diff --git a/docs/rules/jsx-no-target-blank.md b/docs/rules/jsx-no-target-blank.md index ef30c808ea..a2b4cd424e 100644 --- a/docs/rules/jsx-no-target-blank.md +++ b/docs/rules/jsx-no-target-blank.md @@ -2,9 +2,10 @@ When creating a JSX element that has an `a` tag, it is often desired to have the link open in a new tab using the `target='_blank'` attribute. Using this -attribute unaccompanied by `rel='noreferrer noopener'`, however, is a severe -security vulnerability ([see here for more details](https://mathiasbynens.github.io/rel-noopener)) -This rules requires that you accompany all `target='_blank'` attributes with `rel='noreferrer noopener'`. +attribute unaccompanied by `rel='noopener'` or `rel='noreferrer'`, however, +is a severe security vulnerability ([see here for more details](https://mathiasbynens.github.io/rel-noopener)) +This rule requires that you accompany all `target='_blank'` attributes with +`rel='noopener'` or `rel='noreferrer'`. ## Rule Details @@ -18,6 +19,8 @@ The following patterns are not considered errors: ```jsx var Hello =

+var Hello = +var Hello = var Hello = var Hello = var Hello = diff --git a/lib/rules/jsx-no-target-blank.js b/lib/rules/jsx-no-target-blank.js index ccba0e21a2..79028f25ad 100644 --- a/lib/rules/jsx-no-target-blank.js +++ b/lib/rules/jsx-no-target-blank.js @@ -25,7 +25,7 @@ function hasSecureRel(element) { return element.attributes.find(attr => { if (attr.type === 'JSXAttribute' && attr.name.name === 'rel') { const tags = attr.value && attr.value.type === 'Literal' && attr.value.value.toLowerCase().split(' '); - return tags && (tags.indexOf('noopener') >= 0 && tags.indexOf('noreferrer') >= 0); + return tags && (tags.indexOf('noopener') >= 0 || tags.indexOf('noreferrer') >= 0); } return false; }); @@ -34,7 +34,7 @@ function hasSecureRel(element) { module.exports = { meta: { docs: { - description: 'Forbid target="_blank" attribute without rel="noopener noreferrer"', + description: 'Forbid target="_blank" attribute without rel="noopener" or rel="noreferrer"', category: 'Best Practices', recommended: true }, @@ -53,7 +53,7 @@ module.exports = { hasExternalLink(node.parent) && !hasSecureRel(node.parent) ) { - context.report(node, 'Using target="_blank" without rel="noopener noreferrer" ' + + context.report(node, 'Using target="_blank" without rel="noopener" or rel="noreferrer" ' + 'is a security risk: see https://mathiasbynens.github.io/rel-noopener'); } } diff --git a/tests/lib/rules/jsx-no-target-blank.js b/tests/lib/rules/jsx-no-target-blank.js index a0c756cbcc..5cf45933dc 100644 --- a/tests/lib/rules/jsx-no-target-blank.js +++ b/tests/lib/rules/jsx-no-target-blank.js @@ -31,6 +31,8 @@ ruleTester.run('jsx-no-target-blank', rule, { {code: ''}, {code: ''}, {code: ''}, + {code: 's'}, + {code: 's'}, {code: 's'}, {code: ''}, {code: '

'}, @@ -43,55 +45,55 @@ ruleTester.run('jsx-no-target-blank', rule, { invalid: [{ code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }, { code: '', errors: [{ - message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' + + message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' + ' see https://mathiasbynens.github.io/rel-noopener' }] }]