rules-react

Empty dependency array [] means this hook only runs once (on mount). Verify this is intentional and there are no stale closure issues with captured values.

Dynamic href detected. Validate that user-supplied values cannot inject javascript: or data: URIs.

'use server' exposes an HTTP endpoint callable by any client (see CVE-2025-55182/55183/55184). Authenticate + authorize every server action, validate all arguments, and ensure React is on >=19.0.1/19.1.2/19.2.1.

aria-hidden="true" on a focusable element creates a keyboard trap — the element is invisible to screen readers but still reachable by keyboard. Remove tabIndex or aria-hidden.

autoFocus moves keyboard focus unexpectedly, which can disorient screen reader users navigating a page. Use autoFocus only for modal dialogs or intentional focus management.

Interactive element with onClick but no keyboard handler. Non-button/anchor elements with click handlers are inaccessible to keyboard users. Use <button> or add onKeyDown.

dangerouslySetInnerHTML bypasses React's XSS protection. If you need HTML rendering, sanitize with DOMPurify first: dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(html) }}

Button with no text label. Screen readers will announce it as 'button' with no context. Add visible text or an aria-label attribute.

findDOMNode was removed in React 19. Use a ref (useRef/createRef) attached to the target element instead.

React hooks must not be called inside conditionals. This violates the Rules of Hooks and causes unpredictable behavior. Move the hook call to the top level.

href="javascript:" enables XSS attacks. Use onClick handlers instead of javascript: URIs.

img element missing alt attribute. Screen readers cannot describe the image. Add alt="description" for meaningful images, alt="" for decorative ones.

Array .map() rendering detected. Ensure each rendered element has a unique 'key' prop — missing keys cause incorrect re-renders and React warnings.

Referencing the x-middleware-subrequest header is associated with CVE-2025-29927 (Next.js middleware auth bypass). Upgrade Next.js to >=14.2.25 / >=15.2.3 and strip this header at the edge; do not trust it in application code.

X-React-Router-SPA-Mode / X-React-Router-Prerender-Data headers are attacker-controlled inputs behind CVE-2025-43864/43865 (cache poisoning, data spoofing). Upgrade react-router to >=7.5.2 and never forward or trust these headers.

RISK: assigning to ref.current.innerHTML bypasses React's XSS escaping entirely — any user-controlled content becomes injected HTML. FIX: use textContent for plain text, or sanitise with DOMPurify.sanitize() before assigning innerHTML.

Calling setState directly in the render body (outside useEffect) causes an infinite render loop. Move state updates into event handlers or useEffect.

String refs (ref="name") were removed in React 19. Use useRef() or a callback ref (ref={el => ...}) instead.

target="_blank" without rel="noopener noreferrer" allows the new page to access window.opener (reverse tabnapping). Add rel="noopener noreferrer".

Storing auth tokens in localStorage exposes them to any XSS on the page (OWASP guidance). Keep access tokens in memory and long-lived refresh tokens in HttpOnly SameSite cookies.