Products
In-IDE
IDE extension that lets you fix coding issues before they exist!
Discover SonarLint
SaaS
Setup is effortless and analysis is automatic for most languages
Discover SonarCloud
Self-Hosted
Fast, accurate analysis; enterprise scalability
Discover SonarQube

Secrets
ABAP
Apex
AzureResourceManager
C
C++
CloudFormation
COBOL
C#
CSS
Docker
Flex
Go
HTML
Java
JavaScript
Kotlin
Kubernetes
Objective C
PHP
PL/I
PL/SQL
Python
RPG
Ruby
Scala
Swift
Terraform
Text
TypeScript
T-SQL
VB.NET
VB6
XML

TypeScript static code analysis

Unique rules to find Bugs, Vulnerabilities, Security Hotspots, and Code Smells in your TYPESCRIPT code

Tags

DOM updates should not lead to open redirect vulnerabilities
Vulnerability
Extracting archives should not lead to zip slip vulnerabilities
Vulnerability
DOM updates should not lead to cross-site scripting (XSS) attacks
Vulnerability
Dynamic code execution should not be vulnerable to injection attacks
Vulnerability
NoSQL operations should not be vulnerable to injection attacks
Vulnerability
HTTP request redirections should not be open to forging attacks
Vulnerability
Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
Vulnerability
Database queries should not be vulnerable to injection attacks
Vulnerability
XML parsers should not be vulnerable to XXE attacks
Vulnerability
I/O function calls should not be vulnerable to path injection attacks
Vulnerability
OS commands should not be vulnerable to command injection attacks
Vulnerability
Creating public APIs is security-sensitive
Security Hotspot
Allowing public network access to cloud resources is security-sensitive
Security Hotspot
Policies granting all privileges are security-sensitive
Security Hotspot
Disabling Vue.js built-in escaping is security-sensitive
Security Hotspot
Policies authorizing public access to resources are security-sensitive
Security Hotspot
Disabling Angular built-in sanitization is security-sensitive
Security Hotspot
Granting access to S3 buckets to all or authenticated users is security-sensitive
Security Hotspot
Hard-coded credentials are security-sensitive
Security Hotspot
Function returns should not be invariant
Code Smell
Assertions should be complete
Code Smell
Tests should include assertions
Code Smell
Octal values should not be used
Code Smell
Switch cases should end with an unconditional "break" statement
Code Smell
"switch" statements should not contain non-case labels
Code Smell
AWS IAM policies should limit the scope of permissions given
Vulnerability
A new session should be created during user authentication
Vulnerability
JWT should be signed and verified with strong cipher algorithms
Vulnerability
Cipher algorithms should be robust
Vulnerability
Encryption algorithms should be used with secure mode and padding scheme
Vulnerability
Server hostnames should be verified during SSL/TLS connections
Vulnerability
Server certificates should be verified during SSL/TLS connections
Vulnerability
Cryptographic keys should be robust
Vulnerability
Weak SSL/TLS protocols should not be used
Vulnerability
Origins should be verified during cross-origin communications
Vulnerability
Regular expressions should not be vulnerable to Denial of Service attacks
Vulnerability
File uploads should be restricted
Vulnerability
Regular expressions should be syntactically valid
Bug
Type intersections should use meaningful types
Bug
Getters and setters should access the expected fields
Bug
"super()" should be invoked appropriately
Bug
Parentheses should be used when negating "in" and "instanceof" operations
Bug
"Array.prototype.sort()" and "Array.prototype.toSorted()" should use a compare function
Bug
Jump statements should not occur in "finally" blocks
Bug
Allowing public ACLs or policies on a S3 bucket is security-sensitive
Security Hotspot
Authorizing HTTP communications with S3 buckets is security-sensitive
Security Hotspot
Using slow regular expressions is security-sensitive
Security Hotspot
Using publicly writable directories is security-sensitive
Security Hotspot
Using clear-text protocols is security-sensitive
Security Hotspot
Expanding archive files without controlling resource consumption is security-sensitive
Security Hotspot
Using weak hashing algorithms is security-sensitive
Security Hotspot
Disabling CSRF protections is security-sensitive
Security Hotspot
Using pseudorandom number generators (PRNGs) is security-sensitive
Security Hotspot
Dynamically executing code is security-sensitive
Security Hotspot
Equality operators should not be used in "for" loop termination conditions
Code Smell
Tests should not execute any code after "done()" is called
Code Smell
Union and intersection types should not include duplicated constituents
Code Smell
"default" clauses should be last
Code Smell
"await" should only be used with promises
Code Smell
Conditionals should start on new lines
Code Smell
Cognitive Complexity of functions should not be too high
Code Smell
"void" should not be used
Code Smell
Variables should be declared with "let" or "const"
Code Smell
Constructor names should start with an upper case letter
Code Smell
Loop counters should not be assigned within the loop body
