eslint-plugin-sonarjs [](https://badge.fury.io/js/eslint-plugin-sonarjs)

eslint-plugin-sonarjs is an ESLint plugin maintained by Sonar, designed to help developers write Clean Code. This plugin exposes to ESLint users all original JS/TS rules from SonarJS, an analyzer for JavaScript and TypeScript within the Sonar ecosystem. This plugin offers general-purpose rules for detecting code smells and bugs, as well as rules for other aspects of code quality, including testing, accessibility, and more. Additionally, it enhances code security by providing rules to report potential security vulnerabilities.

This ESLint plugin does not contain all the rules from the SonarQube JS/TS analyzer. Aside of the rules available here, SonarQube uses rules from other ESLint plugins (some used as they are, some others have been modified). We recommend installing those ESLint plugins and enabling those rules if you are looking for similar results to SonarQube using ESLint.

If you are a SonarQube Server or a SonarQube Cloud user, to lint your code locally, we suggest using the SonarQube for IDE extension (available for VSCode, JetBrains IDEs and Eclipse). You can connect SonarQube for IDE to your Server or Cloud project to synchronize rules configuration, issue statuses, etc.

Table of Contents

• Prerequisites
• Installation
• Usage
• SonarQube for IDE
• Feedback
• Rules
• ESLint rules
• Improved ESLint rules

Changelog

Prerequisites

The prerequisites for using this plugin depend on the ESLint version you are using:

• For ESLint 8, you need Node.js version >= 18.
• For ESLint 9, you need Node.js version that complies with (^18.18.0 || ^20.9.0 || >=21).

Installation

First, ensure that your project is configured with ESLint. If it is not, please follow the ESLint instructions to set it up.

To install eslint-plugin-sonarjs, use the following npm command (or yarn equivalent):

npm install eslint-plugin-sonarjs --save-dev # locally
npm install eslint-plugin-sonarjs -g         # globally

Usage

The usage of eslint-plugin-sonarjs depends on the ESLint version used by your project.

For ESLint 9

This plugin provides a single configuration named recommended. This configuration enables most of the rules except for a few exceptions, and the rules are enabled with the error severity. You can enable the recommended configuration in your eslint.config.js file:

import sonarjs from 'eslint-plugin-sonarjs';

export default [sonarjs.configs.recommended];

If you don't use the recommended configuration, you need to declare the plugin manually in the plugins field. Enable or disable rules using the rules field:

import sonarjs from 'eslint-plugin-sonarjs';
export default [
  {
    plugins: { sonarjs },
    rules: {
      'sonarjs/no-implicit-dependencies': 'error',
    },
  },
];

For ESLint 8

We include a recommended-legacy configuration to be backward compatible with ESLint v8, equivalent to the recommended configuration for ESLint 9.

Add sonarjs to your .eslintrc file:

{
  "plugins": ["sonarjs"],
  "extends": ["plugin:sonarjs/recommended-legacy"]
}

You can enable some rules manually:

{
  "rules": {
    "sonarjs/cognitive-complexity": "error",
    "sonarjs/no-identical-expressions": "error"
  }
}

TypeScript ESLint parser

Several rules are designed for linting both JavaScript and TypeScript code, and some even rely on type checking through TypeScript. Therefore, you will need to install the @typescript-eslint/parser dependency and instruct ESLint to use this parser through the parserOptions property.

SonarQube for IDE

As an alternative to using this ESLint plugin, you can use SonarQube for IDE. SonarQube for IDE is an IDE extension that helps you detect and fix quality issues as you write code. It provides a broader set of rules compared to the ESLint plugin, improved versions of ESLint rules, and additional features that enhance your linting experience.

Feedback

If you have any questions, encounter any bugs, or have feature requests, please reach out to us through the Sonar Community Forum. Your messages will reach the maintainers of this GitHub repository.

Rules

💼 Configurations enabled in.
✅ Set in the recommended configuration.
🔧 Automatically fixable by the --fix CLI option.
💡 Manually fixable by editor suggestions.
💭 Requires type information.
❌ Deprecated.

