| Name | Description |
|---|---|
| indent | Use 2 spaces |
| quotes | Use single quotes for strings |
| no-unused-vars | No unused variables. |
| keyword-spacing | Add a space after keywords. |
| space-before-function-paren | Add a space before a function declaration's parentheses. |
| eqeqeq | Always use |
| space-infix-ops | Infix operators |
| comma-spacing | Commas should have a space |
| brace-style | Keep else statements |
| curly | For multi-line if statements, |
| handle-callback-err | Always handle the |
| no-undef | Declare browser globals |
| no-multiple-empty-lines | Multiple blank lines not allowed. |
| operator-linebreak | For the ternary operator |
| one-var | For var declarations, |
| no-cond-assign | Wrap conditional assignments |
| block-spacing | Add spaces inside single line blocks. |
| camelcase | Use camelcase when naming variables and functions. |
| comma-dangle | Trailing commas not allowed. |
| comma-style | Commas must be placed at the end of the current line. |
| dot-location | Dot should be on the same line as property. |
| eol-last | Files must end with a newline. |
| func-call-spacing | No space between function identifiers and their invocations. |
| key-spacing | Add space between colon and value in key value pairs. |
| new-cap | Constructor names must begin with a capital letter. |
| new-parens | Constructor with no arguments must be invoked with parentheses. |
| accessor-pairs | Objects must contain a getter when a setter is defined. |
| constructor-super | Constructors of derived classes must call super. |
| no-array-constructor | Use array literals instead of array constructors. |
| no-caller | Avoid using arguments.callee and arguments.caller. |
| no-class-assign | Avoid modifying variables of class declarations. |
| no-const-assign | Avoid modifying variables declared using const. |
| no-constant-condition | Avoid using constant expressions in conditions (except loops). |
| no-control-regex | No control characters in regular expressions. |
| no-debugger | No debugger statements. |
| no-delete-var | No delete operator on variables. |
| no-dupe-args | No duplicate arguments in function definitions. |
| no-dupe-class-members | No duplicate name in class members. |
| no-dupe-keys | No duplicate keys in object literals. |
| no-duplicate-case | No duplicate case labels in switch statements. |
| no-duplicate-imports | Use a single import statement per module. |
| no-empty-character-class | No empty character classes in regular expressions. |
| no-empty-pattern | No empty destructuring patterns. |
| no-eval | No using eval(). |
| no-ex-assign | No reassigning exceptions in catch clauses. |
| no-extend-native | No extending native objects. |
| [no-extra-bind](http://eslint.org/docs/rules/no-extra-bind) | Avoid unnecessary function binding.
| no-extra-boolean-cast | Avoid unnecessary boolean casts. | no-extra-parens | No unnecessary parentheses around function expressions. | no-fallthrough | Use break to prevent fallthrough in switch cases. | no-floating-decimal | No floating decimals. | no-func-assign | Avoid reassigning function declarations. | no-global-assign | No reassigning read-only global variables. | no-implied-eval | No implied eval(). | no-inner-declarations | No function declarations in nested blocks. | no-invalid-regexp | No invalid regular expression strings in RegExp constructors. | no-irregular-whitespace | No irregular whitespace. | no-iterator | No using iterator. | no-label-var | No labels that share a name with an in scope variable. | no-labels | No label statements. | no-lone-blocks | No unnecessary nested blocks. | no-mixed-spaces-and-tabs | Avoid mixing spaces and tabs for indentation. | no-multi-spaces | Do not use multiple spaces except for indentation. | no-multi-str | No multiline strings. | no-new | No new without assigning object to a variable. | no-new-func | No using the Function constructor. | no-new-object | No using the Object constructor. | no-new-require | No using new