no-restricted-paths

💼 This rule is enabled in the following configs: recommended, typescript.

Rule DetailsCopy Anchor Link

Code must not import the paths the user restricts. Each restricted entry is one or more path segments (server, app/server); a specifier is restricted when it contains those segments, in order, as whole path segments. Every way a module is loaded or re-exported is checked: import, side-effect import, export … from, export * from, require(), import() and TypeScript's import x = require(). The default [] restricts nothing.

The specifier is matched as written; it is not resolved, so restrict the segments your imports actually spell.

Not reported: a specifier that only contains the pattern inside a segment name: with restricted: ['server'], ./observer and ./server-utils are not the server path.

❌ IncorrectCopy Anchor Link

// { restricted: ['server'] }
import db from '../server/db';
export { db } from '@/server/db';

✅ CorrectCopy Anchor Link

// { restricted: ['server'] }
import observer from './observer';
import utils from './server-utils';

OptionsCopy Anchor Link

[
  {
    "type": "object",
    "properties": {
      "restricted": {
        "type": "array",
        "items": {
          "type": "string"
        },
        "description": "Array of restricted path patterns"
      }
    },
    "additionalProperties": false
  }
]

ImplementationCopy Anchor Link

• Source Code
• Test Cases

OWASP FoundationCopy Anchor Link

• Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next

{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/no-restricted-paths": "error"  }}

import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/no-restricted-paths': 'error',    },  },});