Name	Description	💼	🔧	💡	💭	❌
anchor-precedence	Alternatives in regular expressions should be grouped when used with anchors	✅			💭
argument-type	Arguments to built-in functions should match documented types	✅			💭
arguments-order	Parameters should be passed in the correct order	✅			💭
arguments-usage	"arguments" should not be accessed directly
array-callback-without-return	Callbacks of array methods should have return statements	✅			💭
array-constructor	Array constructors should not be used			💡
arrow-function-convention	Braces and parentheses should be used consistently with arrow functions
assertions-in-test-cases	Assertions should be placed inside test cases or hooks	✅
assertions-in-tests	Tests should include assertions	✅			💭
async-test-assertions	Async test assertions should be awaited or returned	✅
avoid-mutating-nested-properties-of-shallow-clones	Nested properties of Lodash and Underscore.js clone results should not be mutated	✅		💡
aws-apigateway-public-api	AWS API Gateway should require authentication	✅
aws-ec2-rds-dms-public	Public network access to cloud resources should be disabled	✅
aws-ec2-unencrypted-ebs-volume	EBS volumes should be encrypted	✅
aws-efs-unencrypted	Amazon EFS file systems should be encrypted	✅
aws-iam-all-privileges	Policies should not grant all privileges	✅
aws-iam-all-resources-accessible	IAM policies should not grant access to all account resources
aws-iam-privilege-escalation	AWS IAM policies should limit the scope of permissions given	✅
aws-iam-public-access	AWS resource-based policies should not grant public access	✅
aws-opensearchservice-domain	OpenSearch domains should have encryption at rest enabled	✅
aws-rds-unencrypted-databases	Amazon RDS resources should be encrypted at rest	✅
aws-restricted-ip-admin-access	Administration services access should be restricted to specific IP addresses	✅
aws-s3-bucket-granted-access	S3 buckets should not grant access to all users or authenticated users	✅
aws-s3-bucket-insecure-http	S3 buckets should enforce HTTPS-only access	✅
aws-s3-bucket-public-access	Amazon S3 bucket public access should be fully blocked	✅
aws-s3-bucket-versioning	Amazon S3 buckets should have versioning enabled	✅
aws-sagemaker-unencrypted-notebook	SageMaker notebook instances should be encrypted at rest	✅
aws-sns-unencrypted-topics	Amazon SNS topics should be encrypted at rest	✅
aws-sqs-unencrypted-queue	SQS queues should be encrypted	✅
bitwise-operators	Bitwise operators should not be used in boolean contexts	✅			💭
block-scoped-var	Variables should be used in the blocks where they are declared	✅
bool-param-default	Optional boolean parameters should have default value
call-argument-line	Function call arguments should not start on new lines	✅
chai-determinate-assertion	Chai assertions should have only one reason to succeed	✅
class-name	Class names should comply with a naming convention	✅
class-prototype	Class methods should be used instead of "prototype" assignments				💭
code-eval	Dynamic code execution should not use user-controlled data	✅
cognitive-complexity	Cognitive Complexity of functions should not be too high	✅
comma-or-logical-or-case	Comma and logical OR operators should not be used in switch cases	✅
comment-regex	Track comments matching a regular expression
composite-assertions	Composite assertions should be split
concise-regex	Regular expression quantifiers and character classes should be used concisely	✅			💭
conditional-indentation	A conditionally executed single line should be denoted by indentation					❌
confidential-information-logging	Confidential information should not be logged					❌
constructor-for-side-effects	Objects should not be created to be dropped immediately without being used	✅
content-length	HTTP request content length should be limited	✅
content-security-policy	Content security policy fetch directives should not be disabled	✅
cookie-no-httponly	Cookies should have the "HttpOnly" flag	✅
cors	Cross-Origin Resource Sharing (CORS) policy should be restricted to trusted origins	✅
csrf	CSRF protections should not be disabled	✅
cyclomatic-complexity	Cyclomatic Complexity of functions should not be too high
declarations-in-global-scope	Variables and functions should not be declared in the global scope
deprecation	Deprecated APIs should not be used	✅			💭
destructuring-assignment-syntax	Destructuring syntax should be used for assignments
different-types-comparison	Strict equality operators should not be used with dissimilar types	✅		💡	💭
disabled-auto-escaping	Auto-escaping in HTML template engines should not be disabled	✅			💭
disabled-resource-integrity	Remote artifacts should not be used without integrity checks	✅			💭
disabled-timeout	Disabling Mocha timeouts should be explicit	✅
dompurify-unsafe-config	DOMPurify configuration should not be bypassable	✅			💭
duplicates-in-character-class	Character classes in regular expressions should not contain the same character twice	✅			💭
dynamically-constructed-templates	Templates should not be constructed dynamically	✅
elseif-without-else	"if ... else if" constructs should end with "else" clauses
empty-string-repetition	Repeated patterns in regular expressions should not match the empty string	✅			💭
encryption-secure-mode	Encryption algorithms should be used with secure mode and padding scheme	✅
existing-groups	Replacement strings should reference existing regular expression groups	✅			💭
explicit-test-skip	Tests should be skipped explicitly	✅		💡
expression-complexity	Expressions should not be too complex
file-header	Track lack of copyright and license headers
file-name-differ-from-class	Default export names and file names should match
file-permissions	File permissions should not be set to world-accessible values	✅
file-uploads	File uploads should be restricted	✅
fixme-tag	Track uses of "FIXME" tags	✅
for-in	"for...in" loops should filter properties before acting on them