require. | no-new-symbol | No using the Symbol constructor. | no-new-wrappers | No using primitive wrapper instances. | no-obj-calls | No calling global object properties as functions. | no-octal | No octal literals. | no-octal-escape | No octal escape sequences in string literals. | no-path-concat | Avoid string concatenation when using __dirname and __filename. | no-proto | Avoid using proto. | no-redeclare | No redeclaring variables. | no-regex-spaces | Avoid multiple spaces in regular expression literals. | no-return-assign | Assignments in return statements must be surrounded by parentheses. | no-self-assign | Avoid assigning a variable to itself | no-self-compare | Avoid comparing a variable to itself. | no-sequences | Avoid using the comma operator. | no-shadow-restricted-names | Restricted names should not be shadowed. | no-sparse-arrays | Sparse arrays are not allowed. | no-tabs | Tabs should not be used | no-template-curly-in-string | Regular strings must not contain template literal placeholders. | no-this-before-super | super() must be called before using this. | no-throw-literal | Only throw an Error object. | no-trailing-spaces | Whitespace not allowed at end of line. | no-undef-init | Initializing to undefined is not allowed. | no-unmodified-loop-condition | No unmodified conditions of loops. | no-unneeded-ternary | No ternary operators when simpler alternatives exist. | no-unreachable | No unreachable code after return, throw, continue, and break statements. | no-unsafe-finally | No flow control statements in finally blocks. | no-unsafe-negation | The left operand of relational operators must not be negated. | no-useless-call | Avoid unnecessary use of .call() and .apply(). | no-useless-computed-key | Avoid using unnecessary computed property keys on objects. | no-useless-constructor | No unnecessary constructor. | no-useless-escape | No unnecessary use of escape. | no-useless-rename | Renaming import, export, and destructured assignments to the same name is not allowed. | no-whitespace-before-property | No whitespace before properties. | no-with | No using with statements. | object-property-newline | Maintain consistency of newlines between object properties. | padded-blocks | No padding within blocks. | rest-spread-spacing | No whitespace between spread operators and their expressions. | semi-spacing | Semicolons must have a space after and no space before. | space-before-blocks | Must have a space before blocks. | space-in-parens | No spaces inside parentheses. | space-unary-ops | Unary operators must have a space after. | spaced-comment | Use spaces inside comments. | template-curly-spacing | No spacing in template strings. | use-isnan | Use isNaN() when checking for NaN. | valid-typeof | typeof must be compared to a valid string. | wrap-iife | Immediately Invoked Function Expressions (IIFEs) must be wrapped. | yield-star-spacing | The * in yield*expressions must have a space before and after. | yoda | Avoid Yoda conditions.
💼 Configurations enabled in.
✅ Set in the recommended configuration.
🔧 Automatically fixable by the --fix CLI option.
💡 Manually fixable by editor suggestions.
💭 Requires type information.
❌ Deprecated.
| Name | Description | 💼 | 🔧 | 💡 | 💭 | ❌ |
|---|---|---|---|---|---|---|
| anchor-precedence | Alternatives in regular expressions should be grouped when used with anchors | ✅ | 💭 | |||
| argument-type | Arguments to built-in functions should match documented types | ✅ | 💭 | |||
| arguments-order | Parameters should be passed in the correct order | ✅ | 💭 | |||
| arguments-usage | "arguments" should not be accessed directly | |||||
| array-callback-without-return | Callbacks of array methods should have return statements | ✅ | 💭 | |||
| array-constructor | Array constructors should not be used | 💡 | ||||
| arrow-function-convention | Braces and parentheses should be used consistently with arrow functions | |||||
| assertions-in-tests | Tests should include assertions | ✅ | ||||
