---
url: /docs/guide/usage/linter/rules/react/jsx-no-script-url.md
---

### What it does

Disallow usage of `javascript:` URLs.

### Why is this bad?

URLs starting with `javascript:` are a dangerous attack surface because it’s easy to accidentally
include unsanitized output in a tag like `<a href>` and create a security hole.

Starting in React 16.9, any URLs starting with `javascript:` log a warning.

In React 19, `javascript:` URLs are
[disallowed entirely](https://react.dev/blog/2024/04/25/react-19-upgrade-guide#other-breaking-changes).

### Examples

Examples of **incorrect** code for this rule:

```jsx
<a href="javascript:void(0)">Test</a>
```

Examples of **correct** code for this rule:

```jsx
<Foo test="javascript:void(0)" />
```

## Configuration

### \[0]

type: `array`

#### \[0]\[n]

type: `object`

##### \[0]\[n].name

type: `string`

Component name.

##### \[0]\[n].props

type: `string[]`

List of properties that should be validated.

### \[1]

type: `object`

#### \[1].includeFromSettings

type: `boolean`

default: `false`

Whether to include components from settings.

## How to use

## Version

This rule was added in v0.13.2.

## References