From e69b1136745df6267d9d5ee35112b5ffffc9d438 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Odin=20H=C3=B8rthe=20Omdal?= <odin.omdal@gmail.com>
Date: Wed, 15 Jan 2020 15:09:13 +0100
Subject: [PATCH] [Fix] `jsx-no-target-blank`: allow rel to be an expression

Previously this would be an error, since the rel wasn't read:

    <a target={"_blank"} href={"//"} rel={"noopener noreferrer"}>

Now this works, so you can enable this rule together with
`jsx-curly-brace-presence`.

Fixes #2508.
---
 lib/rules/jsx-no-target-blank.js       | 13 +++++++++++--
 tests/lib/rules/jsx-no-target-blank.js | 12 ++++++++++++
 2 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/lib/rules/jsx-no-target-blank.js b/lib/rules/jsx-no-target-blank.js
index 51df0ece1a..41b3de4ef9 100644
--- a/lib/rules/jsx-no-target-blank.js
+++ b/lib/rules/jsx-no-target-blank.js
@@ -43,8 +43,17 @@ function hasDynamicLink(element, linkAttribute) {
 function hasSecureRel(element, allowReferrer) {
   return element.attributes.find((attr) => {
     if (attr.type === 'JSXAttribute' && attr.name.name === 'rel') {
-      const tags = attr.value && attr.value.type === 'Literal' && attr.value.value.toLowerCase().split(' ');
-      return tags && (tags.indexOf('noopener') >= 0 && (allowReferrer || tags.indexOf('noreferrer') >= 0));
+      const value = attr.value &&
+        ((
+          attr.value.type === 'Literal' &&
+          attr.value.value
+        ) || (
+          attr.value.type === 'JSXExpressionContainer' &&
+          attr.value.expression &&
+          attr.value.expression.value
+        ));
+      const tags = value && value.toLowerCase && value.toLowerCase().split(' ');
+      return tags && tags.indexOf('noopener') >= 0 && (allowReferrer || tags.indexOf('noreferrer') >= 0);
     }
     return false;
   });
diff --git a/tests/lib/rules/jsx-no-target-blank.js b/tests/lib/rules/jsx-no-target-blank.js
index aefd526cfc..cd5b7df311 100644
--- a/tests/lib/rules/jsx-no-target-blank.js
+++ b/tests/lib/rules/jsx-no-target-blank.js
@@ -36,6 +36,10 @@ ruleTester.run('jsx-no-target-blank', rule, {
     {code: '<a randomTag></a>'},
     {code: '<a target />'},
     {code: '<a href="foobar" target="_blank" rel="noopener noreferrer"></a>'},
+    {code: '<a href="foobar" target="_blank" rel={"noopener noreferrer"}></a>'},
+    {code: '<a href={"foobar"} target={"_blank"} rel={"noopener noreferrer"}></a>'},
+    {code: '<a href={\'foobar\'} target={\'_blank\'} rel={\'noopener noreferrer\'}></a>'},
+    {code: '<a href={`foobar`} target={`_blank`} rel={`noopener noreferrer`}></a>'},
     {code: '<a target="_blank" {...spreadProps} rel="noopener noreferrer"></a>'},
     {code: '<a {...spreadProps} target="_blank" rel="noopener noreferrer" href="http://example.com">s</a>'},
     {code: '<a target="_blank" rel="noopener noreferrer" {...spreadProps}></a>'},
@@ -43,10 +47,12 @@ ruleTester.run('jsx-no-target-blank', rule, {
     {code: '<a href="foobar" target="_BLANK" rel="NOOPENER noreferrer"></a>'},
     {code: '<a target="_blank" rel={relValue}></a>'},
     {code: '<a target={targetValue} rel="noopener noreferrer"></a>'},
+    {code: '<a target={targetValue} rel={"noopener noreferrer"}></a>'},
     {code: '<a target={targetValue} href="relative/path"></a>'},
     {code: '<a target={targetValue} href="/absolute/path"></a>'},
     {code: '<a target={\'targetValue\'} href="/absolute/path"></a>'},
     {code: '<a target={"targetValue"} href="/absolute/path"></a>'},
+    {code: '<a target={null} href="//example.com"></a>'},
     {
       code: '<a target="_blank" href={ dynamicLink }></a>',
       options: [{enforceDynamicLinks: 'never'}]
@@ -98,6 +104,12 @@ ruleTester.run('jsx-no-target-blank', rule, {
   }, {
     code: '<a target="_blank" href="//example.com" rel={null}></a>',
     errors: defaultErrors
+  }, {
+    code: '<a target="_blank" href="//example.com" rel={"noopenernoreferrer"}></a>',
+    errors: defaultErrors
+  }, {
+    code: '<a target={"_blank"} href={"//example.com"} rel={"noopenernoreferrer"}></a>',
+    errors: defaultErrors
   }, {
     code: '<a target="_blank" href="//example.com" rel></a>',
     errors: defaultErrors