| aws-apigateway-public-api | Creating public APIs is security-sensitive | ✅ | ||||
| aws-ec2-rds-dms-public | Allowing public network access to cloud resources is security-sensitive | ✅ | ||||
| aws-ec2-unencrypted-ebs-volume | Using unencrypted EBS volumes is security-sensitive | ✅ | ||||
| aws-efs-unencrypted | Using unencrypted EFS file systems is security-sensitive | ✅ | ||||
| aws-iam-all-privileges | Policies granting all privileges are security-sensitive | ✅ | ||||
| aws-iam-all-resources-accessible | Policies granting access to all resources of an account are security-sensitive | |||||
| aws-iam-privilege-escalation | AWS IAM policies should limit the scope of permissions given | ✅ | ||||
| aws-iam-public-access | Policies authorizing public access to resources are security-sensitive | ✅ | ||||
| aws-opensearchservice-domain | Using unencrypted Elasticsearch domains is security-sensitive | ✅ | ||||
| aws-rds-unencrypted-databases | Using unencrypted RDS DB resources is security-sensitive | ✅ | ||||
| aws-restricted-ip-admin-access | Administration services access should be restricted to specific IP addresses | ✅ | ||||
| aws-s3-bucket-granted-access | Granting access to S3 buckets to all or authenticated users is security-sensitive | ✅ | ||||
| aws-s3-bucket-insecure-http | Authorizing HTTP communications with S3 buckets is security-sensitive | ✅ | ||||
| aws-s3-bucket-public-access | Allowing public ACLs or policies on a S3 bucket is security-sensitive | ✅ | ||||
| aws-s3-bucket-server-encryption | Disabling server-side encryption of S3 buckets is security-sensitive | ❌ | ||||
| aws-s3-bucket-versioning | Disabling versioning of S3 buckets is security-sensitive | ✅ | ||||
| aws-sagemaker-unencrypted-notebook | Using unencrypted SageMaker notebook instances is security-sensitive | ✅ | ||||
| aws-sns-unencrypted-topics | Using unencrypted SNS topics is security-sensitive | ✅ | ||||
| aws-sqs-unencrypted-queue | Using unencrypted SQS queues is security-sensitive | ✅ | ||||
| bitwise-operators | Bitwise operators should not be used in boolean contexts | ✅ | ||||
| block-scoped-var | Variables should be used in the blocks where they are declared | ✅ | ||||
| bool-param-default | Optional boolean parameters should have default value | |||||
| call-argument-line | Function call arguments should not start on new lines | ✅ | ||||
| certificate-transparency | Disabling Certificate Transparency monitoring is security-sensitive | ❌ | ||||
| chai-determinate-assertion | Chai assertions should have only one reason to succeed | ✅ | ||||
| class-name | Class names should comply with a naming convention | ✅ | ||||
| class-prototype | Class methods should be used instead of "prototype" assignments | 💭 | ||||
| code-eval | Dynamically executing code is security-sensitive | ✅ | ||||
| cognitive-complexity | Cognitive Complexity of functions should not be too high | ✅ | ||||
| comma-or-logical-or-case | Comma and logical OR operators should not be used in switch cases | ✅ | ||||
| comment-regex | Track comments matching a regular expression | |||||
| concise-regex | Regular expression quantifiers and character classes should be used concisely | ✅ | 💭 | |||
| conditional-indentation | A conditionally executed single line should be denoted by indentation | ❌ | ||||
| confidential-information-logging | Allowing confidential information to be logged is security-sensitive | ✅ | ||||
| constructor-for-side-effects | Objects should not be created to be dropped immediately without being used | ✅ | ||||
| content-length | Allowing requests with excessive content length is security-sensitive | ✅ | ||||
| content-security-policy | Disabling content security policy fetch directives is security-sensitive | ✅ | ||||
| cookie-no-httponly | Creating cookies without the "HttpOnly" flag is security-sensitive | ✅ | ||||
| cookies | Writing cookies is security-sensitive | ❌ | ||||
| cors | Having a permissive Cross-Origin Resource Sharing policy is security-sensitive | ✅ | ||||
