react-doctor/no-danger-with-children

Use either children or dangerouslySetInnerHTML on an element, never both.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires when one element or createElement call has BOTH dangerouslySetInnerHTML and children: children being nested JSX content, a children prop, or positional createElement args: since React throws a runtime warning and the innerHTML wins, silently dropping the children. The check resolves spread props and createElement prop objects (including a variable's static initializer) to see merged dangerouslySetInnerHTML/children. Whitespace-only JSXText containing a newline is treated as auto-format indentation and does NOT count as a child, but a space-only child with no newline (<Hello> </Hello>) DOES fire. Limitation (under-reports): a spread or props object whose source cannot be statically resolved: e.g. a variable lacking an initializer, a self-referential or already-visited symbol, or any non-object expression: is treated as empty, so a real conflict hidden behind that spread is silently missed rather than reported.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

Pick one rendering path. If the markup is the real content, drop dangerouslySetInnerHTML and render the children normally: <div>{content}</div>. If you genuinely need raw HTML, remove the children/children prop so only the danger prop remains: <div dangerouslySetInnerHTML={{ __html: sanitized }} />. For createElement, pass the conflicting value either as the children argument or inside props: never both. See https://oxc.rs/docs/guide/usage/linter/rules/react/no-danger-with-children

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.