javascript - What is the matter with script-targeted URLs? - Stack Overflow

admin管理员组

文章数量:1188429

I'm using JSHint, and it got the following error:

Script URL.

Which I noticed that happened because on this particular line there is a string containing a javascript:... URL.

I know that JSHint complained that because the scripturl option is set, and since my codebase is quite large, I'll have to unset it for now.

Still, I don't understood what is the issue of using script URLs?

I'm using JSHint, and it got the following error:

Script URL.

Which I noticed that happened because on this particular line there is a string containing a javascript:... URL.

I know that JSHint complained that because the scripturl option is set, and since my codebase is quite large, I'll have to unset it for now.

Still, I don't understood what is the issue of using script URLs?

• javascript
• validation
• jshint

Share Improve this question Follow edited Nov 21, 2012 at 16:48 Paul D. Waite 98.8k5757 gold badges202202 silver badges271271 bronze badges asked Nov 21, 2012 at 16:44 MetalcoderMetalcoder 2,26244 gold badges2525 silver badges3030 bronze badges 2

• 7 @epascarello: He's asking why. – SLaks Commented Nov 21, 2012 at 16:47
• 3 Hence why I did not make it a answer! You guys are awesome! – epascarello Commented Nov 21, 2012 at 16:48

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 29

javascript: URLs are part of 'eval is evil'.

In order to execute the javascript: URL, the browser must fire up a JS parser and parse the text of the URL.
This is a slow and costly process.

Also, assembling javascript: URLs (or other strings that contain source code) is a tricky task which is prone to XSS vulnerabilities.

Finally, mixing code and URLs violates the separation of content and behavior (code).

本文标签： javascriptWhat is the matter with scripttargeted URLsStack Overflow