| csrf | Disabling CSRF protections is security-sensitive | ✅ | ||||
| cyclomatic-complexity | Cyclomatic Complexity of functions should not be too high | |||||
| declarations-in-global-scope | Variables and functions should not be declared in the global scope | |||||
| deprecation | Deprecated APIs should not be used | ✅ | 💭 | |||
| destructuring-assignment-syntax | Destructuring syntax should be used for assignments | |||||
| different-types-comparison | Strict equality operators should not be used with dissimilar types | ✅ | 💡 | 💭 | ||
| disabled-auto-escaping | Disabling auto-escaping in template engines is security-sensitive | ✅ | 💭 | |||
| disabled-resource-integrity | Using remote artifacts without integrity checks is security-sensitive | ✅ | 💭 | |||
| disabled-timeout | Disabling Mocha timeouts should be explicit | ✅ | ||||
| dns-prefetching | Allowing browsers to perform DNS prefetching is security-sensitive | ❌ | ||||
| duplicates-in-character-class | Character classes in regular expressions should not contain the same character twice | ✅ | 💭 | |||
| elseif-without-else | "if ... else if" constructs should end with "else" clauses | |||||
| empty-string-repetition | Repeated patterns in regular expressions should not match the empty string | ✅ | 💭 | |||
| encryption | Encrypting data is security-sensitive | ❌ | ||||
| encryption-secure-mode | Encryption algorithms should be used with secure mode and padding scheme | ✅ | ||||
| enforce-trailing-comma | Trailing commas should be used | 🔧 | ❌ | |||
| existing-groups | Replacement strings should reference existing regular expression groups | ✅ | 💭 | |||
| expression-complexity | Expressions should not be too complex | |||||
| file-header | Track lack of copyright and license headers | |||||
| file-name-differ-from-class | Default export names and file names should match | |||||
| file-permissions | Setting loose POSIX file permissions is security-sensitive | ✅ | ||||
| file-uploads | File uploads should be restricted | ✅ | ||||
| fixme-tag | Track uses of "FIXME" tags | ✅ | ||||
| for-in | "for...in" loops should filter properties before acting on them | |||||
| for-loop-increment-sign | A "for" loop update clause should move the counter in the right direction | ✅ | ||||
| frame-ancestors | Disabling content security policy frame-ancestors directive is security-sensitive | ✅ | ||||
| function-inside-loop | Functions should not be defined inside loops | ✅ | ||||
| function-name | Function and method names should comply with a naming convention | |||||
| function-return-type | Functions should always return the same type | ✅ | 💭 | |||
| future-reserved-words | Future reserved words should not be used as identifiers | ✅ | ||||
| generator-without-yield | Generators should explicitly "yield" a value | ✅ | ||||
| hashing | Using weak hashing algorithms is security-sensitive | ✅ | ||||
| hidden-files | Statically serving hidden files is security-sensitive | ✅ | ||||
| in-operator-type-error | "in" should not be used with primitive types | ✅ | 💭 | |||
| inconsistent-function-call | Functions should be called consistently with or without "new" | ✅ | ||||
| index-of-compare-to-positive-number | "indexOf" checks should not be for positive numbers | ✅ | 💭 | |||
| insecure-cookie | Creating cookies without the "secure" flag is security-sensitive | ✅ | ||||
| insecure-jwt-token | JWT should be signed and verified with strong cipher algorithms | ✅ | ||||
| inverted-assertion-arguments | Assertion arguments should be passed in the correct order | ✅ | 💡 | |||
| jsx-no-leaked-render | React components should not render non-boolean condition values | ✅ | 💡 | 💭 | ||
| label-position | Only "while", "do", "for" and "switch" statements should be labelled | ✅ | ||||
| link-with-target-blank | Authorizing an opened window to access back to the originating window is security-sensitive | ✅ | ||||
| max-lines | Files should not have too many lines of code | |||||
| max-lines-per-function | Functions should not have too many lines of code | |||||
