No Script URL

Block javascript: URLs except explicitly allowed patterns because script URLs execute arbitrary code and are a common XSS vector.

Summary

The no-script-url rule reports any string literal whose value, lowercased, starts with javascript: unless it matches one of the allowed patterns.

Prevents XSS vulnerabilities from javascript: URLs that execute arbitrary code.
Makes dangerous patterns visible during code review instead of hiding in string values.
Provides an allowedPatterns escape hatch for cases where javascript: URLs are intentional.

warning

ignoreFiles is an escape hatch for files where this rule genuinely does not apply. It is not intended for routine use.

Option	Type	Default	Description
`allowedPatterns`	`string[]`	`[]`	Exact `javascript:` URLs to allow. Matching is case-insensitive (the literal value and each pattern are compared after lowercasing), and must equal the full literal value.
`ignoreFiles`	`string[]`	`[]`	File names to skip. Supports a leading-`` suffix (`.test.ts`), an exact path, or a trailing path segment; `**` globs are not supported.

Autofix is not available for this rule. Flagged code must be updated manually.

Warning fires on javascript:void(0) — Add 'javascript:void(0)' to the allowedPatterns option.
Template literals are not checked — The rule only inspects string literals. Dynamic javascript: URLs built via template literals are not caught.