Skip to main content
interlace
Plugin: import-nextRules

no-self-import

Forbid a module from importing itself

💼 This rule is enabled in the following configs: recommended, typescript.

Rule Details

A module that loads itself is reported, in every way a module is loaded at runtime: import, side-effect import, export … from, export * from, require(), import() and TypeScript's import x = require().

The specifier names this file when it resolves to it: ./app, ./app.js (TypeScript maps the .js output extension to the .ts source), ./app.ts, or any path back to the same file (../src/app). For an index file, the directory itself is the file: ., ./ and ../lib from lib/index.ts.

Not reported: a different file (./app.tsx from app.ts, ./app.css, ./app.test.constants), a package, import type and imports whose every specifier is an inline type (erased, so nothing loads), and a call to a require the file declares itself (not Node's loader). allowInTests skips test files.

❌ Incorrect

// src/app.ts
import { helper } from './app';
export * from './app.js';
const self = require('../src/app');

// src/lib/index.ts
import { util } from '.';

✅ Correct

// src/app.ts
import { helper } from './helper';
import styles from './app.css';
import type { Config } from './app';

Options

[
  {
    "type": "object",
    "properties": {
      "allowInTests": {
        "type": "boolean",
        "default": false,
        "description": "Allow self-imports in test files."
      }
    },
    "additionalProperties": false
  }
]

Implementation

OWASP Foundation

  • Category: A00:2021 - General Security

Use this rule

npm install -D oxlint-plugin-import-next
.oxlintrc.json
{  "jsPlugins": ["oxlint-plugin-import-next"],  "rules": {    "import-next/no-self-import": "error"  }}
vite.config.ts
import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-import-next'],    rules: {      'import-next/no-self-import': 'error',    },  },});

oxlint-plugin-import-next re-exports eslint-plugin-import-next/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.

Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.