| max-switch-cases | "switch" statements should not have too many "case" clauses | ✅ | ||||
| max-union-size | Union types should not have too many elements | |||||
| misplaced-loop-counter | "for" loop increment clauses should modify the loops' counters | ✅ | ||||
| nested-control-flow | Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply | |||||
| new-operator-misuse | "new" should only be used with functions and classes | ✅ | 💭 | |||
| no-all-duplicated-branches | All branches in a conditional structure should not have exactly the same implementation | ✅ | ||||
| no-alphabetical-sort | "Array.prototype.sort()" and "Array.prototype.toSorted()" should use a compare function | ✅ | 💡 | 💭 | ||
| no-angular-bypass-sanitization | Disabling Angular built-in sanitization is security-sensitive | ✅ | ||||
| no-array-delete | "delete" should not be used on arrays | ✅ | 💭 | |||
| no-associative-arrays | Array indexes should be numeric | ✅ | 💭 | |||
| no-async-constructor | Constructors should not contain asynchronous operations | ✅ | ||||
| no-built-in-override | Built-in objects should not be overridden | |||||
| no-case-label-in-switch | "switch" statements should not contain non-case labels | ✅ | ||||
| no-clear-text-protocols | Using clear-text protocols is security-sensitive | ✅ | ||||
| no-code-after-done | Tests should not execute any code after "done()" is called | ✅ | ||||
| no-collapsible-if | Mergeable "if" statements should be combined | |||||
| no-collection-size-mischeck | Collection size and array length comparisons should make sense | ✅ | 💡 | 💭 | ||
| no-commented-code | Sections of code should not be commented out | ✅ | 💡 | |||
| no-control-regex | Regular expressions should not contain control characters | ✅ | 💭 | |||
| no-dead-store | Unused assignments should be removed | ✅ | ||||
| no-delete-var | "delete" should be used only with object properties | ✅ | ||||
| no-duplicate-in-composite | Union and intersection types should not include duplicated constituents | ✅ | 💡 | |||
| no-duplicate-string | String literals should not be duplicated | |||||
| no-duplicated-branches | Two branches in a conditional structure should not have exactly the same implementation | ✅ | ||||
| no-element-overwrite | Collection elements should not be replaced unconditionally | ✅ | ||||
| no-empty-after-reluctant | Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string | ✅ | 💭 | |||
| no-empty-alternatives | Alternation in regular expressions should not contain empty alternatives | ✅ | 💭 | |||
| no-empty-character-class | Empty character classes should not be used | ✅ | 💭 | |||
| no-empty-collection | Empty collections should not be accessed or iterated | ✅ | ||||
| no-empty-group | Regular expressions should not contain empty groups | ✅ | 💭 | |||
| no-empty-test-file | Test files should contain at least one test case | ✅ | ||||
| no-equals-in-for-termination | Equality operators should not be used in "for" loop termination conditions | ✅ | ||||
| no-exclusive-tests | Exclusive tests should not be committed to version control | ✅ | 💡 | |||
| no-extra-arguments | Function calls should not pass extra arguments | ✅ | ||||
| no-fallthrough | Switch cases should end with an unconditional "break" statement | ✅ | ||||
| no-for-in-iterable | "for in" should not be used with iterables | 💭 | ||||
| no-function-declaration-in-block | Function declarations should not be made within blocks | |||||
| no-global-this | The global "this" object should not be used | ✅ | 💡 | |||
| no-globals-shadowing | Special identifiers should not be bound or assigned | ✅ | ||||
| no-gratuitous-expressions | Boolean expressions should not be gratuitous | ✅ | ||||
| no-hardcoded-ip | Using hardcoded IP addresses is security-sensitive | ✅ | ||||
| no-hardcoded-passwords | Hard-coded passwords are security-sensitive | ✅ | ||||
| no-hardcoded-secrets | Hard-coded secrets are security-sensitive | ✅ | ||||
