{"record":{"id":"207697f258ff490c","repo":"oxc-project/oxc","slug":"do-not-use-instanceof-with-built-in-constructors","errorCode":null,"errorMessage":"Do not use `instanceof` with built-in constructors","messagePattern":"Do not use `instanceof` with built-in constructors","errorType":"validation","errorClass":"OxcDiagnostic","httpStatus":null,"severity":"warning","filePath":"crates/oxc_linter/src/rules/unicorn/no_instanceof_builtins.rs","lineNumber":13,"sourceCode":"use oxc_ast::{AstKind, ast::Expression};\nuse oxc_diagnostics::OxcDiagnostic;\nuse oxc_macros::declare_oxc_lint;\nuse oxc_span::{GetSpan, Span};\nuse oxc_syntax::operator::BinaryOperator;\nuse schemars::JsonSchema;\nuse serde::Serialize;\nuse serde_json::Value;\n\nuse crate::{AstNode, context::LintContext, rule::Rule};\n\nfn no_instanceof_builtins_diagnostic(span: Span) -> OxcDiagnostic {\n    OxcDiagnostic::warn(\"Do not use `instanceof` with built-in constructors\")\n        .with_help(\n            \"Use `Array.isArray(…)`, `typeof … === 'string'`, \\\n             or another realm-safe alternative instead\",\n        )\n        .with_label(span)\n}\n\nconst PRIMITIVE_WRAPPERS: &[&str] = &[\"String\", \"Number\", \"Boolean\", \"BigInt\", \"Symbol\"];\n\nconst STRICT_STRATEGY_CONSTRUCTORS: &[&str] = &[\n    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Error\n    \"Error\",\n    \"EvalError\",\n    \"RangeError\",\n    \"ReferenceError\",\n    \"SyntaxError\",\n    \"TypeError\",\n    \"URIError\",","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/oxc-project/oxc/blob/e1e7af627c8843ab64044ed466b128fcc21a035b/crates/oxc_linter/src/rules/unicorn/no_instanceof_builtins.rs#L1-L31","documentation":"Diagnostic from the oxlint rule `unicorn/no-instanceof-builtins` (category: suspicious). `instanceof` against built-in constructors breaks across realms (iframes, workers, Node vm) and misleads for boxed primitives: `'x' instanceof String` is false while `new String('x') instanceof String` is true. Default ('loose') strategy flags Array (suggests `Array.isArray`), Function (suggests `typeof x === 'function'`), the primitive wrappers String/Number/Boolean/BigInt/Symbol (suggests `typeof`), and — when `useErrorIsError` is enabled — Error (suggests `Error.isError()`). The `strict` strategy additionally flags Error subtypes, Map/Set/WeakMap/WeakSet/WeakRef, typed arrays, Object, RegExp, Promise, Proxy, DataView, Date, and more; `include`/`exclude` tune the set. Most suggestions are auto-fixable.","triggerScenarios":"`foo instanceof Array`, `x instanceof String`, `fn instanceof Function`, `err instanceof Error` (with useErrorIsError), and under strict strategy `v instanceof Map`, `r instanceof RegExp`, `d instanceof Date`, `buf instanceof Uint8Array`, etc. The right side must be a plain identifier resolving to the built-in.","commonSituations":"Hardening code that receives values from workers/iframes/vm sandboxes; replacing wrapper-object checks with primitive checks; teams adopting the strict strategy or extending coverage with include (e.g. HTMLElement, replaced by `el?.nodeType === 1`).","solutions":["Apply the suggested replacement: `Array.isArray(x)`, `typeof x === 'string' | 'number' | 'boolean' | 'bigint' | 'symbol' | 'function'`, `Error.isError(e)` — most are auto-fixable","For DOM constructors use duck typing: `el?.nodeType === 1` instead of `el instanceof HTMLElement`","Configure the rule in .oxlintrc.json: strategy 'loose'|'strict', include/exclude name lists, useErrorIsError boolean"],"exampleFix":"// before\nif (input instanceof String) {\n  use(input);\n}\n\n// after\nif (typeof input === 'string') {\n  use(input);\n}","handlingStrategy":"type-guard","validationCode":null,"typeGuard":"function isPrimitiveString(v: unknown): v is string {\n  return typeof v === 'string';\n}\nfunction isErrorLike(v: unknown): v is Error {\n  return typeof Error.isError === 'function'\n    ? Error.isError(v)\n    : Object.prototype.toString.call(v) === '[object Error]';\n}","tryCatchPattern":null,"preventionTips":["Prefer typeof for primitives and Array.isArray for arrays; keep instanceof for your own classes","Configure strategy/useErrorIsError explicitly so suggestions match your target runtime","Validate cross-realm data once at the boundary, then trust the narrowed type"],"tags":["cross-realm","typeof","builtin-objects","type-checking","oxlint"],"backgroundTag":"cross-realm-instanceof","analyzedSha":"e1e7af627c8843ab64044ed466b128fcc21a035b","analyzedAt":"2026-08-20T07:01:07.079Z","contentChangedAt":"2026-08-20T07:01:07.079Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}