for-loop-increment-sign	A "for" loop update clause should move the counter in the right direction	✅
frame-ancestors	Content Security Policy frame-ancestors directive should not be disabled					❌
function-inside-loop	Functions should not be defined inside loops	✅
function-name	Function and method names should comply with a naming convention
function-return-type	Functions should always return the same type	✅			💭
future-reserved-words	Future reserved words should not be used as identifiers	✅
generator-without-yield	Generators should explicitly "yield" a value	✅
hardcoded-secret-signatures	Credentials should not be hard-coded	✅
hashing	Weak hashing algorithms should not be used	✅
hidden-files	Hidden files should not be served statically					❌
hooks-before-test-cases	Lifecycle hooks should not be interleaved with test cases or nested suites	✅
in-operator-type-error	"in" should not be used with primitive types	✅			💭
inconsistent-function-call	Functions should be called consistently with or without "new"	✅
index-of-compare-to-positive-number	"indexOf" checks should not be for positive numbers	✅			💭
insecure-cookie	Cookies should have the "secure" flag	✅
insecure-jwt-token	JWT should be signed and verified with strong cipher algorithms	✅
inverted-assertion-arguments	Assertion arguments should be passed in the correct order	✅		💡
jsx-no-leaked-render	React components should not render non-boolean condition values	✅		💡	💭
label-position	Only "while", "do", "for" and "switch" statements should be labelled	✅
link-with-target-blank	Opened windows should not have access to the originating page	✅
max-lines	Files should not have too many lines of code
max-lines-per-function	Functions should not have too many lines of code
max-switch-cases	"switch" statements should not have too many "case" clauses	✅
max-union-size	Union types should not have too many elements
memoize-cache-key	Lodash and Underscore.js memoize calls on functions with multiple parameters should use an explicit cache key function	✅
misplaced-loop-counter	"for" loop increment clauses should modify the loops' counters	✅
nested-control-flow	Control flow statements "if", "for", "while", "switch" and "try" should not be nested too deeply
new-operator-misuse	"new" should only be used with functions and classes	✅			💭
no-all-duplicated-branches	All branches in a conditional structure should not have exactly the same implementation	✅
no-alphabetical-sort	"Array.prototype.sort()" and "Array.prototype.toSorted()" should use a compare function	✅		💡	💭
no-angular-bypass-sanitization	Angular built-in sanitization should not be disabled	✅
no-array-delete	"delete" should not be used on arrays	✅			💭
no-associative-arrays	Array indexes should be numeric	✅			💭
no-async-constructor	Constructors should not contain asynchronous operations	✅			💭
no-built-in-override	Built-in objects should not be overridden
no-case-label-in-switch	"switch" statements should not contain non-case labels	✅
no-clear-text-protocols	Clear-text protocols should not be used	✅
no-code-after-done	Tests should not execute any code after "done()" is called	✅
no-collapsible-if	Mergeable "if" statements should be combined
no-collection-size-mischeck	Collection size and array length comparisons should make sense	✅		💡	💭
no-commented-code	Sections of code should not be commented out			💡
no-control-regex	Regular expressions should not contain control characters	✅			💭
no-dead-store	Unused assignments should be removed	✅
no-debounce-throttle-in-render	Lodash and Underscore.js debounced or throttled functions should not be recreated on every React render	✅
no-debug-commands-in-ui-tests	UI test debug commands should not be committed to version control	✅	🔧
no-default-utility-imports	Default imports from modular utility libraries should not be used	✅
no-delete-var	"delete" should be used only with object properties	✅
no-duplicate-in-composite	Union and intersection types should not include duplicated constituents	✅		💡
no-duplicate-parameterized-test-case	Parameterized tests should not contain duplicate test cases	✅	🔧
no-duplicate-string	String literals should not be duplicated
no-duplicate-test-title	Test titles should be unique within the same suite	✅
no-duplicated-branches	Two branches in a conditional structure should not have exactly the same implementation	✅
no-element-overwrite	Collection elements should not be replaced unconditionally	✅
no-empty-after-reluctant	Reluctant quantifiers in regular expressions should be followed by an expression that can't match the empty string	✅			💭
no-empty-alternatives	Alternation in regular expressions should not contain empty alternatives	✅			💭
no-empty-character-class	Empty character classes should not be used	✅			💭
no-empty-collection	Empty collections should not be accessed or iterated	✅
no-empty-group	Regular expressions should not contain empty groups	✅			💭
no-empty-parameterized-test-dataset	Parameterized tests should not have empty datasets	✅
no-empty-test-file	Test files should contain at least one test case	✅
no-empty-test-title	Test and suite titles should not be empty or whitespace-only	✅
no-equals-in-for-termination	Equality operators should not be used in "for" loop termination conditions	✅
no-exclusive-tests	Exclusive tests should not be committed to version control	✅		💡
no-extra-arguments	Function calls should not pass extra arguments	✅
no-fallthrough	Switch cases should end with an unconditional "break" statement	✅
no-fixed-wait-in-tests	Fixed waits should not be used in tests	✅
no-floating-point-equality	Floating point numbers should not be tested for equality	✅
no-for-in-iterable	"for in" should not be used with iterables				💭
no-forced-browser-interaction	Forced browser interactions should not bypass actionability checks	✅
no-function-declaration-in-block	Function declarations should not be made within blocks
no-global-this	The global "this" object should not be used	✅		💡
