New
Introducing React Bench, see how different models perform on React code
Menu
What Is React Doctor?
Quickstart
Install for Coding Agents
How to Fix Issues
GitHub Actions Setup
Updating CI
Other CI Providers
Migrating to CI v2
Config Files
ESLint & oxlint Plugins
Add Custom Rules
CLI Reference
GitHub Action Reference
Node.js API
Changelog
Modified MIT License
Terms of Service
Privacy Policy
Data Use
Security
Support
Rules reference

react-doctor/clickjacking-redirect-risk

A redirect target taken from caller input, or a privileged page that allows untrusted framing, lets attackers send users to malicious sites or trick them through clickjacking.

  • Category: Security
  • Severity: warn
  • Source: oxlint-plugin-react-doctor
  • Framework: global
  • Enabled when: production source files (.js/.ts/.tsx) or config/CI files; tests/build/docs/generated paths skipped
  • Tags: security-scan
  • Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires in production source or config/CI files on four shapes: (1) a redirect(...) call whose argument is attacker-controllable caller input — a bare identifier/property referencing searchParams.get/nextUrl.searchParams/returnTo/callbackUrl/continue/next (open redirect); (2) an <iframe> whose markup within ~700 chars carries redirect/URL-param shapes like next=/continue=/redirect=/redirect_uri/role=/..; (3) a frame-ancestors * (or 'self' *) CSP; or (4) an X-Frame-Options: ALLOW… header. Comments are stripped first. FALSE POSITIVE to suppress: already exempted — a redirect keyword that appears only inside a string literal (e.g. redirect('/login?...continue...')) and a target already passed through a safe*/valid*/sanitiz*/allowlist/whitelist helper are skipped; a remaining FP is a next/returnTo value already validated against a same-origin or path allowlist before this redirect().

Fix prompt

Use this once validation confirms the diagnostic is real.

For redirects, validate the target against a strict allowlist of paths or origins (or force it relative: reject anything not starting with a single /, and reject //) before calling redirect(), ideally through one shared getSafeRedirectUrl() helper. For framing, set Content-Security-Policy: frame-ancestors 'self' (or specific trusted origins) on privileged pages and avoid X-Frame-Options: ALLOW…. Do not embed privileged flows in URL-driven <iframe>s or URL-prefilled dialogs.

More Security rules from the rules reference:

  • react-doctor/command-execution-input-risk: Passing caller-controlled input into a shell command lets an attacker run arbitrary commands on your server (remote code execution).
  • react-doctor/cors-cookie-trust-risk: Combining credentialed CORS with a wildcard or less-trusted origin, or scoping auth cookies to a parent domain, lets other sites or subdomains ride a user's session.
  • react-doctor/dangerous-html-sink: Passing user- or request-derived data into an HTML sink like `dangerouslySetInnerHTML` or `innerHTML` without sanitizing it allows cross-site scripting.
  • react-doctor/firebase-client-owned-authz-field: When the client writes ownership or role fields (`ownerId`, `orgId`, `role`, `isAdmin`) to Firebase/Supabase, an attacker can forge them and grant themselves access.
  • react-doctor/firebase-permissive-rules: A Firebase rule of `if true` or `if request.auth != null` leaves data open to everyone (or to every signed-in user), treating sign-in as authorization and exposing other users' data.