Skip to content
Sarj Sarj Sarj Standards

React Doctor

492 rules react-doctor@0.9.14

Complete effective rule inventory.

Docs

Rules

40 rules on this page · 492 total

  • react-doctor/active-static-asset

    Prefer <img> for SVG images; if SVG must be served directly, use attachment disposition and a CSP that blocks scripts and objects.

    : warning in React projects
    No autofix
  • react-doctor/alt-text

    Give every meaningful image an alt, aria-label, or aria-labelledby.

    : error in React projects
    No autofix
  • react-doctor/anchor-ambiguous-text

    Name where a link goes. Avoid 'click here', 'learn more', and 'link'.

    : warning in React projects
    No autofix
  • react-doctor/anchor-has-content

    Put readable text inside every link.

    : warning in React projects
    No autofix
  • react-doctor/anchor-is-valid

    Give links a real destination. Use <button> for in-page actions.

    : warning in React projects
    No autofix
  • react-doctor/anchor-target-exists

    Add an element with the referenced id, or update the fragment link to point to an existing target.

    : warning in React projects
    No autofix
  • react-doctor/aria-activedescendant-has-tabindex

    Add tabIndex so keyboard users can reach elements that use aria-activedescendant.

    : warning in React projects
    No autofix
  • react-doctor/aria-props

    Only use aria-* attributes that actually exist.

    : error in React projects
    No autofix
  • react-doctor/aria-proptypes

    Give each aria-* attribute the kind of value it expects.

    : error in React projects
    No autofix
  • react-doctor/aria-role

    Use a real, non-abstract ARIA role so assistive tech can expose the element correctly.

    : error in React projects
    No autofix
  • react-doctor/aria-unsupported-elements

    Do not put role or aria-* on reserved HTML elements.

    : error in React projects
    No autofix
  • react-doctor/artifact-env-leak

    Treat public env prefixes as publication, not secrecy; keep secret env vars server-only and rebuild after rotating leaked keys.

    : error in React projects
    No autofix
  • react-doctor/artifact-secret-leak

    Remove the secret from client bundles/static assets, rotate it, and route privileged service calls through server-only code.

    : error in React projects
    No autofix
  • react-doctor/auth-token-in-web-storage

    Don't persist auth tokens (JWTs, access/refresh tokens, secrets) in localStorage/sessionStorage; they're readable by any XSS. Use an HttpOnly cookie set by the server.

    : warning in React projects
    No autofix
  • react-doctor/autocomplete-valid

    Use a valid autofill token in autoComplete so browsers can fill the right field reliably.

    : warning in React projects
    No autofix
  • react-doctor/base-ui-dialog-popup-requires-title

    Give every Base UI Dialog.Popup and AlertDialog.Popup a Title part (visually hidden when the design shows no heading) or name the dialog with aria-label.

    : warning in React projects
    No autofix
  • react-doctor/base-ui-field-requires-label

    Give every Field.Root that wraps a Field.Control a Field.Label (visually hidden when the design shows no label) or name the control directly with aria-label.

    : warning in React projects
    No autofix
  • react-doctor/base-ui-tabs-tab-requires-list

    Render each Base UI Tabs.Tab inside Tabs.List so the tablist role and arrow-key focus handling cover every tab.

    : warning in React projects
    No autofix
  • react-doctor/build-pipeline-secret-boundary

    Run dependency installs with scripts disabled before exposing secrets, isolate untrusted build code, and move signing/deploy authority into a narrow privileged step.

    : warning in React projects
    No autofix
  • react-doctor/button-has-type

    Set an explicit button type so plain buttons do not submit forms by accident: type="button", "submit", or "reset".

    : warning in React projects
    No autofix
  • react-doctor/checked-requires-onchange-or-readonly

    Add onChange, readOnly, or defaultChecked so React knows whether the checkbox is editable, display-only, or uncontrolled.