no-globals-shadowing	Special identifiers should not be bound or assigned	✅
no-gratuitous-expressions	Boolean expressions should not be gratuitous	✅
no-hardcoded-ip	IP addresses should not be hardcoded	✅
no-hardcoded-passwords	Credentials should not be hard-coded	✅
no-hardcoded-secrets	Secrets should not be hard-coded	✅
no-hook-setter-in-body	React's useState hook should not be used directly in the render function or body of a component	✅
no-identical-conditions	"if/else if" chains and "switch" cases should not have the same condition	✅
no-identical-expressions	Identical expressions should not be used on both sides of a binary operator	✅
no-identical-functions	Functions should not have identical implementations	✅
no-ignored-exceptions	Exceptions should not be ignored	✅
no-ignored-return	Return values from functions without side effects should not be ignored	✅			💭
no-implicit-dependencies	Dependencies should be explicit
no-implicit-global	Variables should be declared explicitly	✅
no-in-misuse	"in" should not be used on arrays	✅		💡	💭
no-incompatible-assertion-types	Assertions comparing incompatible types should not be made	✅			💭
no-incomplete-assertions	Assertions should be complete	✅
no-inconsistent-returns	Functions should use "return" consistently				💭
no-incorrect-string-concat	Strings and non-strings should not be added				💭
no-internal-api-use	Users should not use internal APIs	✅
no-interpolation-in-inline-snapshots	Inline snapshots should not contain interpolations	✅
no-intrusive-permissions	Sensitive permissions should not be requested unnecessarily					❌
no-invalid-regexp	Regular expressions should be syntactically valid	✅			💭
no-invariant-returns	Function returns should not be invariant	✅
no-inverted-boolean-check	Boolean checks should not be inverted	✅		💡
no-ip-forward	Client IP address should not be forwarded to proxies					❌
no-labels	Labels should not be used	✅
no-literal-call	Literals should not be used as functions	✅
no-mime-sniff	Browsers should not be allowed to perform MIME type sniffing	✅
no-misleading-array-reverse	Array-mutating methods should not be used misleadingly	✅		💡	💭
no-misleading-character-class	Unicode Grapheme Clusters should be avoided inside regex character classes	✅		💡	💭
no-mixed-completion-style	Test and hook callbacks should use a single completion style
no-mixed-content	Content Security Policy should block mixed-content					❌
no-mutate-reactive-state-in-updated-hook	Reactive state should not be unconditionally mutated inside Vue's "updated" lifecycle hook	✅
no-nested-assignment	Assignments should not be made from within sub-expressions	✅
no-nested-conditional	Ternary operators should not be nested	✅
no-nested-functions	Functions should not be nested too deeply	✅
no-nested-incdec	Increment (++) and decrement (--) operators should not be used in a method call or mixed with other operators in an expression
no-nested-switch	"switch" statements should not be nested
no-nested-template-literals	Template literals should not be nested	✅
no-networkidle-wait	Playwright "networkidle" waits should not be used
no-os-command-from-path	OS commands should not rely on PATH resolution	✅
no-parameter-reassignment	Initial values of parameters, caught exceptions, and loop variables should not be ignored	✅
no-primitive-wrappers	Wrapper objects should not be used for primitive types	✅		💡
no-redundant-assignments	Assignments should not be redundant	✅
no-redundant-boolean	Boolean literals should not be used in comparisons	✅		💡
no-redundant-jump	Jump statements should not be redundant	✅		💡
no-redundant-optional	Optional property declarations should not use both '?' and 'undefined' syntax	✅		💡	💭
no-redundant-parentheses	Redundant pairs of parentheses should be removed			💡		❌
no-reference-error	Variables should be defined before being used
no-referrer-policy	HTTP Referrer-Policy should not be set to an unsafe value	✅
no-regex-spaces	Regular expressions should not contain multiple spaces	✅		💡	💭
no-require-or-define	"import" should be used to include external code				💭
no-return-type-any	Primitive return types should be used				💭
no-same-argument-assert	Assertions should not be given twice the same argument	✅
no-same-line-conditional	Conditionals should start on new lines	✅		💡
no-selector-parameter	Methods should not contain selector parameters	✅			💭
no-session-cookies-on-static-assets	Static Assets should not serve session cookies	✅
no-skipped-tests	Tests should not be skipped without providing a reason	✅
no-small-switch	"if" statements should be preferred over "switch" when simpler	✅			💭
no-sonar-comments	Track uses of "NOSONAR" comments
no-tab	Tabulation characters should not be used					❌
no-table-as-layout	HTML "<table>" should not be used for layout purposes	✅
no-trivial-assertions	Assertions should not be trivially true	✅		💡
no-try-promise	Promise rejections should not be caught by "try" blocks	✅			💭
no-undefined-argument	"undefined" should not be passed as the value of optional parameters	✅		💡	💭
no-undefined-assignment	"undefined" should not be assigned
no-unenclosed-multiline-block	Multiline blocks should be enclosed in curly braces	✅
no-uniq-key	JSX list components keys should match up between renders	✅
no-unsafe-unzip	Expanding archive files should not be done without controlling resource consumption					❌
no-unthrown-error	Errors should not be created without being thrown	✅		💡
no-unused-collection	Collection contents should be used	✅
no-unused-function-argument	Unused function parameters should be removed			💡
no-unused-vars	Unused local variables and functions should be removed	✅
no-use-of-empty-return-value	The return value of void functions should not be used	✅
no-useless-catch	"catch" clauses should do more than rethrow	✅
no-useless-increment	Values should not be uselessly incremented	✅
no-useless-intersection	Type intersections should use meaningful types	✅			💭
