicit_props_in_spread_attributes(spread_span)` is emitted. An explicit `rel=\"noreferrer\"` (or valid href) placed after the spread suppresses it.","commonSituations":"Component libraries forwarding rest props (`<a {...rest} target=\"_blank\" />`); wrappers around next/link or react-router anchors; teams that enabled warnOnSpreadAttributes during a security audit and hit dozens of wrapper components.","solutions":["Add an explicit safe prop after the last spread: `<a target=\"_blank\" {...rest} rel=\"noreferrer\" />`.","Or specify the href explicitly after the spread so it is provably safe/relative.","If the component provably never receives external hrefs, disable `\"warnOnSpreadAttributes\"` or suppress inline for that element."],"exampleFix":"// before\n<a target=\"_blank\" {...rest} />\n\n// after\n<a target=\"_blank\" {...rest} rel=\"noreferrer\" />","handlingStrategy":"validation","validationCode":"oxlint --react-plugin -W no-target-blank=warn src/ # with warnOnSpreadAttributes enabled in config","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Put explicit rel/href AFTER the last {...spread} so the rule (and readers) see the final safe value.","In wrapper components, hoist the safety prop: `<a target={target} {...rest} rel=\"noreferrer\" />`.","Only enable warnOnSpreadAttributes once; fix the flagged wrappers by adding trailing safe props."],"tags":["react","security","spread-props","tabnabbing","oxlint","lint"],"backgroundTag":"target-blank-tabnabbing","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}