    : warning in React projects
    No autofix
  • react-doctor/class-component-missing-component-will-unmount-teardown

    Release listeners and timers acquired in componentDidMount/constructor by adding a componentWillUnmount that removes them (or use MobX disposeOnUnmount).

    : warning in React projects
    No autofix
  • react-doctor/click-events-have-key-events

    Pair onClick with a key handler so keyboard users can trigger it.

    : warning in React projects
    No autofix
  • react-doctor/clickjacking-redirect-risk

    Allowlist redirect origins/paths, set frame-ancestors for privileged pages, and avoid URL-prefilled privileged dialogs.

    : warning in React projects
    No autofix
  • react-doctor/command-execution-input-risk

    Avoid shell execution for caller-controlled values. Use fixed commands, argument arrays, strict allowlists, and no shell interpolation.

    : error in React projects
    No autofix
  • react-doctor/control-has-associated-label

    Give every interactive control a label screen readers can read.

    : warning in React projects
    No autofix
  • react-doctor/cors-cookie-trust-risk

    Keep auth cookies host-only and HttpOnly, avoid credentialed CORS for less-trusted docs/vendor origins, and isolate documentation domains from app sessions.

    : warning in React projects
    No autofix
  • react-doctor/dangerous-html-sink

    Prefer rendering structured React nodes. If HTML is required, sanitize with a well-reviewed sanitizer and keep the trust boundary close to the sink.

    : warning in React projects
    No autofix
  • react-doctor/debounce-no-cleanup

    A debounced/throttled callback holds a pending timer that still fires after unmount, so add useEffect(() => () => debounced.cancel(), [debounced]) to cancel the trailing invocation when the component tears down.

    : warning in React projects
    No autofix
  • react-doctor/dialog-has-accessible-name

    Give every <dialog> / role="dialog" an accessible name with aria-label or aria-labelledby (referencing the dialog's title element).

    : warning in React projects
    No autofix
  • react-doctor/duplicate-jsx-subtree

    Extract a shared component when the repeated JSX trees represent the same UI concept and should evolve together.

    : warning in React projects
    No autofix
  • react-doctor/effect-listener-cleanup-mismatch

    Pass the same callback binding and capture flag to addEventListener and removeEventListener, or abort the registration's local AbortController during cleanup.

    : error in React projects
    No autofix
  • react-doctor/effect-listener-cleanup-reference-mismatch

    Removal APIs match by reference identity, so the second inline function passed to the remove call can never equal the one you added; hoist the handler into a single named const (or useCallback) and pass that same reference to both the add and remove calls.

    : error in React projects
    No autofix
  • react-doctor/effect-observer-needs-disconnect

    Return a cleanup function that calls observer.disconnect() (or observer.unobserve(node)) so the observer stops firing callbacks against detached nodes after unmount instead of leaking on every mount.

    : error in React projects
    No autofix
  • react-doctor/effect-raf-loop-needs-cancel

    Store the frame id and return a cleanup that calls cancelAnimationFrame(id) so self-scheduling work cannot continue after unmount.

    : warning in React projects
    No autofix
  • react-doctor/expo-no-non-inlined-env

    Read env vars with static dotted access (process.env.EXPO_PUBLIC_NAME). Computed access and destructuring aren't inlined by babel-preset-expo and resolve to undefined at runtime.

    : warning in React Native projects
    No autofix
  • react-doctor/firebase-client-owned-authz-field

    Derive authority fields on the server or enforce them in Firebase/Supabase rules; never trust client-provided owner, org, or role values.

    : error in React projects
    No autofix
  • react-doctor/firebase-permissive-rules

    Bind every read/write to request.auth.uid, immutable ownership, and tenant membership instead of treating sign-in as authorization.

    : error in React projects
    No autofix
  • react-doctor/forbid-dom-props

    Configure blocked DOM props so plain HTML tags stay on the agreed DOM API surface.

    : warning in React projects
    No autofix
  • react-doctor/forbid-elements

    Configure blocked elements so code stays on the approved UI primitives.

    : warning in React projects
    No autofix