Skip to content
Sarj Sarj Sarj Standards

React Doctor

492 rules react-doctor@0.9.14

Complete effective rule inventory.

Docs

Rules

40 rules on this page · 492 total

  • react-doctor/no-unguarded-browser-global-at-module-scope

    Reading window/navigator/localStorage at module scope throws ReferenceError: window is not defined when the module is imported during SSR. Move the read inside a function/effect, or guard it with typeof window !== "undefined".

    : warning in React projects
    No autofix
  • react-doctor/no-unguarded-browser-global-in-render-or-hook-init

    Move browser-only reads into an effect or event, guard them behind a client-only render path, or use useSyncExternalStore with a stable server snapshot.

    : error in React projects
    No autofix
  • react-doctor/no-unguarded-numeric-input-parse

    Guard Number(e.target.value) / parseInt(e.target.value) against empty and NaN before storing it. Number('') is 0 and Number('abc') is NaN, both of which silently ship a wrong value.

    : warning in React projects
    No autofix
  • react-doctor/no-uninformative-aria-label

    Name the action, not the element type: aria-label="Search", not aria-label="icon" or aria-label="button".

    : warning in React projects
    No autofix
  • react-doctor/no-unknown-property

    Use the prop name React expects, like className, htmlFor, or tabIndex, so the attribute is applied correctly.

    : warning in React projects
    No autofix
  • react-doctor/no-unowned-async-error-clear

    Guard async completion by request identity, perform an ownership-aware functional state update, or key the state-owning component by request ID.

    : warning in React projects
    No autofix
  • react-doctor/no-unsafe

    Move setup to constructor or componentDidMount, prop-derived state to getDerivedStateFromProps, and update side effects to componentDidUpdate so React does not rely on deprecated unsafe lifecycles.

    : warning in React projects
    No autofix
  • react-doctor/no-unstable-nested-components

    Move nested components to module scope so React does not remount them and lose state on every render.

    : warning in React projects
    No autofix
  • react-doctor/no-unthrottled-scroll-mutation

    Use a scroll or view timeline, IntersectionObserver, or a real timer throttle so animation work does not run for every scroll event.

    : warning in React projects
    No autofix
  • react-doctor/no-will-update-set-state

    Avoid setState in componentWillUpdate because it can loop forever; derive state before render or move guarded updates to componentDidUpdate.

    : warning in React projects
    No autofix
  • react-doctor/nosql-injection-risk

    Coerce scalar fields before querying, reject operator keys from client input, and avoid $where or request-derived regexes.

    : warning in React projects
    No autofix
  • react-doctor/only-export-components

    Move non-component exports out of component files so Fast Refresh can preserve component state instead of full-reloading.

    : warning in React projects
    No autofix
  • react-doctor/package-metadata-secret

    Keep secrets out of package metadata and generated reports; they are often published to registries, logs, or browser artifacts.

    : warning in React projects
    No autofix
  • react-doctor/path-traversal-risk

    Resolve paths against a fixed base directory, reject traversal after normalization, and map user-visible identifiers to server-owned paths.

    : warning in React projects
    No autofix
  • react-doctor/plugin-update-trust-risk

    Require signed updates/plugins, pin trusted repositories, verify hashes before execution, and keep custom repository installs behind explicit warnings.

    : warning in React projects
    No autofix
  • react-doctor/pointer-capture-needs-cancel-handler

    Handle onPointerCancel or onLostPointerCapture with the same cleanup used for pointer-up so interrupted drags cannot stay active.

    : warning in React projects
    No autofix
  • react-doctor/postmessage-origin-risk

    Validate event.origin against an exact allowlist before using event.data, especially when an iframe or parent window can be attacker-controlled.

    : warning in React projects
    No autofix
  • react-doctor/preact-no-children-length

    Wrap with toChildArray(children) because Preact's props.children is not always an array and array methods can crash.

    : warning in Preact projects
    No autofix
  • react-doctor/preact-no-react-hooks-import

    Import hooks from preact/hooks so they share Preact's renderer state instead of loading a second hook implementation.

    : warning in Preact projects
    No autofix
  • react-doctor/preact-no-render-arguments

    Read from this.props and this.state because preact/compat uses React's parameterless render() and positional props/state become undefined.

    : warning in Preact projects
    No autofix
  • react-doctor/preact-prefer-ondblclick

    Rename onDoubleClick to onDblClick because Preact core listens for the DOM dblclick event name and onDoubleClick never fires.

    : warning in Preact projects
    No autofix
  • react-doctor/preact-prefer-oninput

    Replace onChange with onInput on text-like inputs, or use preact/compat which remaps onChange automatically.

    : warning in Preact projects
    No autofix
  • react-doctor/prefer-html-dialog

    Replace the wrapper with <dialog> and open it with dialog.showModal(). For the trigger, prefer <button commandfor="id" command="show-modal"> (Chrome 135+), or a useRef with dialogRef.current?.showModal().

    : warning in React projects
    No autofix
  • react-doctor/prefer-tag-over-role

    Use the matching HTML element when one exists so browsers and assistive tech get native semantics.

    : warning in React projects
    No autofix
  • react-doctor/public-debug-artifact

    Remove debug artifacts from public output; logs and dumps often reveal source paths, internal routes, tokens, or environment snapshots.

    : warning in React projects
    No autofix
  • react-doctor/public-env-secret-name

    Public env prefixes are inlined into browser bundles. Rename public values to non-secret names, and keep tokens, passwords, private keys, and service-role credentials server-only.

    : warning in React projects
    No autofix
  • react-doctor/r3f-cap-device-pixel-ratio

    Cap devicePixelRatio, commonly at 2, or pass an explicit DPR range so high-density displays do not multiply rendering work without a bound

    : warning in React projects
    No autofix
  • react-doctor/r3f-limit-shadowed-point-lights

    Keep at most two shadow-casting point lights in one scene, or replace them with cheaper directional, spot, baked, or fake shadows

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-advancing-clock-in-use-frame

    Use the delta argument supplied to useFrame or read clock.elapsedTime without advancing the shared clock

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-allocation-in-pointer-move

    Reuse component-owned vectors and Three.js objects while handling pointer movement

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-async-use-frame

    Keep useFrame synchronous; start asynchronous work outside the render loop and consume its completed state from the callback

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-clone-in-use-frame

    Clone once outside the frame loop or reuse a scratch vector, quaternion, matrix, or object allocated with useMemo or useRef

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-compile-in-use-frame

    Precompile scene materials outside useFrame before they are first displayed

    : error in React projects
    No autofix
  • react-doctor/r3f-no-deep-use-three-selector

    Select the stable R3F store object, then read its mutable Three.js fields where they are consumed

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-dispose-loader-cache

    Do not dispose assets returned by cached R3F and Drei loader hooks

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-duplicate-primitive-object

    Mount a Three.js object through one <primitive>, or clone it deliberately when two independent instances are required

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-extend-in-render

    Call extend at module scope so React renders and Strict Mode replays do not repeatedly mutate R3F's global catalogue

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-extend-three-namespace

    Pass extend an object containing only the Three.js constructors used by JSX so bundlers can tree-shake the rest of the namespace

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-fresh-portal-container

    Keep the createPortal container stable with module scope, lazy state, or useMemo so R3F can preserve the portal store and event layer

    : warning in React projects
    No autofix
  • react-doctor/r3f-no-fresh-use-three-selector

    Select one stable store field at a time, or provide an equality function when returning an object or array from useThree

    : warning in React projects
    No autofix