[draarivpatel-ui]

Short description of what this resolves

Fixes a false tag-pair error reported for valid start tags whose quoted attributes are not separated by whitespace. Closes #1460 (and the older #18).

Given this markup:

<div id="abc"class="def">
    test
</div>

HTMLHint reported Tag must be paired, no start tag: [ </div> ] on the closing tag. The tagstart regex required \s+ before every attribute, so a value ending in a quote followed immediately by the next attribute name made the whole start tag fail to match. The parser then emitted the start tag as plain text, leaving the end tag with no matching start.

Proposed changes

• Relax the attribute separator in src/core/htmlparser.ts so a new attribute may begin directly after a closing single or double quote, while whitespace stays the normal separator. Malformed tags such as <divclass="x"> are still treated as text, so no existing parsing behavior changes.
• Regenerate the tracked dist/core/htmlparser.js build output.
• Add regression tests in test/htmlparser.spec.js (double and single quoted attributes) and test/rules/tag-pair.spec.js (no false pairing error).

Verification

• npm run lint passes.
• npm run build passes and leaves a clean tree (git diff --exit-code).
• npm test passes: 61 suites, 384 tests.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[coliff]

Hi @draarivpatel-ui - can you address or comment on the GitHub Advanced Security feedback please?

[draarivpatel-ui]

Hi @coliff — thanks for the nudge, and apologies for the delayed reply.

The two GitHub Advanced Security / CodeQL findings on src/core/htmlparser.ts have been addressed in follow-up commits on this PR:

• 6f24811 — eliminates the regTag backtracking and aligns --!> comment parsing with --> (the "Bad HTML filtering regexp" finding).
• 73ed35a — replaces the polynomial-time regex in start-tag and attribute scanning with linear character-by-character scanning (the "Inefficient regular expression" / exponential-backtracking finding). This also keeps the original fix for quoted attributes with no separating whitespace (#1460) intact.

Current state on head 73ed35a:

• CodeQL and Analyze checks: success (2026-11-11T23:59Z).
• All 11 CI checks green (build on Node 22/24/26 × ubuntu/windows, lint, spellcheck, CodeQL, Analyze).
• Local verification: npm ci + npm run build + npx jest -> 392 passed / 393 total, with test/htmlparser.spec.js and test/core.spec.js at 52/52. The single failure is test/cli/formatters/sarif.spec.js, a 30s done() timeout that also passes in isolation on both this branch and main — it's a parallel-run flake in this environment, unrelated to the parser change.

Happy to adjust anything further if you'd like a different approach. Thanks for reviewing!