Code Smell
"for" loop increment clauses should modify the loops' counters
Code Smell
Functions should not be empty
Code Smell
Applications should not create session cookies from untrusted input
Vulnerability
Server-side requests should not be vulnerable to forging attacks
Vulnerability
Non-empty statements should change control flow or have at least one side-effect
Bug
"children" and "dangerouslySetInnerHTML" should not be used together
Bug
"this" should not be used in functional components
Bug
"setState" should use a callback when referencing the previous state
Bug
Binary expressions should not always return the same value
Bug
Promises should not be misused
Bug
Numbers should not lose precision
Bug
Optional chaining should not be used if returning "undefined" throws an error
Bug
React state setter function should not be called with its matching state variable
Bug
React's useState hook should not be used directly in the render function or body of a component
Bug
React Hooks should be properly called
Bug
React components should not render non-boolean condition values
Bug
Comments inside JSX expressions should be enclosed in curly braces
Bug
React "render" functions should return a value
Bug
Exclusive tests should not be commited to version control
Bug
Regular expressions with the global flag should be used with caution
Bug
Replacement strings should reference existing regular expression groups
Bug
Regular expressions should not contain control characters
Bug
Alternation in regular expressions should not contain empty alternatives
Bug
Disabling Mocha timeouts should be explicit
Bug
Unicode Grapheme Clusters should be avoided inside regex character classes
Bug
Assertions should not be given twice the same argument
Bug
Alternatives in regular expressions should be grouped when used with anchors
Bug
Promise rejections should not be caught by 'try' blocks
Bug
Collection elements should not be replaced unconditionally
Bug
Constructors should not be declared inside interfaces
Bug
Errors should not be created without being thrown
Bug
Collection size and array length comparisons should make sense
Bug
All branches in a conditional structure should not have exactly the same implementation
Bug
Destructuring patterns should not be empty
Bug
The return value of void functions should not be used
Bug
Comma and logical OR operators should not be used in switch cases
Bug
Generators should explicitly "yield" a value
Bug
"new" should only be used with functions and classes
Bug
Non-existent operators '=+', '=-' and '=!' should not be used
Bug
"NaN" should not be used in comparisons
Bug
Empty character classes should not be used
Bug
A "for" loop update clause should move the counter in the right direction
Bug
Return values from functions without side effects should not be ignored
Bug
Special identifiers should not be bound or assigned
Bug
Values should not be uselessly incremented
Bug
"if/else if" chains and "switch" cases should not have the same condition
Bug
Objects should not be created to be dropped immediately without being used
Bug
Identical expressions should not be used on both sides of a binary operator
Bug
All code should be reachable
Bug
Loops with at most one iteration should be refactored
Bug
Variables should not be self-assigned
Bug
Member names should not be duplicated within a class or object literal
Bug
Bitwise operators should not be used in boolean contexts
Bug
Constructing arguments of system commands from user input is security-sensitive
Security Hotspot
Using unencrypted EFS file systems is security-sensitive
Security Hotspot
Using unencrypted SQS queues is security-sensitive
Security Hotspot
Using unencrypted SNS topics is security-sensitive
Security Hotspot
Using unencrypted SageMaker notebook instances is security-sensitive
Security Hotspot
Using unencrypted Elasticsearch domains is security-sensitive
Security Hotspot
Using unencrypted RDS DB resources is security-sensitive
Security Hotspot
Using unencrypted EBS volumes is security-sensitive
Security Hotspot
Allowing requests with excessive content length is security-sensitive
Security Hotspot
Statically serving hidden files is security-sensitive
Security Hotspot
Using intrusive permissions is security-sensitive
Security Hotspot
Disabling auto-escaping in template engines is security-sensitive
Security Hotspot
Using shell interpreter when executing OS commands is security-sensitive
Security Hotspot
Setting loose POSIX file permissions is security-sensitive
Security Hotspot
Formatting SQL queries is security-sensitive
Security Hotspot
Comma operator should not be used
Code Smell
Focusable elements should not have "aria-hidden" attribute
Code Smell
No ARIA role or property for unsupported DOM elements
Code Smell
No redundant ARIA role
Code Smell
DOM elements with ARIA roles should have a valid non-abstract role
Code Smell
Prefer tag over ARIA role
Code Smell
DOM elements with ARIA role should only have supported properties
Code Smell
DOM elements with ARIA roles should have the required properties
Code Smell
ARIA properties in DOM elements should have valid values
Code Smell
