New
Introducing React Bench, see how different models perform on React code
Menu
What Is React Doctor?
Quickstart
Install for Coding Agents
How to Fix Issues
GitHub Actions Setup
Updating CI
Other CI Providers
Migrating to CI v2
Config Files
ESLint & oxlint Plugins
Add Custom Rules
CLI Reference
GitHub Action Reference
Node.js API
Changelog
Modified MIT License
Terms of Service
Privacy Policy
Data Use
Security
Support
Rules reference

react-doctor/active-static-asset

A browser-reachable SVG that contains a `<script>` tag or `on*` event handler runs that code in your origin when someone opens it, which can lead to cross-site scripting.

  • Category: Security
  • Severity: warn
  • Source: oxlint-plugin-react-doctor
  • Framework: global
  • Enabled when: browser-reachable `.svg` assets (public/, dist/assets, .next/static, out/, generated bundles, .map) for the executable-SVG branch; production source (.js/.ts/.tsx) and config/CI files (next.config, vercel.json, Dockerfile, workflow YAML, netlify.toml) for the config/embed branch; server build output (.next/server, .output/server) skipped
  • Tags: security-scan
  • Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Two detection branches. (1) For a .svg file that is browser-reachable (under public/, dist/assets/, .next/static/, out/, a generated bundle, or a .map), it fires when the SVG body contains a <script tag or an inline on{load,error,click,mouseover}= event handler — an executable SVG that runs script when opened same-origin (escalated to an error-level finding). (2) For production source (.js/.ts/.tsx) or config/CI files, it fires on the literal dangerouslyAllowSVG: true or an <object|embed|iframe> whose data/src points at a .svg file. FALSE POSITIVE to suppress: a first-party, fully-trusted SVG you author whose script/handlers are intentional and never mixed with user-uploaded SVGs, or a dangerouslyAllowSVG: true config where every served SVG is sanitized/first-party and the response already sets an attachment disposition and a script-blocking CSP.

Fix prompt

Use this once validation confirms the diagnostic is real.

Serve SVGs as inert images: reference them with <img src=...> instead of <object>, <embed>, or <iframe>, so embedded scripts and handlers never run. If you must serve raw SVG, sanitize it first (for example DOMPurify with the SVG profile) to strip <script> and on* handlers, deliver it from a cookieless origin with Content-Disposition: attachment, and set a Content-Security-Policy that blocks script-src and object-src. Avoid dangerouslyAllowSVG: true in Next image config unless every SVG is first-party and sanitized.

More Security rules from the rules reference:

  • react-doctor/agent-tool-capability-risk: An AI agent tool that can reach shell, filesystem, or network primitives lets prompt-injected input trigger those actions, because the model treats tool arguments as trusted.
  • react-doctor/artifact-baas-authority-surface: Shipping Firebase/Supabase client config with your collection and authorization-field names in a browser bundle hands attackers a map of your data model, which is dangerous when server-side rules do not enforce access.
  • react-doctor/artifact-env-leak: A real secret shipped in a browser bundle under a public env prefix (`NEXT_PUBLIC_`, `VITE_`, `REACT_APP_`, `EXPO_PUBLIC_`) is world-readable and must be treated as compromised.
  • react-doctor/artifact-secret-leak: A live credential (API key, token, or connection string) sits in a browser bundle or static asset, so anyone can read it, and it must be treated as compromised.
  • react-doctor/auth-token-in-web-storage: Auth token in web storage