21

I'm using JSHint, and it got the following error:

Script URL.

Which I noticed that happened because on this particular line there is a string containing a javascript:... URL.

I know that JSHint complained that because the scripturl option is set, and since my codebase is quite large, I'll have to unset it for now.

Still, I don't understood what is the issue of using script URLs?

2
  • 7
    @epascarello: He's asking why.
    – SLaks
    Nov 21, 2012 at 16:47
  • 3
    Hence why I did not make it a answer! You guys are awesome! Nov 21, 2012 at 16:48

1 Answer 1

29

javascript: URLs are part of 'eval is evil'.

In order to execute the javascript: URL, the browser must fire up a JS parser and parse the text of the URL.
This is a slow and costly process.

Also, assembling javascript: URLs (or other strings that contain source code) is a tricky task which is prone to XSS vulnerabilities.

Finally, mixing code and URLs violates the separation of content and behavior (code).

7
  • 3
    @Barmar: It needs to parse your <script> tag no matter what. However, it's better to parse one longer script than many shorter ones.
    – SLaks
    Nov 21, 2012 at 16:49
  • Doesn't it have to do the same parse if you put the script in <script> and call it as a function? It's worse, because it has to parse the JS even if you never click on the link.
    – Barmar
    Nov 21, 2012 at 16:49
  • Separation of code and content: isn't it more obvious to insert a script URL than to attach an event to an element, prevent default, and override the apparent content in some hidden place in the code? How else might I submit a form using AJAX? Feb 10, 2017 at 12:01
  • "the browser must fire up a JS parser and parse the text of the URL" How can i confirm this statement?
    – tsh
    Dec 22, 2017 at 8:09
  • 5
    Browser may want to specially optimize link like javascript:; and javascript:void(0); since they are quite common.
    – tsh
    Dec 24, 2017 at 11:53

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.