Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
tslint-react
Advanced tools
Lint rules related to React & JSX for TSLint.
tslint-react has peer dependencies on TSLint and TypeScript.
To use these lint rules with the default preset, use configuration inheritance via the extends
keyword.
Here's a sample configuration where tslint.json
lives adjacent to your node_modules
folder:
{
"extends": ["tslint:latest", "tslint-react"],
"rules": {
// override tslint-react rules here
"jsx-wrap-multiline": false
}
}
To lint your .ts
and .tsx
files you can simply run tslint -c tslint.json 'src/**/*.{ts,tsx}'
.
The built-in configuration preset you get with "extends": "tslint-react"
is semantically versioned in a manner similar to TSLint's built-in presets and the TypeScript language itself. As new rules are added to tslint-react across minor versions, stricter checks may be enabled here. Your code is not guaranteed to continue passing checks across these version bumps. If you wish to ensure that npm upgrade
or yarn upgrade
never breaks your build, declare a tilde dependency on this package (e.g. "~1.0.0"
).
jsx-alignment
// Good:
const element = <div
className="foo"
tabIndex={1}
>
{children}
</div>;
// Also Good:
<Button
appearance="pretty"
disabled
label="Click Me"
size={size}
/>
jsx-ban-elements
(since v3.4.0)
jsx-ban-props
(since v2.3.0)
jsx-boolean-value
(since v2.5.0)
["always", "never"]
always
.jsx-curly-spacing
(since v1.1.0)
["always", "never"]
jsx-equals-spacing
(since v3.2.0)
=
token in JSX element attributes.["always", "never"]
jsx-key
(since v3.2.0)
key
props in JSX element array literals and inside return statements of Array.prototype.map
callbacks.
.map(...)
syntax and does not inspect computed types of expressions. As such, it may produce false positives if you use APIs that look similar to .map()
.jsx-no-bind
(since v2.6.0)
jsx-no-lambda
in helping you avoid excessive re-renders..bind
function and supply this
as a parameter.jsx-no-lambda
function
syntax or ES2015 arrow syntax) inside the render
call stack works against pure component rendering. When doing an equality check between two lambdas, React will always consider them unequal values and force the component to re-render more often than necessary.jsx-no-multiline-js
jsx-no-string-ref
ref
prop of React elements is considered a legacy feature and will soon be deprecated.
Instead, use a callback.jsx-use-translation-function
(since v2.4.0)
["allow-punctuation", "allow-htmlentities"]
jsx-self-close
(since v0.4.0)
// bad
<div className="foo"></div>
// good
<div className="foo" />
jsx-space-before-trailing-slash
jsx-wrap-multiline
(since v2.1)
// bad
const button = <button type="submit">
Submit
</button>;
// good
const button = (
<button type="submit">
Submit
</button>
);
We track rule suggestions on Github issues -- here's a useful link to view all the current suggestions. Tickets are roughly triaged by priority (P1, P2, P3).
We're happy to accept PRs for new rules, especially those marked as Status: Accepting PRs. If submitting a PR, try to follow the same style conventions as the core TSLint project.
Quick Start (requires Node v6+, yarn v0.22+):
yarn
yarn verify
yarn lint
See the Github release history.
FAQs
Lint rules related to React & JSX for TSLint
We found that tslint-react demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.