prefer-code-point
Prefer String.codePointAt() over String.charCodeAt(). This rule is part of eslint-plugin-conventions.
Prefer String.codePointAt() over String.charCodeAt(). This rule is part of eslint-plugin-conventions.
Quick Summary
| Aspect | Details |
|---|---|
| Severity | Warning (correctness) |
| Auto-Fix | ❌ No |
| Category | Quality |
| ESLint MCP | ✅ Optimized for ESLint MCP integration |
| Best For | Unicode handling, emoji support |
Rule Details
charCodeAt() only works for Basic Multilingual Plane characters. codePointAt() handles all Unicode including emoji.
The rule reports a call of a charCodeAt method in every spelling:
s.charCodeAt(0), s['charCodeAt'](0), an optional call (s?.charCodeAt(0))
and a non-null receiver (s!.charCodeAt(0)). It does not report
codePointAt, a method chosen by a runtime key (s[method](0)), or a plain
function that happens to be named charCodeAt. The rule has no options.
Why This Matters
| Issue | Impact | Solution |
|---|---|---|
| 😀 Emoji handling | Incorrect code points | codePointAt() |
| 🌍 Unicode support | Astral characters fail | Full Unicode support |
| 📏 String length | Surrogate pairs miscounted | Correct iteration |
Examples
❌ Incorrect
const code = string.charCodeAt(0); // Fails for emoji
'😀'.charCodeAt(0); // Returns 55357 (wrong!)✅ Correct
const code = string.codePointAt(0); // Works for all Unicode
'😀'.codePointAt(0); // Returns 128512 (correct!)
// Iterate over code points
for (const char of string) {
const codePoint = char.codePointAt(0);
}Configuration Examples
Basic Usage
{
rules: {
'conventions/prefer-code-point': 'warn'
}
}Related Rules
prefer-dom-node-text-content- DOM text handling
Further Reading
- codePointAt() - MDN - MDN reference
Known False Negatives
String.prototype.charCodeAt.call(s, 0)and a reference that is called later (const at = s.charCodeAt; at.call(s, 0)) are not reported.String.fromCharCode()(the inverse, whichString.fromCodePoint()replaces) is not in scope.
Use this rule
npm install -D oxlint-plugin-conventions{ "jsPlugins": ["oxlint-plugin-conventions"], "rules": { "conventions/prefer-code-point": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-conventions'], rules: { 'conventions/prefer-code-point': 'error', }, },});oxlint-plugin-conventions re-exports eslint-plugin-conventions/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.
no-raw-cross-property-href
Forbid hand-written cross-property hrefs; use buildUtmHref() from lib/utm.ts
prefer-dependency-version-strategy
Enforce consistent version strategy (caret ^, tilde ~, exact, range, or any) for package.json dependencies. Pairs with a lockfile-alignment check to give complete dependency validation.