Skip to content
Sarj Sarj Sarj Standards

React Doctor

492 rules react-doctor@0.9.14

Complete effective rule inventory.

Docs

Rules

32 rules on this page · 492 total

  • react-doctor/ink-no-repeated-render

    Call Ink render() once and update or rerender the returned instance.

    : error in React projects
    No autofix
  • react-doctor/ink-prefer-use-animation

    Use Ink's shared useAnimation() scheduler and automatic unmount cleanup.

    : warning in React projects
    No autofix
  • react-doctor/ink-static-is-append-only

    Pass <Static> a collection whose existing entries never reorder or disappear.

    : warning in React projects
    No autofix
  • react-doctor/ink-static-requires-key

    Put a stable key on the root element returned by <Static>.

    : error in React projects
    No autofix
  • react-doctor/ink-use-reactive-window-size

    Use Ink's useWindowSize() so resize events trigger a render.

    : warning in React projects
    No autofix
  • react-doctor/ink-use-string-width-for-cursor

    Measure terminal columns with string-width before calling setCursorPosition.

    : warning in React projects
    No autofix
  • react-doctor/ink-use-suspend-terminal

    Run inherited-TTY child processes inside useApp().suspendTerminal().

    : error in React projects
    No autofix
  • react-doctor/ink-valid-aria-semantics

    Use a role supported by Ink and do not label elements hidden from screen readers.

    : error in React projects
    No autofix
  • react-doctor/insecure-crypto-risk

    Use modern primitives, crypto.randomBytes / Web Crypto randomness, and timing-safe comparisons for signatures, digests, tokens, and auth material.

    : warning in React projects
    No autofix
  • react-doctor/insecure-session-cookie

    Set auth/session cookies server-side with httpOnly: true, secure: true, and sameSite. Cookies set via document.cookie or with httpOnly: false are readable by any XSS payload and can be stolen.

    : warning in React projects
    No autofix
  • react-doctor/interactive-supports-focus

    Add keyboard focus support so users can reach interactive elements without a pointer.

    : warning in React projects
    No autofix
  • react-doctor/jotai-derived-atom-returns-fresh-object

    Split it into one derived atom per field (each compares cleanly with Object.is), or wrap with selectAtom(source, fn, shallow) from jotai/utils if you really need one object.

    : warning in React projects
    No autofix
  • react-doctor/jotai-select-atom-in-render-body

    Lift selectAtom(base, fn) to module scope, or wrap it: const atom = useMemo(() => selectAtom(base, fn), [deps]). Calling it during render makes a new atom every time and re-subscribes forever.

    : error in React projects
    No autofix
  • react-doctor/jotai-tq-use-raw-query-atom

    Derive the field you read: const dataAtom = atom((get) => get(queryAtom).data). Subscribing to the whole query atom re-renders on every refetch, focus, or no-op cache hit.

    : warning in React projects
    No autofix
  • react-doctor/js-async-reduce-without-awaited-acc

    Await the accumulator first: const acc = await previous; ...; return acc;. Seed it with Promise.resolve(initial) so the first run also gets a Promise

    : warning in React projects
    No autofix
  • react-doctor/jsx-key

    Add a stable key prop so React can keep list items matched to the right data when the list changes.

    : error in React projects
    No autofix
  • react-doctor/jsx-no-comment-textnodes

    Wrap JSX comments in {/* … */} so users do not see comment text rendered as children.

    : warning in React projects
    No autofix
  • react-doctor/jsx-no-constructed-context-values

    Wrap the context value in useMemo or move it outside the component so consumers do not redraw every render.

    : warning in React projects
    No autofix
  • react-doctor/jsx-no-duplicate-props

    Remove or rename one of the duplicate props so the later value does not silently override the earlier one.

    : error in React projects
    No autofix
  • react-doctor/jsx-no-jsx-as-prop

    Move the JSX outside the component or wrap it in useMemo so memoized children do not redraw every render.

    : warning in React projects
    No autofix
  • react-doctor/jsx-no-new-array-as-prop

    Wrap the array in useMemo or move it outside the component so memoized children do not redraw every render.

    : warning in React projects
    No autofix
  • react-doctor/jsx-no-new-function-as-prop

    Wrap the callback in useCallback or move it outside the component so memoized children do not redraw every render.

    : warning in React projects
    No autofix
  • react-doctor/jsx-no-new-object-as-prop

    Wrap the object in useMemo or move it outside the component so memoized children do not redraw every render.

    : warning in React projects
    No autofix
  • react-doctor/jsx-no-script-url

    Use real event handlers instead of javascript: URLs so injected URL text cannot execute as code.

    : error in React projects
    No autofix
  • react-doctor/jsx-no-target-blank

    Add rel="noreferrer" (or "noopener") when using target="_blank".

    : warning in React projects
    No autofix
  • react-doctor/jsx-no-undef

    Import the component or fix the typo so React can resolve the JSX identifier at runtime.

    : error in React projects
    No autofix
  • react-doctor/jsx-numeric-and-leaked-render

    In {items.length && <List/>} React renders a literal 0 when the count is 0. Compare explicitly (items.length > 0 && <List/>) or use a ternary (items.length ? <List/> : null).

    : warning in React projects
    No autofix
  • react-doctor/jsx-props-no-spread-multi

    Spread each value at most once so later props cannot silently override earlier props from the same object.

    : warning in React projects
    No autofix
  • react-doctor/jwt-insecure-verification

    Never accept the none algorithm; it disables signature verification and lets any forged token through. Pin the real algorithm(s) explicitly (jwt.verify(token, key, { algorithms: ['RS256'] })).

    : error in React projects
    No autofix
  • react-doctor/key-lifecycle-risk

    Remove private keys from source, rotate exposed credentials, prefer short-lived deploy credentials, and document revocation/expiry for release keys.

    : error in React projects
    No autofix
  • react-doctor/label-has-associated-control

    Tie every label to a control with htmlFor, or by nesting the input.

    : warning in React projects
    No autofix
  • react-doctor/lang

    Use a valid language code like en or en-US so screen readers choose the right pronunciation rules.

    : warning in React projects
    No autofix