oxc-project/oxc · warning

Using target=`_blank` without rel=`noreferrer` or rel=`noope

Error message

Using target=`_blank` without rel=`noreferrer` or rel=`noopener` (the former implies the latter and is preferred due to wider support) is a security risk: see https://mathiasbynens.github.io/rel-noopener/#recommendations

What it means

The looser variant of oxlint's react/jsx-no-target-blank diagnostic, emitted when `allowReferrers: true` is configured. It still flags `target="_blank"` links missing protection, but accepts either rel="noreferrer" or rel="noopener" since you opted into sending referrers. The underlying risk is the same: without noopener semantics, the opened page can reach window.opener and redirect/navigate the originating tab.

Source

Thrown at crates/oxc_linter/src/rules/react/jsx_no_target_blank.rs:31

use oxc_str::CompactStr;
use schemars::JsonSchema;
use serde::{Deserialize, Serialize};

use crate::{
    AstNode,
    context::{ContextHost, LintContext},
    rule::{DefaultRuleConfig, Rule},
    utils::is_same_expression,
};

fn target_blank_without_noreferrer(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Using target=`_blank` without rel=`noreferrer` (which implies rel=`noopener`) is a security risk in older browsers: see https://mathiasbynens.github.io/rel-noopener/#recommendations")
        .with_help("add rel=`noreferrer` to the element")
        .with_label(span)
}

fn target_blank_without_noopener(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Using target=`_blank` without rel=`noreferrer` or rel=`noopener` (the former implies the latter and is preferred due to wider support) is a security risk: see https://mathiasbynens.github.io/rel-noopener/#recommendations")
        .with_help("add rel=`noreferrer` or rel=`noopener` to the element")
        .with_label(span)
}

fn explicit_props_in_spread_attributes(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("all spread attributes are treated as if they contain an unsafe combination of props, unless specifically overridden by props after the last spread attribute prop.")
        .with_help("add rel=`noreferrer` to the element")
        .with_label(span)
}

#[derive(Debug, Clone, JsonSchema, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", default, deny_unknown_fields)]
pub struct JsxNoTargetBlank {
    /// Whether to enforce dynamic links or enforce static links.
    enforce_dynamic_links: EnforceDynamicLinksEnum,
    /// Whether to warn when spread attributes are used.
    warn_on_spread_attributes: bool,
    /// Whether to allow referrers.

View on GitHub (pinned to e1e7af627c)

Solutions

1. Add `rel="noopener"` (minimal fix) or `rel="noreferrer"` (preferred, wider support).
2. Audit all target="_blank" usages at once: `rg 'target=["'\''_]blank'` to fix them in a batch.
3. If dynamic external hrefs are impossible to validate, consider `"enforceDynamicLinks": "never"` while keeping static-link enforcement.

Example fix

// before
<a href="https://example.com" target="_blank">Docs</a>

// after
<a href="https://example.com" target="_blank" rel="noopener">Docs</a>

oxlint --react-plugin src/
rg -n --no-ignore 'target=["'"']_blank' src/ | grep -v 'noopener\|noreferrer' || echo OK

When it happens

Trigger: Same detector as the noreferrer variant — link element with target="_blank", external or dynamic href (enforceDynamicLinks "always" by default) — but the `diagnostic()` helper routes to this message when `self.allow_referrer` is true and the rel attribute matches neither "noopener" nor "noreferrer" per `check_rel`.

Common situations: Analytics-driven products that require referrer headers on outbound links; teams that consciously enabled allowReferrers and then still forgot any rel attribute; mixed states after a partial migration to rel="noopener".

Related errors

• Using target=`_blank` without rel=`noreferrer` (which implie
• all spread attributes are treated as if they contain an unsa
• React 19 disallows `javascript:` URLs as a security precauti
• ARIA used where native HTML could suffice.
• React Hook {hook_name:?} cannot be called inside a callback.

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/f596aecb391cbdc5. Report an issue: GitHub.