21

I'm using JSHint, and it got the following error:

Script URL.

Which I noticed that happened because on this particular line there is a string containing a javascript:... URL.

I know that JSHint complained that because the scripturl option is set, and since my codebase is quite large, I'll have to unset it for now.

Still, I don't understood what is the issue of using script URLs?

Improve this question
2
  • 7
    @epascarello: He's asking why.
    – SLaks
    Commented Nov 21, 2012 at 16:47
  • 3
    Hence why I did not make it a answer! You guys are awesome!
    – epascarello
    Commented Nov 21, 2012 at 16:48

1 Answer 1

Reset to default
29

javascript: URLs are part of 'eval is evil'.

In order to execute the javascript: URL, the browser must fire up a JS parser and parse the text of the URL.
This is a slow and costly process.

Also, assembling javascript: URLs (or other strings that contain source code) is a tricky task which is prone to XSS vulnerabilities.

Finally, mixing code and URLs violates the separation of content and behavior (code).

Improve this answer
7
  • 3
    @Barmar: It needs to parse your <script> tag no matter what. However, it's better to parse one longer script than many shorter ones.
    – SLaks
    Commented Nov 21, 2012 at 16:49
  • Doesn't it have to do the same parse if you put the script in <script> and call it as a function? It's worse, because it has to parse the JS even if you never click on the link.
    – Barmar
    Commented Nov 21, 2012 at 16:49
  • Separation of code and content: isn't it more obvious to insert a script URL than to attach an event to an element, prevent default, and override the apparent content in some hidden place in the code? How else might I submit a form using AJAX?
    – bmacnaughton
    Commented Feb 10, 2017 at 12:01
  • "the browser must fire up a JS parser and parse the text of the URL" How can i confirm this statement?
    – tsh
    Commented Dec 22, 2017 at 8:09
  • 5
    Browser may want to specially optimize link like javascript:; and javascript:void(0); since they are quite common.
    – tsh
    Commented Dec 24, 2017 at 11:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.