no-javascript-url.md

no-javascript-url

📝 Disallow javascript: URLs in Markdown.

🚫 Disabled by default.

Disallow javascript: destinations in Markdown links, images, autolinks, and reference definitions. A link with this scheme can execute JavaScript when followed in a browser, depending on the renderer. The rule checks parsed destinations using browser URL parsing, including mixed-case schemes and character references that the Markdown parser decodes.

Reference definitions are reported at the definition, including unused definitions. Raw HTML in Markdown is not checked.

Examples

<!-- ❌ -->
[Open](javascript:alert(1))
![Image](JaVaScRiPt:alert(1))
<javascript:alert(1)>

[Open][destination]

[destination]: javascript:alert(1)

<!-- ✅ -->
[Open](https://example.com)
![Image](https://example.com/image.png)
<https://example.com>