All "defaultProps" should have non-required PropTypes
Code Smell
Spacing between inline elements should be explicit
Code Smell
User-defined JSX components should use Pascal case
Code Smell
Unused React typed props should be removed
Code Smell
JSX special characters should be escaped
Code Smell
"shouldComponentUpdate" should not be defined when extending "React.PureComponent"
Code Smell
React props should be read-only
Code Smell
The return value of "useState" should be destructured and named symmetrically
Code Smell
The return value of "ReactDOM.render" should not be used
Code Smell
Redundant React fragments should be removed
Code Smell
React "children" should not be passed as prop
Code Smell
JSX elements should not use unknown properties and attributes
Code Smell
In React "this.state" should not be mutated directly
Code Smell
If statements should not be the only statement in else blocks
Code Smell
Octal escape sequences should not be used
Code Smell
Prototypes of builtin objects should not be modified
Code Smell
"as const" assertions should be preferred
Code Smell
Enum members should not mix value types
Code Smell
Optional chaining should be preferred
Code Smell
Enum values should be unique
Code Smell
Enum member values should be either all initialized or none
Code Smell
Unnecessary type constraints should be removed
Code Smell
Redundant type aliases should not be used
Code Smell
Ends of strings should be checked with "startsWith()" and "endsWith()"
Code Smell
All enum members should be literals
Code Smell
Unnecessary character escapes should be removed
Code Smell
Import variables should not be reassigned
Code Smell
JSX list components keys should match up between renders
Code Smell
React Context Provider values should have stable identities
Code Smell
JSX list components should not use array indexes as key
Code Smell
React components should not be nested
Code Smell
JSX list components should have a key property
Code Smell
Unused methods of React components should be removed
Code Smell
Character classes in regular expressions should not contain only one character
Code Smell
Regular expressions should not contain empty groups
Code Smell
Regular expressions should not contain multiple spaces
Code Smell
Chai assertions should have only one reason to succeed
Code Smell
Single-character alternations in regular expressions should be replaced with character classes
Code Smell
Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string
Code Smell
Tests should check which exception is thrown
Code Smell
Character classes in regular expressions should not contain the same character twice
Code Smell
Names of regular expressions named groups should be used
Code Smell
Regular expressions should not be too complicated
Code Smell
Optional property declarations should not use both '?' and 'undefined' syntax
Code Smell
Shorthand promises should be used
Code Smell
Template literals should not be nested
Code Smell
"undefined" should not be passed as the value of optional parameters
Code Smell
"in" should not be used on arrays
Code Smell
Assignments should not be redundant
Code Smell
Functions should not have identical implementations
Code Smell
Sparse arrays should not be created with extra commas
Code Smell
Array-mutating methods should not be used misleadingly
Code Smell
Collection contents should be used
Code Smell
Literals should not be thrown
Code Smell
Array indexes should be numeric
Code Smell
Assertion arguments should be passed in the correct order
Code Smell
Ternary operators should not be nested
Code Smell
"delete" should not be used on arrays
Code Smell
"indexOf" checks should not be for positive numbers
Code Smell
"arguments.caller" and "arguments.callee" should not be used
Code Smell
Multiline blocks should be enclosed in curly braces
Code Smell
Boolean expressions should not be gratuitous
Code Smell
Variables should be used in the blocks where they are declared
Code Smell
Parameters should be passed in the correct order
Code Smell
Two branches in a conditional structure should not have exactly the same implementation
Code Smell
Unused assignments should be removed
Code Smell
Function parameters with default values should be last
Code Smell
Functions should not be defined inside loops
Code Smell
"switch" statements should not have too many "case" clauses
Code Smell
Only "while", "do", "for" and "switch" statements should be labelled
Code Smell
Sections of code should not be commented out
Code Smell
Track uses of "FIXME" tags
Code Smell
Assignments should not be made from within sub-expressions
Code Smell
Labels should not be used
Code Smell
Nested blocks of code should not be left empty
Code Smell
Functions should not have too many parameters
Code Smell
Unused private class members should be removed
Code Smell
Administration services access should be restricted to specific IP addresses
Vulnerability
OS commands should not be vulnerable to argument injection attacks
Vulnerability
Repeated patterns in regular expressions should not match the empty string
Bug
Empty collections should not be accessed or iterated
Bug
"delete" should be used only with object properties
Bug
