jsx-no-target-blank should fail on dynamic link

Author: Ken Earley

lib/rules/jsx-no-target-blank.js

@@ -23,6 +23,13 @@ function hasExternalLink(element) {
       /^(?:\w+:|\/\/)/.test(attr.value.value));
 }
 
+function hasDynamicLink(element) {
+  return element.attributes.some(attr => attr.name &&
+    attr.name.name === 'href' &&
+    attr.value.type === 'JSXExpressionContainer');
+}
+
+
 function hasSecureRel(element) {
   return element.attributes.find(attr => {
     if (attr.type === 'JSXAttribute' && attr.name.name === 'rel') {
@@ -53,7 +60,7 @@ module.exports = {
 
         if (
           isTargetBlank(node) &&
-          hasExternalLink(node.parent) &&
+          (hasExternalLink(node.parent) || hasDynamicLink(node.parent)) &&
           !hasSecureRel(node.parent)
         ) {
           context.report(node, 'Using target="_blank" without rel="noopener noreferrer" ' +

tests/lib/rules/jsx-no-target-blank.js

@@ -25,6 +25,7 @@ const parserOptions = {
 // ------------------------------------------------------------------------------
 
 const ruleTester = new RuleTester({parserOptions});
+
 ruleTester.run('jsx-no-target-blank', rule, {
   valid: [
     {code: '<a href="foobar"></a>'},
@@ -94,5 +95,11 @@ ruleTester.run('jsx-no-target-blank', rule, {
       message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
       ' see https://mathiasbynens.github.io/rel-noopener'
     }]
+  }, {
+    code: '<a target="_blank" href={ dynamicLink }></a>',
+    errors: [{
+      message: 'Using target="_blank" without rel="noopener noreferrer" is a security risk:' +
+      ' see https://mathiasbynens.github.io/rel-noopener'
+    }]
   }]
 });