VBC-086: target-blank-rel

warning

Category: core
Analysis: Regex (whole file)
File types: .html, .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Off by default. Name it in slopless.config.json to turn it on.
Tags: security

What it reports

target='_blank' without rel='noopener' at line {line}. Browsers since 2021 treat it as noopener already, so this only matters for older ones; add rel='noreferrer' as well to hide the referrer.

Flagged

<a href="/x" target="_blank">docs</a>

Not flagged

<a href="/x" target="_blank" rel="noopener">docs</a>

<a href="/x" rel="noreferrer" target="_blank">docs</a>

Pattern

<a\b(?![^>]*\brel\s*=\s*["'{][^"'}]*(?:noopener|noreferrer))[^>]*\btarget\s*=\s*["'{]{0,2}_blank