Merge pull request #1271 from dustinsoftware/issue-1269

Fix crash when rel tag is empty

Author: ljharb

lib/rules/jsx-no-target-blank.js

@@ -26,8 +26,8 @@ function hasExternalLink(element) {
 function hasSecureRel(element) {
   return element.attributes.find(function (attr) {
     if (attr.name.name === 'rel') {
-      var tags = attr.value.type === 'Literal' && attr.value.value.toLowerCase().split(' ');
-      return !tags || (tags.indexOf('noopener') >= 0 && tags.indexOf('noreferrer') >= 0);
+      var tags = attr.value && attr.value.type === 'Literal' && attr.value.value.toLowerCase().split(' ');
+      return tags && (tags.indexOf('noopener') >= 0 && tags.indexOf('noreferrer') >= 0);
     }
     return false;
   });

tests/lib/rules/jsx-no-target-blank.js

@@ -69,5 +69,29 @@ ruleTester.run('jsx-no-target-blank', rule, {
       message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
       ' see https://mathiasbynens.github.io/rel-noopener'
     }]
+  }, {
+    code: '<a target="_blank" href="//example.com" rel={true}></a>',
+    errors: [{
+      message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
+      ' see https://mathiasbynens.github.io/rel-noopener'
+    }]
+  }, {
+    code: '<a target="_blank" href="//example.com" rel={3}></a>',
+    errors: [{
+      message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
+      ' see https://mathiasbynens.github.io/rel-noopener'
+    }]
+  }, {
+    code: '<a target="_blank" href="//example.com" rel={null}></a>',
+    errors: [{
+      message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
+      ' see https://mathiasbynens.github.io/rel-noopener'
+    }]
+  }, {
+    code: '<a target="_blank" href="//example.com" rel></a>',
+    errors: [{
+      message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
+      ' see https://mathiasbynens.github.io/rel-noopener'
+    }]
   }]
 });