Initial values of parameters, caught exceptions, and loop variables should not be ignored
Bug
Mouse events should have corresponding keyboard events
Bug
Disabling versioning of S3 buckets is security-sensitive
Security Hotspot
Disabling server-side encryption of S3 buckets is security-sensitive
Security Hotspot
Forwarding client IP address is security-sensitive
Security Hotspot
Allowing confidential information to be logged is security-sensitive
Security Hotspot
Allowing browsers to perform DNS prefetching is security-sensitive
Security Hotspot
Disabling Certificate Transparency monitoring is security-sensitive
Security Hotspot
Disabling Strict-Transport-Security policy is security-sensitive
Security Hotspot
Disabling strict HTTP no-referrer policy is security-sensitive
Security Hotspot
Allowing browsers to sniff MIME types is security-sensitive
Security Hotspot
Disabling content security policy frame-ancestors directive is security-sensitive
Security Hotspot
Allowing mixed-content is security-sensitive
Security Hotspot
Disabling content security policy fetch directives is security-sensitive
Security Hotspot
Using remote artifacts without integrity checks is security-sensitive
Security Hotspot
Disclosing fingerprints from web application technologies is security-sensitive
Security Hotspot
Authorizing an opened window to access back to the originating window is security-sensitive
Security Hotspot
Having a permissive Cross-Origin Resource Sharing policy is security-sensitive
Security Hotspot
Delivering code in production with debug features activated is security-sensitive
Security Hotspot
Searching OS commands in PATH is security-sensitive
Security Hotspot
Creating cookies without the "HttpOnly" flag is security-sensitive
Security Hotspot
Creating cookies without the "secure" flag is security-sensitive
Security Hotspot
Using hardcoded IP addresses is security-sensitive
Security Hotspot
Anchors should contain accessible content
Code Smell
DOM elements with the `aria-activedescendant` property should be accessible via the tab key
Code Smell
"Number.isNaN()" should be used to check for "NaN" value
Code Smell
Calls to ".call()" and ".apply()" methods should not be redundant
Code Smell
Literals should not be used for promise rejection
Code Smell
Spread syntax should be used instead of "apply()"
Code Smell
Object spread syntax should be used instead of "Object.assign"
Code Smell
__proto__ property should not be used
Code Smell
Use Object.hasOwn static method instead of hasOwnProperty
Code Smell
Renaming import, export, and destructuring assignments should not be to the same name
Code Smell
Unnecessary constructors should be removed
Code Smell
Ternary operator should not be used instead of simpler alternatives
Code Smell
Unnecessary calls to ".bind()" should not be used
Code Smell
Constructors should not return values
Code Smell
Nullish coalescing should be preferred
Code Smell
Function types should be preferred
Code Smell
"RegExp.exec()" should be preferred over "String.match()"
Code Smell
Type constituents of unions and intersections should not be redundant
Code Smell
Non-null assertions should not be used misleadingly
Code Smell
Prefer the return type "this" in fluent interfaces
Code Smell
Objects and classes converted or coerced to strings should define a "toString()" method
Code Smell
Extra boolean casts should be removed
Code Smell
Regular expression quantifiers and character classes should be used concisely
Code Smell
Regular expression literals should be used when possible
Code Smell
Redundant casts and non-null assertions should be avoided
Code Smell
Type aliases should be used
Code Smell
Type predicates should be used
Code Smell
"module" should not be used
Code Smell
"for of" should be used with Iterables
Code Smell
Imports from the same module should be merged
Code Smell
Jump statements should not be redundant
Code Smell
The global "this" object should not be used
Code Smell
"catch" clauses should do more than rethrow
Code Smell
Exceptions should not be ignored
Code Smell
Classes should not be empty
Code Smell
Boolean checks should not be inverted
Code Smell
Deprecated APIs should not be used
Code Smell
Wrapper objects should not be used for primitive types
Code Smell
Multiline string literals should not be used
Code Smell
Function call arguments should not start on new lines
Code Smell
"switch" statements should have at least 3 "case" clauses
Code Smell
A "while" loop should be used instead of a "for" loop
Code Smell
Nested code blocks should not be used
Code Smell
Unnecessary imports should be removed
Code Smell
Boolean literals should not be used in comparisons
Code Smell
Class names should comply with a naming convention
Code Smell
Track uses of "TODO" tags
Code Smell
Web SQL databases should not be used
Vulnerability
Policies granting access to all resources of an account are security-sensitive
Security Hotspot
Variables declared with "var" should be declared before they are used
Code Smell
Track lack of copyright and license headers
Code Smell
Reading the Standard Input is security-sensitive
Security Hotspot
Using command line arguments is security-sensitive