no-useless-react-setstate	React state setter function should not be called with its matching state variable	✅
no-variable-usage-before-declaration	Variables declared with "var" should be declared before they are used
no-vue-class-component	Vue components should not use the deprecated "vue-class-component" or "vue-property-decorator" libraries	✅
no-vue-mixins	Vue components should not use mixins	✅
no-weak-cipher	Cipher algorithms should be robust	✅
no-weak-keys	Cryptographic keys should be robust	✅
no-wildcard-import	Wildcard imports should not be used
non-existent-operator	Non-existent operators '=+', '=-' and '=!' should not be used	✅		💡
non-number-in-arithmetic-expression	Arithmetic operators should only have numbers as operands				💭
null-dereference	Properties of variables with "null" or "undefined" values should not be accessed	✅			💭
object-alt-content	"	✅
operation-returning-nan	Arithmetic operations should not result in "NaN"				💭
os-command	OS commands should not be executed using a shell interpreter					❌
parameterized-tests	Similar tests should be grouped in a single Parameterized test	✅
post-message	Origins should be verified during cross-origin communications	✅			💭
prefer-cypress-should	Cypress assertions should be retryable	✅		💡
prefer-default-last	"default" clauses should be last	✅
prefer-immediate-return	Local variables should not be declared and then immediately returned or thrown		🔧		💭
prefer-native-axios-alternative	Native APIs should be preferred over Axios utility methods	✅		💡
prefer-native-jquery-alternative	Native APIs should be preferred over jQuery utility methods	✅
prefer-native-lodash-alternative	Native APIs should be preferred over Lodash and Underscore.js methods	✅
prefer-object-literal	Object literal syntax should be used
prefer-promise-shorthand	Shorthand promises should be used	✅		💡
prefer-read-only-props	React props should be read-only	✅		💡	💭
prefer-regexp-exec	"RegExp.exec()" should be preferred over "String.match()"	✅		💡	💭
prefer-single-boolean-return	Return of boolean expressions should not be wrapped into an "if-then-else" statement	✅		💡
prefer-specific-assertions	The most specific assertion should be used	✅		💡
prefer-type-guard	Type predicates should be used	✅		💡
prefer-while	A "while" loop should be used instead of a "for" loop	✅	🔧
production-debug	Debugging features should not be enabled in production	✅
pseudo-random	Pseudorandom number generators (PRNGs) should not be used in security contexts	✅
public-static-readonly	Public "static" fields should be read-only	✅		💡
publicly-writable-directories	Temporary files should not be created in publicly writable directories	✅
reduce-initial-value	"Array.reduce()" calls should include an initial value	✅			💭
redundant-type-aliases	Redundant type aliases should not be used	✅
regex-complexity	Regular expressions should not be too complicated	✅			💭
review-blockchain-mnemonic	Wallet phrases should not be hard-coded	✅
session-regeneration	A new session should be created during user authentication	✅
shorthand-property-grouping	Shorthand object properties should be grouped at the beginning or end of an object declaration
single-char-in-character-classes	Character classes in regular expressions should not contain only one character	✅			💭
single-character-alternation	Single-character alternations in regular expressions should be replaced with character classes	✅			💭
slow-regex	Regular expressions should not cause catastrophic backtracking	✅			💭
sql-queries	SQL queries should not be dynamically formatted	✅			💭
stable-tests	Tests should be stable	✅
stateful-regex	Regular expressions with the global flag should be used with caution	✅
strict-transport-security	HTTP Strict-Transport-Security policy should not be disabled	✅
strings-comparison	Comparison operators should not be used with strings				💭
super-linear-regex	Regular expressions should not cause non-linear backtracking	✅
synchronous-exception-assertions	Synchronous exception assertions should receive synchronous callbacks	✅		💡	💭
synchronous-suite-callback	Tests should not be registered asynchronously in suite callbacks	✅		💡
table-header	Tables should have headers	✅
table-header-reference	Table cells should reference their headers	✅
test-check-exception	Tests should check which exception is thrown	✅
testing-library-prefer-query-by-disappearance	Testing Library disappearance waits should use non-throwing queries	✅	🔧
testing-library-query-assertion	Testing Library queries should match presence assertions	✅	🔧
todo-tag	Track uses of "TODO" tags	✅
too-many-break-or-continue-in-loop	Loops should not contain more than a single "break" or "continue" statement
unicode-aware-regex	Regular expressions using Unicode character classes or property escapes should enable the unicode flag				💭
unused-import	Unnecessary imports should be removed	✅		💡	💭
unused-named-groups	Names of regular expressions named groups should be used	✅			💭
unverified-certificate	Server certificates should be verified during SSL/TLS connections	✅
unverified-hostname	Server hostnames should be verified during SSL/TLS connections	✅
updated-const-var	"const" variables should not be reassigned	✅
updated-loop-counter	Loop counters should not be assigned within the loop body	✅
use-type-alias	Type aliases should be used	✅
useless-string-operation	Results of operations on strings should not be ignored				💭	❌
values-not-convertible-to-numbers	Values not convertible to numbers should not be used in numeric comparisons				💭
variable-name	Variable, property and parameter names should comply with a naming convention
vitest-mock-at-module-scope	vi.mock should be declared at module scope	✅
void-use	"void" should not be used	✅			💭
weak-ssl	Weak SSL/TLS protocols should not be used	✅
web-sql-database	Web SQL databases should not be used				💭	❌
x-powered-by	Web application technologies should not disclose version information	✅
xml-parser-xxe	XML parsers should not be vulnerable to XXE attacks	✅

