JavaScript: Restrict E4X processing instruction disambiguation to the <?xml ...?> case.

Max Schaefer · Max Schaefer · commit f726125b71b7 · 2019-02-24T20:56:43.000Z
diff --git a/javascript/extractor/src/com/semmle/jcorn/CustomParser.java b/javascript/extractor/src/com/semmle/jcorn/CustomParser.java
@@ -551,11 +551,13 @@ protected Token readToken(int code) {
 		// chunk of E4X content and a Flow type annotation (both can start with `<?`)
 		// hence if we can't find the closing `?>` of a putative XML processing instruction
 		// we backtrack and try lexing as something else
+		// to avoid frequent backtracking, we only consider `<?xml ...?>` processing instructions;
+		// while other processing instructions are technically possible, they are unlikely in practice
 		if (this.options.e4x()) {
 			while (code == '<') {
-				if (charAt(this.pos+1) == '?') {
+				if (inputSubstring(this.pos+1, this.pos+5).equals("?xml")) {
 					int oldPos = this.pos;
-					this.pos += 2;
+					this.pos += 5;
 					if (!jsx_readUntil("?>")) {
 						// didn't find a closing `?>`, so backtrack
 						this.pos = oldPos;