| no-hook-setter-in-body | React's useState hook should not be used directly in the render function or body of a component | ✅ | ||||
| no-identical-conditions | "if/else if" chains and "switch" cases should not have the same condition | ✅ | ||||
| no-identical-expressions | Identical expressions should not be used on both sides of a binary operator | ✅ | ||||
| no-identical-functions | Functions should not have identical implementations | ✅ | ||||
| no-ignored-exceptions | Exceptions should not be ignored | ✅ | ||||
| no-ignored-return | Return values from functions without side effects should not be ignored | ✅ | 💭 | |||
| no-implicit-dependencies | Dependencies should be explicit | |||||
| no-implicit-global | Variables should be declared explicitly | ✅ | ||||
| no-in-misuse | "in" should not be used on arrays | ✅ | 💡 | 💭 | ||
| no-incomplete-assertions | Assertions should be complete | ✅ | ||||
| no-inconsistent-returns | Functions should use "return" consistently | |||||
| no-incorrect-string-concat | Strings and non-strings should not be added | 💭 | ||||
| no-internal-api-use | Users should not use internal APIs | ✅ | ||||
| no-intrusive-permissions | Using intrusive permissions is security-sensitive | ✅ | ||||
| no-invalid-regexp | Regular expressions should be syntactically valid | ✅ | 💭 | |||
| no-invariant-returns | Function returns should not be invariant | ✅ | ||||
| no-inverted-boolean-check | Boolean checks should not be inverted | ✅ | 🔧 | 💡 | ||
| no-ip-forward | Forwarding client IP address is security-sensitive | ✅ | ||||
| no-labels | Labels should not be used | ✅ | ||||
| no-literal-call | Literals should not be used as functions | ✅ | ||||
| no-mime-sniff | Allowing browsers to sniff MIME types is security-sensitive | ✅ | ||||
| no-misleading-array-reverse | Array-mutating methods should not be used misleadingly | ✅ | 💡 | 💭 | ||
| no-misleading-character-class | Unicode Grapheme Clusters should be avoided inside regex character classes | ✅ | 💡 | 💭 | ||
| no-mixed-content | Allowing mixed-content is security-sensitive | ✅ | ||||
| no-nested-assignment | Assignments should not be made from within sub-expressions | ✅ | ||||
| no-nested-conditional | Ternary operators should not be nested | ✅ | ||||
| no-nested-functions | Functions should not be nested too deeply | ✅ | ||||
| no-nested-incdec | Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression | |||||
| no-nested-switch | "switch" statements should not be nested | |||||
| no-nested-template-literals | Template literals should not be nested | ✅ | ||||
| no-os-command-from-path | Searching OS commands in PATH is security-sensitive | ✅ | ||||
| no-parameter-reassignment | Initial values of parameters, caught exceptions, and loop variables should not be ignored | ✅ | ||||
| no-primitive-wrappers | Wrapper objects should not be used for primitive types | ✅ | 💡 | |||
| no-redundant-assignments | Assignments should not be redundant | ✅ | ||||
| no-redundant-boolean | Boolean literals should not be used in comparisons | ✅ | ||||
| no-redundant-jump | Jump statements should not be redundant | ✅ | 💡 | |||
| no-redundant-optional | Optional property declarations should not use both '?' and 'undefined' syntax | ✅ | 💡 | 💭 | ||
| no-redundant-parentheses | Redundant pairs of parentheses should be removed | 💡 | ❌ | |||
| no-reference-error | Variables should be defined before being used | |||||
| no-referrer-policy | Disabling strict HTTP no-referrer policy is security-sensitive | ✅ | ||||
| no-regex-spaces | Regular expressions should not contain multiple spaces | ✅ | 💡 | 💭 | ||
| no-require-or-define | "import" should be used to include external code | 💭 | ||||
| no-return-type-any | Primitive return types should be used | 💭 | ||||
| no-same-argument-assert | Assertions should not be given twice the same argument | ✅ | ||||
| no-same-line-conditional | Conditionals should start on new lines | ✅ | 💡 | |||
| no-selector-parameter | Methods should not contain selector parameters | ✅ | 💭 | |||