ESLint rules

SonarJS uses some rules are not shipped in this ESLint plugin to avoid duplication with already existing rules from ESLint core and third-party ESLint plugins. The following rules are used directly, without modifying the original behavior:

SonarJS rule ID	Rule implemented by
S103	@stylistic/eslint-plugin/max-len
S106	eslint/no-console
S108	eslint/no-empty
S113	@stylistic/eslint-plugin/eol-last
S121	eslint/curly
S122	@stylistic/eslint-plugin/max-statements-per-line
S139	eslint/line-comment-position
S878	eslint/no-sequences
S909	eslint/no-continue
S1090	jsx-a11y/iframe-has-title
S1117	typescript-eslint/no-shadow
S1131	@stylistic/eslint-plugin/no-trailing-spaces
S1199	eslint/no-lone-blocks
S1314	eslint/no-octal
S1321	eslint/no-with
S1440	eslint/eqeqeq
S1441	@stylistic/eslint-plugin/quotes
S1442	eslint/no-alert
S1516	eslint/no-multi-str
S1525	eslint/no-debugger
S1536	eslint/no-dupe-args
S1537	@stylistic/eslint-plugin/comma-dangle
S1539	eslint/strict
S1656	eslint/no-self-assign
S1751	eslint/no-unreachable-loop
S1774	eslint/no-ternary
S2427	eslint/radix
S2432	eslint/no-setter-return
S2685	eslint/no-caller
S2966	typescript-eslint/no-non-null-assertion
S3257	typescript-eslint/no-inferrable-types
S3353	eslint/prefer-const
S3523	eslint/no-new-func
S3786	eslint/no-template-curly-in-string
S3812	eslint/no-unsafe-negation
S3834	eslint/no-new-native-nonconstructor
S3863	import/no-duplicates
S4124	typescript-eslint/no-misused-new
S4125	eslint/valid-typeof
S4136	typescript-eslint/adjacent-overload-signatures
S4137	typescript-eslint/consistent-type-assertions
S4140	eslint/no-sparse-arrays
S4157	typescript-eslint/no-unnecessary-type-arguments
S4204	typescript-eslint/no-explicit-any
S4326	eslint/no-return-await
S6325	eslint/prefer-regex-literals
S6435	react/require-render-return
S6438	react/jsx-no-comment-textnodes
S6480	react/jsx-no-bind
S6509	eslint/no-extra-boolean-cast
S6522	eslint/no-import-assign
S6523	eslint/no-unsafe-optional-chaining
S6534	eslint/no-loss-of-precision
S6550	typescript-eslint/prefer-literal-enum-member
S6565	typescript-eslint/prefer-return-this-type
S6568	typescript-eslint/no-confusing-non-null-assertion
S6569	typescript-eslint/no-unnecessary-type-constraint
S6578	typescript-eslint/no-duplicate-enum-values
S6583	typescript-eslint/no-mixed-enums
S6590	typescript-eslint/prefer-as-const
S6635	eslint/no-constructor-return
S6637	eslint/no-extra-bind
S6638	eslint/no-constant-binary-expression
S6644	eslint/no-unneeded-ternary
S6645	eslint/no-undef-init
S6650	eslint/no-useless-rename
S6653	eslint/prefer-object-has-own
S6654	eslint/no-proto
S6657	eslint/no-octal-escape
S6671	typescript-eslint/prefer-promise-reject-errors
S6746	react/no-direct-mutation-state
S6748	react/no-children-prop
S6750	react/no-render-return-value
S6756	react/no-access-state-in-setstate
S6761	react/no-danger-with-children
S6763	react/no-redundant-should-component-update
S6766	react/no-unescaped-entities
S6770	react/jsx-pascal-case
S6772	react/jsx-child-element-spacing
S6775	react/default-props-match-prop-types
S6789	react/no-is-mounted
S6790	react/no-string-refs
S6793	jsx-a11y/aria-proptypes
S6807	jsx-a11y/role-has-required-aria-props
S6811	jsx-a11y/role-supports-aria-props
S6821	jsx-a11y/aria-role
S6822	jsx-a11y/no-redundant-roles
S6823	jsx-a11y/aria-activedescendant-has-tabindex
