Skip to content
Critiq Docs

Search docs

Search documentation pages and rules

security.ui

Add rel=noopener to target=_blank links

Opening links in a new tab without rel=noopener lets the destination page access window.opener.

#Metadata

Rule ID
ts.react.no-target-blank-without-rel
Severity
high
Confidence
0.9
Languages
javascript, typescript
Presets
recommended, security, strict
Stability
experimental
Applies to
function
Tags
react, rules-catalog, security, ui

#Why it matters

Untrusted destinations can navigate or phish the opener tab unless noopener severs that relationship.

#Remediation

Add rel=noopener or rel="noopener noreferrer" whenever target="_blank" is present.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.react.no-target-blank-without-rel.rule.yaml.