function foo() { return "noopener noreferrer"; } var o = { rel: "noopener noreferrer "}; Example; Example; Example; Example; Example; Example; // OK - because of constant URL Example; Example; Example; Example; // $ Alert - because of dynamic URL Example; // $ Alert Example; // $ Alert function f() { var a1 = $("", { href: "http://example.com" }); a1.attr("target", "_blank"); var a2 = $("", { href: "http://example.com" }); a2.attr("target", "_blank"); a2.attr(computedName(), "noopener"); var a3 = $("", { href: "{{X}}" }); // $ Alert a3.attr("target", "_blank"); var a4 = $(""); a4[f()] = g(); a4.attr("target", "_blank"); var a5 = $(""); // $ Alert a5.attr("href", g()); a5.attr("target", "_blank"); } // OK - because of dynamic URL with fixed host Example; Example; Example; Example; Example; Example; // OK - because of dynamic URL with relative path Example; Example; Example; Example; Example; // OK - Flask application with internal links Example; Example; Example; // OK - nunjucks template Example; // OK - Django application with internal links Example