S6824	jsx-a11y/aria-unsupported-elements
S6825	jsx-a11y/no-aria-hidden-on-focusable
S6836	eslint/no-case-declarations
S6840	jsx-a11y/autocomplete-valid
S6841	jsx-a11y/tabindex-no-positive
S6842	jsx-a11y/no-noninteractive-element-to-interactive-role
S6843	jsx-a11y/no-interactive-element-to-noninteractive-role
S6845	jsx-a11y/no-noninteractive-tabindex
S6846	jsx-a11y/no-access-key
S6847	jsx-a11y/no-noninteractive-element-interactions
S6848	jsx-a11y/no-static-element-interactions
S6850	jsx-a11y/heading-has-content
S6851	jsx-a11y/img-redundant-alt
S6852	jsx-a11y/interactive-supports-focus
S6861	import/no-mutable-exports
S7641	@angular-eslint/contextual-lifecycle
S7647	@angular-eslint/no-empty-lifecycle-method
S7648	@angular-eslint/prefer-standalone
S7650	@angular-eslint/no-inputs-metadata-property
S7651	@angular-eslint/no-output-native
S7652	@angular-eslint/no-output-on-prefix
S7653	@angular-eslint/no-output-rename
S7654	@angular-eslint/no-outputs-metadata-property
S7655	@angular-eslint/use-lifecycle-interface
S7656	@angular-eslint/use-pipe-transform-interface
S7718	unicorn/catch-error-name
S7719	unicorn/consistent-date-clone
S7720	unicorn/consistent-empty-array-spread
S7721	unicorn/consistent-function-scoping
S7724	unicorn/no-abusive-eslint-disable
S7725	unicorn/no-accessor-recursion
S7726	unicorn/no-anonymous-default-export
S7730	unicorn/no-await-expression-member
S7731	unicorn/no-for-loop
S7732	unicorn/no-instanceof-builtins
S7733	unicorn/no-invalid-fetch-options
S7734	unicorn/no-named-default
S7735	unicorn/no-negated-condition
S7736	unicorn/no-negation-in-equality-check
S7737	unicorn/no-object-as-default-parameter
S7738	unicorn/no-single-promise-in-promise-methods
S7740	unicorn/no-this-assignment
S7741	unicorn/no-typeof-undefined
S7742	unicorn/no-unnecessary-polyfills
S7743	unicorn/no-unreadable-iife
S7744	unicorn/no-useless-fallback-in-spread
S7745	unicorn/no-useless-length-check
S7746	unicorn/no-useless-promise-resolve-reject
S7747	unicorn/no-useless-spread
S7748	unicorn/no-zero-fractions
S7749	unicorn/numeric-separators-style
S7750	unicorn/prefer-array-find
S7751	unicorn/prefer-array-flat
S7752	unicorn/prefer-array-flat-map
S7753	unicorn/prefer-array-index-of
S7754	unicorn/prefer-array-some
S7756	unicorn/prefer-blob-reading-methods
S7757	unicorn/prefer-class-fields
S7758	unicorn/prefer-code-point
S7760	unicorn/prefer-default-parameters
S7761	unicorn/dom-node-dataset
S7762	unicorn/prefer-dom-node-remove
S7764	unicorn/prefer-global-this
S7765	unicorn/prefer-includes
S7767	unicorn/prefer-math-trunc
S7768	unicorn/prefer-modern-dom-apis
S7769	unicorn/prefer-modern-math-apis
S7771	unicorn/prefer-negative-index
S7772	unicorn/prefer-node-protocol
S7773	unicorn/prefer-number-properties
S7774	unicorn/prefer-prototype-methods
S7775	unicorn/prefer-regexp-test
S7776	unicorn/prefer-set-has
S7777	unicorn/prefer-set-size
S7783	unicorn/prefer-string-trim-start-end
S7786	unicorn/prefer-type-error
S7787	unicorn/require-module-specifiers
S8957	vue/require-prop-types
S8962	vue/require-typed-ref
S8981	testing-library/no-global-regexp-flag-in-query

Improved ESLint rules

The following rules are used in SonarJS but not available in this ESLint plugin. These rules have been modified, so your experience using them in your ESLint configuration may differ from the results you may get using SonarQube.

