mcp-server-semgrep/semgrep-rules/typescript/react/best-practice/react-props-spreading.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: react-props-spreading
  patterns:
    - pattern: <$X {...$PROPS} />
    - focus-metavariable: $PROPS
  message: >-
      It's best practice to explicitly pass props to an HTML component rather than
      use the spread operator.
      The spread operator risks passing invalid HTML props to an HTML element,
      which can cause console warnings or worse, give malicious actors a way
      to inject unexpected attributes.
  languages:
    - typescript
    - javascript
  severity: WARNING
  metadata:
      source-rule-url: https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-props-no-spreading.md
      references:
        - https://github.com/yannickcr/eslint-plugin-react/blob/master/docs/rules/jsx-props-no-spreading.md
      category: best-practice
      technology:
        - react