JavaScript: Accept CDATA in E4X content.

Max Schaefer · Max Schaefer · commit d6deefed8639 · 2019-02-24T20:45:41.000Z
diff --git a/javascript/extractor/src/com/semmle/jcorn/CustomParser.java b/javascript/extractor/src/com/semmle/jcorn/CustomParser.java
@@ -564,7 +564,7 @@ protected Token readToken(int code) {
 
 	@Override
 	protected Either<Integer, Token> jsx_readChunk(StringBuilder out, int chunkStart, int ch) {
-		// skip XML comments and processing instructions (which are allowed in E4X, but not in JSX)
+		// skip XML comments, processing instructions and CDATA (which are allowed in E4X, but not in JSX)
 		if (this.options.e4x() && ch == '<') {
 			if (inputSubstring(this.pos+1, this.pos+4).equals("!--")) {
 				out.append(inputSubstring(chunkStart, this.pos));
@@ -576,6 +576,13 @@ protected Either<Integer, Token> jsx_readChunk(StringBuilder out, int chunkStart
 				this.pos += 2;
 				jsx_readUntil("?>");
 				return Either.left(this.pos);
+			} else if (inputSubstring(this.pos+1,  this.pos+9).equals("![CDATA[")) {
+				out.append(inputSubstring(chunkStart, this.pos));
+				this.pos += 9;
+				int cdataStart = this.pos;
+				jsx_readUntil("]]>");
+				out.append(inputSubstring(cdataStart, this.pos-3));
+				return Either.left(this.pos);
 			}
 		}
 
diff --git a/javascript/extractor/tests/e4x/input/tst.js b/javascript/extractor/tests/e4x/input/tst.js
@@ -9,4 +9,5 @@ message.soap::[g()];
 
 var e = <?xml version="1.0" encoding="UTF-8"?> <elt>
   <!-- comment -->
+  <![CDATA[ some <cdata> ]]>
   </elt>;
diff --git a/javascript/extractor/tests/e4x/output/trap/tst.js.trap b/javascript/extractor/tests/e4x/output/trap/tst.js.trap
