---
title: "no-script-url"
description: "Disallow `javascript:` URLs"
# Generated by src/codegen/lint-rule-docs.ts. Do not edit below this line.
plugin: "eslint"
aliases: ["eslint/no-script-url"]
kind: "suggestion"
category: "style"
default: "off"
fixable: "no"
typeAware: false
deprecated: false
---

A browser runs the text after `javascript:` as code when the URL is opened. That's `eval` under another name. The code is a string that no tool checks, and if any part of it comes from a user, it's a way to inject a script.

The rule reports a string or a template literal without `${}` that starts with `javascript:`, in upper or lower case.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"no-script-url" = "error" # or "warn"
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad {"count": 2} */}
```js
link.href = "javascript:void(0)";
location.href = `JavaScript:save()`;
```

Not reported:

{/* good */}
```js
link.addEventListener("click", (event) => {
  event.preventDefault();
  save();
});
```