Import Absolute Path
ID |
javascript.import_absolute_path |
Severity |
high |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
JavaScript |
Tags |
imports, portability, reliability |
Description
Reports an import whose module specifier is an absolute filesystem path: a leading /, a Windows drive letter (C:\ or C:/), or a UNC share (\\host\share).
A path alias (@app/config, ~/config) is not reported: it is resolved by configuration that travels with the project. Nor is a relative path or a package name.
Rationale
// Bad
import config from '/home/dev/app/config.js';
import tool from 'C:\\build\\tool.js';-
The specifier names a location on the machine it was written on. It survives no clone into a different directory, no build container, no other developer’s machine and no CI runner.
-
When it fails, it fails at resolution time with a message about a missing file rather than about the import, which is usually the last place anyone looks.
-
When it does resolve, it has reached outside the project’s dependency graph. The file it names is not tracked, not versioned with the code, and not visible to the bundler — so the build is reproducible only by accident.
-
It is almost always a leftover from debugging: a path pasted from an editor or a terminal to try something out, and never turned back into a real import.
A leading / is reported even though a few bundler configurations read it as "relative to the project root". That reading is bundler-specific, invisible in the source, and unavailable to Node or to the browser, so the same specifier means different things in different places — which is the defect, not an exemption from it.
Remediation
Use a path relative to the importing file, a package name, or a configured alias.
// Good
import config from './config.js';
import shared from '../shared/config.js';
import lodash from 'lodash';
import config from '@app/config'; // alias declared in the project's resolver configAn alias is the right fix when the relative path would be long or fragile: declare it once (in tsconfig.json paths, in the bundler’s resolve.alias, or as an imports entry in package.json) and every file gets a stable, portable specifier.