VBC-086: target-blank-rel

error

Category: core
Analysis: Regex (whole file)
File types: .html, .js, .ts, .tsx, .astro
Scope: source code only, ignoring anything inside strings and comments
Tags: security

What it reports

target='_blank' without rel='noopener' detected at line {line}.

Flagged

<a href="/x" target="_blank">docs</a>

Not flagged

<a href="/x" target="_blank" rel="noopener">docs</a>

<a href="/x" rel="noreferrer" target="_blank">docs</a>

Pattern

<a\b(?![^>]*\brel\s*=\s*["'{][^"'}]*(?:noopener|noreferrer))[^>]*\btarget\s*=\s*["'{]{0,2}_blank