Skip to main content
interlace
Plugin: react-featuresRules

no-unescaped-entities

no-unescaped-entities rule

Detect unescaped HTML entities in JSX. This rule is part of eslint-plugin-react-features.

Quick Summary

AspectDetails
SeverityError (syntax)
Auto-Fix✅ Yes (escapes entities)
CategoryReact
ESLint MCP✅ Optimized for ESLint MCP integration
Best ForAll React/JSX projects

Rule Details

A raw " in JSX text reads like an attribute delimiter that was never closed. The rule reads the source as written, so the escaped spellings (", ", {'"'}) and quotes inside attribute values or string expressions are not reported.

Why This Matters

IssueImpactSolution
⚠️ Syntax errorsJSX parsing failsUse HTML entities
📖 ReadabilityAmbiguous charactersExplicit escaping
🐛 Silent failuresWrong outputProper encoding

Examples

❌ Incorrect

<div>Use "quotes"</div>

> and } in JSX text do not parse in TypeScript, and the parser reports them before this rule runs.

✅ Correct

<div>Hello World</div>
<div>Use &quot;quotes&quot;</div>
<div>Use {'"'}quotes{'"'}</div>
<div>It's working</div>

Entity Reference

CharacterEntityAlternative
>&gt;{'>'} or &#62;
<&lt;{'<'} or &#60;
"&quot;{'"'} or &#34;
'&apos;{"'"} or &#39;
}&#125;{'}'}
{&#123;{'{'}

Configuration Examples

Basic Usage

{
  rules: {
    'react-features/no-unescaped-entities': 'error'
  }
}

Further Reading

Known False Negatives

  • ' is not reported: an apostrophe renders as written and is ordinary prose.
  • > and } in JSX text are a TypeScript parse error, so the rule never sees them in a .tsx file.

Use this rule

npm install -D oxlint-plugin-react-features
.oxlintrc.json
{  "jsPlugins": ["oxlint-plugin-react-features"],  "rules": {    "react-features/no-unescaped-entities": "error"  }}
vite.config.ts
import { defineConfig } from 'vite-plus';export default defineConfig({  lint: {    jsPlugins: ['oxlint-plugin-react-features'],    rules: {      'react-features/no-unescaped-entities': 'error',    },  },});

oxlint-plugin-react-features re-exports eslint-plugin-react-features/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.

Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.