Security Hotspot
Using Sockets is security-sensitive
Security Hotspot
Executing XPath expressions is security-sensitive
Security Hotspot
Encrypting data is security-sensitive
Security Hotspot
Using regular expressions is security-sensitive
Security Hotspot
A conditionally executed single line should be denoted by indentation
Code Smell
Class methods should be used instead of "prototype" assignments
Code Smell
Unchanged variables should be marked as "const"
Code Smell
Wildcard imports should not be used
Code Smell
"switch" statements should not be nested
Code Smell
Cyclomatic Complexity of functions should not be too high
Code Smell
"strict" mode should be used with caution
Code Smell
Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply
Code Smell
"switch" statements should have "default" clauses
Code Smell
"if ... else if" constructs should end with "else" clauses
Code Smell
Control structures should use curly braces
Code Smell
String literals should not be duplicated
Code Smell
Expressions should not be too complex
Code Smell
Template literal placeholder syntax should not be used in regular strings
Bug
Built-in objects should not be overridden
Bug
"for...in" loops should filter properties before acting on them
Bug
Results of operations on strings should not be ignored
Bug
Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression
Code Smell
Disallow `.bind()` and arrow functions in JSX props
Code Smell
Optional boolean parameters should have default value
Code Smell
Union types should not have too many elements
Code Smell
Dependencies should be explicit
Code Smell
"this" should not be assigned to variables
Code Smell
The "any" type should not be used
Code Smell
"for in" should not be used with iterables
Code Smell
Functions should use "return" consistently
Code Smell
"arguments" should not be accessed directly
Code Smell
Comparison operators should not be used with strings
Code Smell
Fields that are only assigned in the constructor should be "readonly"
Code Smell
Property getters and setters should come in pairs
Code Smell
JavaScript parser failure
Code Smell
The ternary operator should not be used
Code Smell
"===" and "!==" should be used instead of "==" and "!="
Code Smell
Functions should not have too many lines of code
Code Smell
Track comments matching a regular expression
Code Smell
Statements should be on separate lines
Code Smell
Unused function parameters should be removed
Code Smell
Variables should not be shadowed
Code Smell
Redundant pairs of parentheses should be removed
Code Smell
Magic numbers should not be used
Code Smell
Mergeable "if" statements should be combined
Code Smell
Standard outputs should not be used directly to log anything
Code Smell
Files should not have too many lines of code
Code Smell
Lines should not be too long
Code Smell
Debugger statements should not be used
Vulnerability
Regular expressions using Unicode character classes or property escapes should enable the unicode flag
Bug
The base should be provided to "parseInt"
Bug
Function declarations should not be made within blocks
Bug
Writing cookies is security-sensitive
Security Hotspot
"continue" should not be used
Code Smell
"await" should not be used redundantly
Code Smell
Primitive return types should be used
Code Smell
Default type parameters should be omitted
Code Smell
Type assertions should use "as"
Code Smell
Method overloads should be grouped together
Code Smell
Interfaces should not be empty
Code Smell
Trailing commas should be used
Code Smell
"import" should be used to include external code
Code Smell
Braces and parentheses should be used consistently with arrow functions
Code Smell
Destructuring syntax should be used for assignments
Code Smell
Template strings should be used instead of concatenation
Code Smell
Shorthand object properties should be grouped at the beginning or end of an object declaration
Code Smell
Object literal shorthand syntax should be used
Code Smell
Strings and non-strings should not be added
Code Smell
Default export names and file names should match
Code Smell
Primitive types should be omitted from initialized or defaulted declarations
Code Smell
Non-null assertions should not be used
Code Smell
"undefined" should not be assigned
Code Smell
Trailing commas should not be used
Code Smell
Array constructors should not be used
Code Smell
Local variables should not be declared and then immediately returned or thrown
Code Smell
Quotes for string literals should be used consistently
Code Smell
Statements should end with semicolons
Code Smell
Comments should not be located at the end of lines of code
Code Smell
Loops should not contain more than a single "break" or "continue" statement
Code Smell
Variable, property and parameter names should comply with a naming convention
Code Smell
Lines should not end with trailing whitespaces
Code Smell
Files should contain an empty newline at the end
Code Smell
Extra semicolons should be removed
Code Smell
An open curly brace should be located at the end of a line
Code Smell
Tabulation characters should not be used
Code Smell
Function and method names should comply with a naming convention
Code Smell

