Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[jsx-no-target-blank] Allow either noopener or noreferrer #1391

Closed
wants to merge 1 commit into from
Closed

[jsx-no-target-blank] Allow either noopener or noreferrer #1391

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 6 additions & 3 deletions docs/rules/jsx-no-target-blank.md
View file
Open in desktop
Expand Up @@ -2,9 +2,10 @@

When creating a JSX element that has an `a` tag, it is often desired to have
the link open in a new tab using the `target='_blank'` attribute. Using this
attribute unaccompanied by `rel='noreferrer noopener'`, however, is a severe
security vulnerability ([see here for more details](https://mathiasbynens.github.io/rel-noopener))
This rules requires that you accompany all `target='_blank'` attributes with `rel='noreferrer noopener'`.
attribute unaccompanied by `rel='noopener'` or `rel='noreferrer'`, however,
is a severe security vulnerability ([see here for more details](https://mathiasbynens.github.io/rel-noopener))
This rule requires that you accompany all `target='_blank'` attributes with
`rel='noopener'` or `rel='noreferrer'`.

## Rule Details

Expand All @@ -18,6 +19,8 @@ The following patterns are not considered errors:

```jsx
var Hello = <p target='_blank'></p>
var Hello = <a target='_blank' rel='noopener' href="http://example.com"></a>
var Hello = <a target='_blank' rel='noreferrer' href="http://example.com"></a>
var Hello = <a target='_blank' rel='noopener noreferrer' href="http://example.com"></a>
var Hello = <a target='_blank' href="relative/path/in/the/host"></a>
var Hello = <a target='_blank' href="/absolute/path/in/the/host"></a>
Expand Down
6 changes: 3 additions & 3 deletions lib/rules/jsx-no-target-blank.js
View file
Open in desktop
Expand Up @@ -25,7 +25,7 @@ function hasSecureRel(element) {
return element.attributes.find(attr => {
if (attr.type === 'JSXAttribute' && attr.name.name === 'rel') {
const tags = attr.value && attr.value.type === 'Literal' && attr.value.value.toLowerCase().split(' ');
return tags && (tags.indexOf('noopener') >= 0 && tags.indexOf('noreferrer') >= 0);
return tags && (tags.indexOf('noopener') >= 0 || tags.indexOf('noreferrer') >= 0);
}
return false;
});
Expand All @@ -34,7 +34,7 @@ function hasSecureRel(element) {
module.exports = {
meta: {
docs: {
description: 'Forbid target="_blank" attribute without rel="noopener noreferrer"',
description: 'Forbid target="_blank" attribute without rel="noopener" or rel="noreferrer"',
category: 'Best Practices',
recommended: true
},
Expand All @@ -53,7 +53,7 @@ module.exports = {
hasExternalLink(node.parent) &&
!hasSecureRel(node.parent)
) {
context.report(node, 'Using target="_blank" without rel="noopener noreferrer" ' +
context.report(node, 'Using target="_blank" without rel="noopener" or rel="noreferrer" ' +
'is a security risk: see https://mathiasbynens.github.io/rel-noopener');
}
}
Expand Down
20 changes: 11 additions & 9 deletions tests/lib/rules/jsx-no-target-blank.js
View file
Open in desktop
Expand Up @@ -31,6 +31,8 @@ ruleTester.run('jsx-no-target-blank', rule, {
{code: '<a randomTag></a>'},
{code: '<a href="foobar" target="_blank" rel="noopener noreferrer"></a>'},
{code: '<a target="_blank" {...spreadProps} rel="noopener noreferrer"></a>'},
{code: '<a {...spreadProps} target="_blank" rel="noopener" href="http://example.com">s</a>'},
{code: '<a {...spreadProps} target="_blank" rel="noreferrer" href="http://example.com">s</a>'},
{code: '<a {...spreadProps} target="_blank" rel="noopener noreferrer" href="http://example.com">s</a>'},
{code: '<a target="_blank" rel="noopener noreferrer" {...spreadProps}></a>'},
{code: '<p target="_blank"></p>'},
Expand All @@ -43,55 +45,55 @@ ruleTester.run('jsx-no-target-blank', rule, {
invalid: [{
code: '<a target="_blank" href="http://example.com"></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_blank" rel="" href="http://example.com"></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_blank" rel="noopenernoreferrer" href="http://example.com"></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_BLANK" href="http://example.com"></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_blank" href="//example.com"></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_blank" href="//example.com" rel={true}></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_blank" href="//example.com" rel={3}></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_blank" href="//example.com" rel={null}></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}, {
code: '<a target="_blank" href="//example.com" rel></a>',
errors: [{
message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
message: 'Using target="_blank" without rel="noopener" or rel="noreferrer" is a security risk:' +
' see https://mathiasbynens.github.io/rel-noopener'
}]
}]
Expand Down