rules-ant-design

Detected usage of 'moment.js'. While not a direct security vulnerability, 'moment.js' is considered a legacy library with a larger bundle size and mutable objects that can lead to subtle bugs. Ant Design and the React community generally recommend 'dayjs' or native 'Date' objects for date/time handling. Consider migrating to 'dayjs' for better performance, smaller bundle size, and modern immutable date practices.

Detected 'Input.Password' with 'visibilityToggle' explicitly set to 'false'. Disabling the password visibility toggle can negatively impact user experience and make it harder for users to verify their input, potentially leading to mistyped passwords and account lockouts. It is generally recommended to keep this feature enabled (which is the default behavior) to improve usability and reduce user frustration.

Detected usage of Ant Design v3 'Form.create()'. This Higher-Order Component (HOC) API is deprecated in Ant Design v4 and later. Please migrate to the modern 'Form' component and 'useForm' hook for improved maintainability, better performance, and full compatibility with React hooks. Using legacy APIs can lead to unexpected behavior, compatibility issues, or missed security updates in newer environments.

Detected direct HTML string (e.g., template literal with '<') being passed to Ant Design 'message', 'notification', or 'Alert' components' content/message/description props. This is a high-risk XSS vulnerability if the HTML originates from user input. Ensure all user-supplied content is rigorously sanitized using a library like 'dompurify' before being rendered as HTML in these components.

Detected Ant Design 'Upload' component without a 'beforeUpload' prop. This is a critical security risk as it allows users to upload any file type or size without client-side validation, potentially leading to Denial of Service (DoS), malware uploads, or other server-side vulnerabilities. Implement robust 'beforeUpload' logic to validate file type, size, and potentially content before the upload proceeds.

Detected 'dangerouslySetInnerHTML'. This is a critical Cross-Site Scripting (XSS) vulnerability if the content is not thoroughly sanitized. Always use a robust sanitization library like 'dompurify' to process any user-supplied or untrusted HTML before rendering. Prefer Ant Design's safe props or React's text rendering mechanisms where possible to avoid direct HTML injection.