ARIA properties in DOM elements should have valid values

Code Smell

MajorSonarSource default severity
click to learn more

react
accessibility

Why is this an issue?

ARIA (Accessible Rich Internet Applications) attributes are used to enhance the accessibility of web content and web applications. These attributes provide additional information about an element’s role, state, properties, and values to assistive technologies like screen readers.

This rule checks that the values of ARIA attributes "aria-*" in DOM elements are valid.

How to fix it in JSX

Check that each element with a defined ARIA attribute has a valid value.

<span aria-hidden="ok">foo</span>

To fix the code use a valid value for the aria-* attribute.

<span aria-hidden="true">foo</span>

Resources

Documentation

MDN web docs - Using ARIA: Roles, states, and properties
MDN web docs - ARIA states and properties (Reference)

Standards

W3C - Accessible Rich Internet Applications (WAI-ARIA) 1.2

Available In:

Catch issues on the fly,
in your IDE

Detect issues in your GitHub, Azure DevOps Services, Bitbucket Cloud, GitLab repositories

Developer
Edition

© 2008-2023 SonarSource S.A., Switzerland. All content is copyright protected. SONAR, SONARSOURCE, SONARLINT, SONARQUBE, and SONARCLOUD are trademarks of SonarSource S.A. All other trademarks and copyrights are the property of their respective owners. All rights are expressly reserved.
Privacy Policy | Cookie Policy

In-IDE

SaaS

Self-Hosted