SonarJS rule ID	Rules used in the SonarJS implementation
S107	eslint/max-params
S109	typescript-eslint/no-magic-numbers
S131	typescript-eslint/switch-exhaustiveness-check
S905	typescript-eslint/no-unused-expressions
S1068	eslint/no-unused-private-class-members
S1077	jsx-a11y/alt-text
S1082	jsx-a11y/mouse-events-have-key-events jsx-a11y/click-events-have-key-events
S1105	@stylistic/eslint-plugin/brace-style
S1116	@stylistic/eslint-plugin/no-extra-semi
S1143	eslint/no-unsafe-finally
S1186	typescript-eslint/no-empty-function
S1438	@stylistic/eslint-plugin/semi
S1534	eslint/no-dupe-keys typescript-eslint/no-dupe-class-members react/jsx-no-duplicate-props vue/no-duplicate-attributes
S1763	eslint/no-unreachable
S1788	typescript-eslint/default-param-last
S2094	typescript-eslint/no-extraneous-class
S2189	eslint/no-unmodified-loop-condition
S2376	eslint/accessor-pairs
S2430	eslint/new-cap
S2688	eslint/use-isnan
S2814	typescript-eslint/no-redeclare
S2933	typescript-eslint/prefer-readonly
S3498	eslint/object-shorthand
S3504	eslint/no-var
S3512	eslint/prefer-template
S3696	eslint/no-throw-literal
S3723	@stylistic/eslint-plugin/comma-dangle
S3799	eslint/no-empty-pattern
S3854	eslint/constructor-super eslint/no-this-before-super
S4023	typescript-eslint/no-empty-interface
S4084	jsx-a11y/media-has-caption
S4123	typescript-eslint/await-thenable
S4138	typescript-eslint/prefer-for-of
S4156	typescript-eslint/prefer-namespace-keyword
S4275	eslint/getter-return
S4325	typescript-eslint/no-unnecessary-type-assertion
S4327	typescript-eslint/no-this-alias
S5254	jsx-a11y/lang jsx-a11y/html-has-lang
S6440	react-hooks/rules-of-hooks
S6441	react/no-unused-class-component-methods
S6477	react/jsx-key
S6478	react/no-unstable-nested-components
S6479	react/no-array-index-key
S6481	react/jsx-no-constructed-context-values
S6535	eslint/no-useless-escape eslint/no-nonoctal-decimal-escape
S6544	typescript-eslint/no-misused-promises eslint/no-async-promise-executor
S6551	typescript-eslint/no-base-to-string
S6557	typescript-eslint/prefer-string-starts-ends-with
S6571	typescript-eslint/no-redundant-type-constituents
S6572	typescript-eslint/prefer-enum-initializers
S6582	typescript-eslint/prefer-optional-chain
S6598	typescript-eslint/prefer-function-type
S6606	typescript-eslint/prefer-nullish-coalescing
S6643	eslint/no-extend-native
S6647	eslint/no-useless-constructor
S6660	eslint/no-lonely-if
S6661	eslint/prefer-object-spread
S6666	eslint/prefer-spread
S6676	eslint/no-useless-call
S6679	eslint/no-self-compare
S6747	react/no-unknown-property jsx-a11y/aria-props
S6749	react/jsx-no-useless-fragment
S6754	react/hook-use-state
S6757	react/no-this-in-sfc
S6767	react/no-unused-prop-types
S6774	react/prop-types
S6788	react/no-find-dom-node
S6791	react/no-unsafe
S6819	jsx-a11y/prefer-tag-over-role
S6827	jsx-a11y/anchor-has-content
S6844	jsx-a11y/anchor-is-valid
S6853	jsx-a11y/label-has-associated-control
S6859	import/no-absolute-path
S6957	react/no-deprecated
S7060	import/no-self-import
S7503	typescript-eslint/require-await
S7649	@angular-eslint/no-input-rename
S7722	unicorn/error-message
S7723	unicorn/new-for-builtins
S7727	unicorn/no-array-callback-reference
S7728	unicorn/no-array-for-each
S7729	unicorn/no-array-method-this-argument
S7739	unicorn/no-thenable
S7755	unicorn/prefer-at
S7759	unicorn/prefer-date-now
S7763	unicorn/prefer-export-from
S7766	unicorn/prefer-math-min-max
S7770	unicorn/prefer-native-coercion-functions
S7778	unicorn/prefer-single-call
S7780	unicorn/prefer-string-raw
S7781	unicorn/prefer-string-replace-all
S7784	unicorn/prefer-structured-clone
S7785	unicorn/prefer-top-level-await
S8950	vue/no-required-prop-with-default
S8951	vue/no-mutating-props
S8961	vue/require-explicit-emits
S8980	testing-library/no-unnecessary-act
S8982	vue/require-v-for-key
S8984	vue/valid-v-for
S8985	testing-library/no-wait-for-side-effects
S8987	vue/no-use-v-if-with-v-for
S8988	vue/no-side-effects-in-computed-properties
S8990	testing-library/no-promise-in-fire-event
S9011	react/button-has-type vue/html-button-has-type
S9012	testing-library/no-wait-for-snapshot
S9019	vue/no-ref-as-operand
S9020	testing-library/prefer-find-by
S9025	vue/no-async-in-computed-properties
S9026	testing-library/await-async-queries
S9107	vue/require-prop-type-constructor
S9115	testing-library/await-async-events
S9128	vue/no-dupe-keys
S9333	testing-library/no-await-sync-queries
S9379	jsx-a11y/no-autofocus
S9380	jsx-a11y/scope
S9381	promise/no-nesting
S9382	eslint/no-await-in-loop
S9383	typescript-eslint/no-floating-promises