New
Introducing React Bench, see how different models perform on React code
Menu
What Is React Doctor?
Quickstart
Install for Coding Agents
How to Fix Issues
GitHub Actions Setup
Updating CI
Other CI Providers
Migrating to CI v2
Config Files
ESLint & oxlint Plugins
Add Custom Rules
CLI Reference
GitHub Action Reference
Node.js API
Changelog
Modified MIT License
Terms of Service
Privacy Policy
Data Use
Security
Support
Rules reference

react-doctor/tenant-static-proxy-risk

Building an asset path from a client-supplied tenant, subdomain, or workspace value lets one tenant read another tenant's files.

  • Category: Security
  • Severity: warn
  • Source: oxlint-plugin-react-doctor
  • Framework: global
  • Enabled when: server route source files only — server-context dirs (api/backend/server/functions/lambdas/workers, *.server.*) plus middleware.* and route.* entrypoints
  • Tags: security-scan
  • Default: Enabled

Validation prompt

Use this to decide whether a fired diagnostic is real or a false positive.

Fires in server route code when an asset-fetch call — fetch(, path.join(, getObject*(, GetObjectCommand(, getSignedUrl(, or createReadStream( — has, within its own argument list (~200 chars), a tenant identifier composed into the path: a ${…} interpolation referencing tenant/subdomain/workspace/hostPattern/organizationId|Slug, or a bare tenant|subdomain|workspace(Id|Slug|Name)? token used as a path segment. The tenant token must sit inside the call's arguments (a nearby .org domain literal is excluded, and a bare params/fetch pairing alone does not match). FALSE POSITIVE: the tenant value is already bound to the authenticated org or trusted host and only namespaces the path (not attacker-chosen), or the call targets a fixed bucket where the segment is canonicalized and traversal-checked — confirm the tenant cannot point at another tenant's prefix.

Fix prompt

Use this once validation confirms the diagnostic is real.

Derive the tenant and asset prefix from the authenticated session or the trusted host, never from a client-supplied subdomain or route param. After decoding, canonicalize the path and reject .., absolute, and scheme-bearing segments before reading, and confine object-store access to the caller's own prefix. For fetch, allowlist the destination host so a tenant value cannot redirect the request off-bucket or to an internal address.

More Security rules from the rules reference:

  • react-doctor/unsafe-json-in-html: Unescaped JSON in HTML or script sink
  • react-doctor/untrusted-redirect-following: Following a redirect from a request-supplied URL without re-validating each hop lets an attacker bounce your server into internal addresses (server-side request forgery).
  • react-doctor/url-prefilled-privileged-action: Reading a privileged action from the URL (invite, role, permission, redirect, sharing) and acting on it lets an attacker craft a link that performs that action for a victim.
  • react-doctor/webhook-signature-risk: An inbound webhook handler that acts on the request body without verifying the provider's signature will process forged requests from anyone.
  • socket/low-supply-chain-score: A direct dependency's worst Socket security axis (supply chain or vulnerability) scores below the configured minimum — bump it to a patched/healthier release, replace it, or vet it and raise `supplyChain.minScore`