Plugin: react-featuresRules
no-unescaped-entities
no-unescaped-entities rule
Detect unescaped HTML entities in JSX. This rule is part of eslint-plugin-react-features.
Quick Summary
| Aspect | Details |
|---|---|
| Severity | Error (syntax) |
| Auto-Fix | ✅ Yes (escapes entities) |
| Category | React |
| ESLint MCP | ✅ Optimized for ESLint MCP integration |
| Best For | All React/JSX projects |
Rule Details
A raw " in JSX text reads like an attribute delimiter that was never closed.
The rule reads the source as written, so the escaped spellings (",
", {'"'}) and quotes inside attribute values or string expressions
are not reported.
Why This Matters
| Issue | Impact | Solution |
|---|---|---|
| ⚠️ Syntax errors | JSX parsing fails | Use HTML entities |
| 📖 Readability | Ambiguous characters | Explicit escaping |
| 🐛 Silent failures | Wrong output | Proper encoding |
Examples
❌ Incorrect
<div>Use "quotes"</div>> and } in JSX text do not parse in TypeScript, and the parser reports
them before this rule runs.
✅ Correct
<div>Hello World</div>
<div>Use "quotes"</div>
<div>Use {'"'}quotes{'"'}</div>
<div>It's working</div>Entity Reference
| Character | Entity | Alternative |
|---|---|---|
> | > | {'>'} or > |
< | < | {'<'} or < |
" | " | {'"'} or " |
' | ' | {"'"} or ' |
} | } | {'}'} |
{ | { | {'{'} |
Configuration Examples
Basic Usage
{
rules: {
'react-features/no-unescaped-entities': 'error'
}
}Related Rules
no-danger- HTML injection safety
Further Reading
- JSX In Depth - React docs
- HTML Entities - Reference
Known False Negatives
'is not reported: an apostrophe renders as written and is ordinary prose.>and}in JSX text are a TypeScript parse error, so the rule never sees them in a.tsxfile.
Use this rule
npm install -D oxlint-plugin-react-features{ "jsPlugins": ["oxlint-plugin-react-features"], "rules": { "react-features/no-unescaped-entities": "error" }}import { defineConfig } from 'vite-plus';export default defineConfig({ lint: { jsPlugins: ['oxlint-plugin-react-features'], rules: { 'react-features/no-unescaped-entities': 'error', }, },});oxlint-plugin-react-features re-exports eslint-plugin-react-features/oxlint: the same rules under the same IDs, and no ESLint install. Why oxlint.
Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.