| no-skipped-tests | Tests should not be skipped without providing a reason | ✅ | ||||
| no-small-switch | "if" statements should be preferred over "switch" when simpler | ✅ | ||||
| no-sonar-comments | Track uses of "NOSONAR" comments | |||||
| no-tab | Tabulation characters should not be used | ❌ | ||||
| no-table-as-layout | HTML "<table>" should not be used for layout purposes | ✅ | ||||
| no-try-promise | Promise rejections should not be caught by "try" blocks | ✅ | 💭 | |||
| no-undefined-argument | "undefined" should not be passed as the value of optional parameters | ✅ | 💡 | 💭 | ||
| no-undefined-assignment | "undefined" should not be assigned | |||||
| no-unenclosed-multiline-block | Multiline blocks should be enclosed in curly braces | ✅ | ||||
| no-uniq-key | JSX list components keys should match up between renders | ✅ | ||||
| no-unsafe-unzip | Expanding archive files without controlling resource consumption is security-sensitive | ✅ | ||||
| no-unthrown-error | Errors should not be created without being thrown | ✅ | 💡 | |||
| no-unused-collection | Collection contents should be used | ✅ | ||||
| no-unused-function-argument | Unused function parameters should be removed | 💡 | ||||
| no-unused-vars | Unused local variables and functions should be removed | ✅ | ||||
| no-use-of-empty-return-value | The return value of void functions should not be used | ✅ | ||||
| no-useless-catch | "catch" clauses should do more than rethrow | ✅ | ||||
| no-useless-increment | Values should not be uselessly incremented | ✅ | ||||
| no-useless-intersection | Type intersections should use meaningful types | ✅ | 💭 | |||
| no-useless-react-setstate | React state setter function should not be called with its matching state variable | ✅ | ||||
| no-variable-usage-before-declaration | Variables declared with "var" should be declared before they are used | |||||
| no-vue-bypass-sanitization | Disabling Vue.js built-in escaping is security-sensitive | ❌ | ||||
| no-weak-cipher | Cipher algorithms should be robust | ✅ | ||||
| no-weak-keys | Cryptographic keys should be robust | ✅ | ||||
| no-wildcard-import | Wildcard imports should not be used | |||||
| non-existent-operator | Non-existent operators '=+', '=-' and '=!' should not be used | ✅ | 💡 | |||
| non-number-in-arithmetic-expression | Arithmetic operators should only have numbers as operands | 💭 | ||||
| null-dereference | Properties of variables with "null" or "undefined" values should not be accessed | ✅ | 💭 | |||
| object-alt-content | "" tags should provide an alternative content | ✅ | ||||
| operation-returning-nan | Arithmetic operations should not result in "NaN" | 💭 | ||||
| os-command | Using shell interpreter when executing OS commands is security-sensitive | ✅ | ||||
| post-message | Origins should be verified during cross-origin communications | ✅ | 💭 | |||
| prefer-default-last | "default" clauses should be last | ✅ | ||||
| prefer-immediate-return | Local variables should not be declared and then immediately returned or thrown | 🔧 | ||||
| prefer-object-literal | Object literal syntax should be used | |||||
| prefer-promise-shorthand | Shorthand promises should be used | ✅ | 💡 | |||
| prefer-read-only-props | React props should be read-only | ✅ | 💡 | 💭 | ||
| prefer-regexp-exec | "RegExp.exec()" should be preferred over "String.match()" | ✅ | 💡 | 💭 | ||
| prefer-single-boolean-return | Return of boolean expressions should not be wrapped into an "if-then-else" statement | ✅ | 💡 | |||
| prefer-type-guard | Type predicates should be used | ✅ | 💡 | |||
| prefer-while | A "while" loop should be used instead of a "for" loop | ✅ | 🔧 | |||
| process-argv | Using command line arguments is security-sensitive | ❌ | ||||
| production-debug | Delivering code in production with debug features activated is security-sensitive | ✅ | ||||
| pseudo-random | Using pseudorandom number generators (PRNGs) is security-sensitive | ✅ | ||||
| public-static-readonly | Public "static" fields should be read-only | ✅ | 💡 | |||
