Skip to main content

no-malformed-character-reference

Warns when a &...;-shaped character reference is malformed: an unrecognized name, a missing terminating semicolon, or a numeric reference to a NULL, surrogate, control, noncharacter, or out-of-Unicode-range code point.

In certain cases described in other sections, text may be mixed with character references. These can be used to escape characters that couldn't otherwise legally be included in text.

Cite: HTML Living Standard 13.1.4 Character references

This rule reads the same parse5 tokenizer errors the built-in parseError channel can surface, and reports them under this rule's name instead so they're covered by the same enable/severity/reason config as every other rule.

A literal < or an ambiguous ampersand that was never written as a &...;-shaped sequence in the first place is no-unescaped-char's concern, not this rule's.

❌ Examples of incorrect code for this rule

<p>&xyz;</p>
<p>&amp text</p>
<p>&#;</p>
<p>&#x110000;</p>

✅ Examples of correct code for this rule

<p>&amp; text</p>
<p>&#65;</p>

Interface​

{
  "no-malformed-character-reference": boolean
}

Default Severity​

error