I'm running JSLint checks in Rhino using jslintant.js.

I found something a bit strange and was wondering if I could gets some input from other programmers. Basically, the following line gets a JSLint 'Script URL' error:

var a = '<a href="javascript:alert(\'I am a bookmarklet\');" >Drag me to your Toolbar</a>';

Error:

Lint at line 124 character 35: Script URL.

I've gone into the code that Douglas Crockford wrote in fulljslint.js and found that indeed he is testing for this as follows:

// javascript url
jx = /(?:javascript|jscript|ecmascript|vbscript|mocha|livescript)\s*:/i,

So, given this constraint and the fact that drag and drop bookmarklets only use the HREF attribute of the A tag. How are we meant to dynamically create bookmarklets that pass a JSLint test?

Thanks for your input.

I'm running JSLint checks in Rhino using jslintant.js.

I found something a bit strange and was wondering if I could gets some input from other programmers. Basically, the following line gets a JSLint 'Script URL' error:

var a = '<a href="javascript:alert(\'I am a bookmarklet\');" >Drag me to your Toolbar</a>';

Error:

Lint at line 124 character 35: Script URL.

I've gone into the code that Douglas Crockford wrote in fulljslint.js and found that indeed he is testing for this as follows:

// javascript url
jx = /(?:javascript|jscript|ecmascript|vbscript|mocha|livescript)\s*:/i,

So, given this constraint and the fact that drag and drop bookmarklets only use the HREF attribute of the A tag. How are we meant to dynamically create bookmarklets that pass a JSLint test?

Thanks for your input.

• javascript
• bookmarklet
• rhino
• jslint

2 Answers 2

JSLint can be too picky at times. In this case I would suggest trying to go for an workaround. The following two bypass the regex test by splitting the string into smaller parts:

var x = ['<a href="javascript', ':', 'stuff'].join('');

or

var tmp = '<a href="javascript'
var x = tmp + ':stuff"';

Unfortunately, you can't just concatenate the string literals with + (as the old version of this answer used to suggest) because new versions of JSLint added some special code to detect that:

var x = 'javascript' + ':' + 'stuff'; // JSLint might still give a warning here.

Edit: If you are using JSHint instead of JSLint you can set the "scripturl" option to supress this class of warnings without needing to use a workaround:

/*jshint scripturl:true*/
var x = 'javascript: foo()';

I ran into this issue too, like someone suggested before you can split it into parts to get around the warning but

var x = 'javascript' + ':';

won't work. A simpler way than the previously suggested method is:

var x = 'javascript' + ':'.toLowerCase() + 'alert("my action")';