# no-javascript-url

📝 Disallow `javascript:` URLs in Markdown.

🚫 Disabled by default.

<!-- end auto-generated rule header -->
<!-- Do not manually modify this header. Run: `npm run fix:eslint-docs` -->

Disallow `javascript:` destinations in Markdown links, images, autolinks, and reference definitions. A link with this scheme can execute JavaScript when followed in a browser, depending on the renderer. The rule checks parsed destinations using browser URL parsing, including mixed-case schemes and character references that the Markdown parser decodes.

Reference definitions are reported at the definition, including unused definitions. Raw HTML in Markdown is not checked.

## Examples

```md
<!-- ❌ -->
[Open](javascript:alert(1))
![Image](JaVaScRiPt:alert(1))
<javascript:alert(1)>

[Open][destination]

[destination]: javascript:alert(1)

<!-- ✅ -->
[Open](https://example.com)
![Image](https://example.com/image.png)
<https://example.com>
```