Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't issue errors for <a/> with target=_blank and non-external URLs #1216

Merged
merged 3 commits into from
May 24, 2017

Conversation

gfx
Copy link
Contributor

@gfx gfx commented May 22, 2017

<a href="relative/path" target="_blank"/>and <a href="/absolute/path" target="_blank"/> are considered safe because the link is placed in the same host, so the rule only issues for URLs with protocols.

@@ -33,8 +33,21 @@ module.exports = {
var relFound = false;
var attrs = node.parent.attributes;
for (var idx in attrs) {
if (attrs[idx].name && attrs[idx].name.name === 'rel') {
var tags = attrs[idx].value.type === 'Literal' && attrs[idx].value.value.toLowerCase().split(' ');
if (!Object.prototype.hasOwnProperty.call(attrs, idx)) {
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

the guard is for guard-for-in.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since we have node 4+ now, let's just use Object.keys().forEach - then no guard is needed.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

in forEach(), only there's onlyreturn available to control loops, but this loop needs return, continue and breaks, so forEach() is not suitable.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In that case I'd prefer to rewrite it to use .filter in lieu of the continues, and .find in lieu of the breaks and returns.

However, to keep this PR small, we can stick with this guard (which should have been here in the first place).

Copy link
Contributor Author

@gfx gfx May 22, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMO your review seems right and the conditions are too complex; I also prefer to re-write them with ES2015 features.

Refactored in 89c33b6

}
if (attr.name.name === 'href') {
if (attr.value.type === 'Literal' && !/^\w+:/.test(attr.value.value)) {
// it's safe because it is not an external link (i.e. doesn't start with a protocol)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

//google.com/foo is an external link - please add a test case ensuring that protocol-less URLs still treated as external.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Right!

Fixed 664e5df

Copy link
Member

@ljharb ljharb left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems good!

@ljharb ljharb merged commit 5aa4470 into jsx-eslint:master May 24, 2017
@gfx gfx deleted the no-target-blank/only-for-external-links branch May 30, 2017 01:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Development

Successfully merging this pull request may close these issues.

3 participants