New
Introducing React Bench, see how different models perform on React code
Menu
What Is React Doctor?
Quickstart
Install for Coding Agents
How to Fix Issues
GitHub Actions Setup
Updating CI
Other CI Providers
Migrating to CI v2
Config Files
ESLint & oxlint Plugins
Add Custom Rules
CLI Reference
GitHub Action Reference
Node.js API
Changelog
Modified MIT License
Terms of Service
Privacy Policy
Data Use
Security
Support
Rules reference

react-doctor/plugin-update-trust-risk

Downloading and running an update or plugin without verifying its integrity lets an attacker ship malicious code to your users.

  • Category: Security
  • Severity: warn
  • Source: oxlint-plugin-react-doctor
  • Framework: global
  • Enabled when: production source files plus config/CI files (package.json, Dockerfile, docker-compose.yml, .github/workflows/*.yml, vercel.json, next.config.*, netlify.toml); test/doc/generated source skipped
  • Tags: security-scan
  • Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires when an updater-shaped trigger (repoUrl/updateUrl/UpdateApp/InstallApp/auto-updater/installer/curl/wget, but not curl -T/--upload-file) is followed within ~250 chars by a concrete executable artifact (.zip/.exe/.dmg/.appimage/.msi/.deb/.rpm/.tar.gz) or a pipe-to-shell (| bash/| sh); for .js/.ts source files it additionally requires a real execution surface (child_process/execa/os.system/subprocess/Deno.run/autoUpdater/electron-updater, or an exec/spawn call). Comments are stripped first. FALSE POSITIVE: the download already verifies a hash/signature before use (sha256sum, --checksum, EXPECTED_SHA, gpg --verify, a .sha256 file), which suppresses the finding, or a docs/snippet component merely DISPLAYS an install command with no execution surface (skipped for source files).

Fix prompt

Use this once validation confirms the diagnostic is real.

Verify integrity before running any downloaded update or plugin: check a pinned SHA-256 (or gpg --verify a signature) and abort on mismatch. Pin the update or repository URL to a trusted host (no user-supplied repoUrl), serve it over HTTPS, and never pipe a download straight into a shell (curl … | sh). Keep custom-repository or third-party plugin installs behind an explicit user confirmation.

More Security rules from the rules reference:

  • react-doctor/postmessage-origin-risk: Reading `event.data` in a `message` handler without checking `event.origin` lets any other window send data your code trusts, which can lead to cross-site scripting or data theft.
  • react-doctor/public-debug-artifact: A browser-reachable debug, log, dump, or report file in your build output can expose source paths, internal routes, env data, or secrets.
  • react-doctor/public-env-secret-name: A public-prefixed env var whose name implies a secret (token, password, private key, service role) is inlined into the client bundle, so a real credential there is world-readable.
  • react-doctor/raw-sql-injection-risk: Building a SQL query by string concatenation or an unsafe raw helper lets an attacker inject SQL and read or modify your database.
  • react-doctor/repository-secret-file: A committed env file, credential, or token is exposed to anyone with repo access and must be rotated, even after you remove it.