# no-script-url

> Disallow `javascript:` URLs

A browser runs the text after `javascript:` as code when the URL is opened. That's `eval` under another name. The code is a string that no tool checks, and if any part of it comes from a user, it's a way to inject a script.

The rule reports a string or a template literal without `${}` that starts with `javascript:`, in upper or lower case.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"no-script-url" = "error" # or "warn"
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad {"count": 2} */}
```js
link.href = "javascript:void(0)";
location.href = `JavaScript:save()`;
```

Not reported:

{/* good */}
```js
link.addEventListener("click", (event) => {
  event.preventDefault();
  save();
});
```