| publicly-writable-directories | Using publicly writable directories is security-sensitive | ✅ | ||||
| reduce-initial-value | "Array.reduce()" calls should include an initial value | ✅ | 💭 | |||
| redundant-type-aliases | Redundant type aliases should not be used | ✅ | ||||
| regex-complexity | Regular expressions should not be too complicated | ✅ | 💭 | |||
| regular-expr | Using regular expressions is security-sensitive | ❌ | ||||
| session-regeneration | A new session should be created during user authentication | ✅ | ||||
| shorthand-property-grouping | Shorthand object properties should be grouped at the beginning or end of an object declaration | |||||
| single-char-in-character-classes | Character classes in regular expressions should not contain only one character | ✅ | 💭 | |||
| single-character-alternation | Single-character alternations in regular expressions should be replaced with character classes | ✅ | 💭 | |||
| slow-regex | Using slow regular expressions is security-sensitive | ✅ | 💭 | |||
| sockets | Using Sockets is security-sensitive | ❌ | ||||
| sql-queries | Formatting SQL queries is security-sensitive | ✅ | ||||
| stable-tests | Tests should be stable | ✅ | ||||
| standard-input | Reading the Standard Input is security-sensitive | ❌ | ||||
| stateful-regex | Regular expressions with the global flag should be used with caution | ✅ | ||||
| strict-transport-security | Disabling Strict-Transport-Security policy is security-sensitive | ✅ | ||||
| strings-comparison | Comparison operators should not be used with strings | 💭 | ||||
| super-invocation | "super()" should be invoked appropriately | ✅ | ||||
| table-header | Tables should have headers | ✅ | ||||
| table-header-reference | Table cells should reference their headers | ✅ | ||||
| test-check-exception | Tests should check which exception is thrown | ✅ | ||||
| todo-tag | Track uses of "TODO" tags | ✅ | ||||
| too-many-break-or-continue-in-loop | Loops should not contain more than a single "break" or "continue" statement | |||||
| unicode-aware-regex | Regular expressions using Unicode character classes or property escapes should enable the unicode flag | 💭 | ||||
| unused-import | Unnecessary imports should be removed | ✅ | 💡 | 💭 | ||
| unused-named-groups | Names of regular expressions named groups should be used | ✅ | 💭 | |||
| unverified-certificate | Server certificates should be verified during SSL/TLS connections | ✅ | ||||
| unverified-hostname | Server hostnames should be verified during SSL/TLS connections | ✅ | ||||
| updated-const-var | "const" variables should not be reassigned | ✅ | ||||
| updated-loop-counter | Loop counters should not be assigned within the loop body | ✅ | ||||
| use-type-alias | Type aliases should be used | ✅ | ||||
| useless-string-operation | Results of operations on strings should not be ignored | 💭 | ❌ | |||
| values-not-convertible-to-numbers | Values not convertible to numbers should not be used in numeric comparisons | 💭 | ||||
| variable-name | Variable, property and parameter names should comply with a naming convention | |||||
| void-use | "void" should not be used | ✅ | 💭 | |||
| weak-ssl | Weak SSL/TLS protocols should not be used | ✅ | ||||
| web-sql-database | Web SQL databases should not be used | 💭 | ❌ | |||
| x-powered-by | Disclosing fingerprints from web application technologies is security-sensitive | ✅ | ||||
| xml-parser-xxe | XML parsers should not be vulnerable to XXE attacks | ✅ | ||||
| xpath | Executing XPath expressions is security-sensitive | ❌ |
SonarJS uses some rules are not shipped in this ESLint plugin to avoid duplication with already existing rules from ESLint core and third-party ESLint plugins. The following rules are used directly, without modifying the original behavior:
The following rules are used in SonarJS but not available in this ESLint plugin. These rules have been modified, so your experience using them in your ESLint configuration may differ from the results you may get using SonarQube.