oxc-project__oxc/tasks/coverage/misc/fail/html-comment-in-module.mjs at codex/parser-grouped-expression-allocation - oxc-project__oxc - GetSkill.work

skills/oxc-project__oxc

mirror of https://github.com/oxc-project/oxc.git synced 2026-09-14 19:36:11 +08:00

Files

T

Boshen aed3669a02 fix(parser): parse HTML-like comments in unambiguous mode (#18442 )

## Summary

Closes #18392

Support HTML-like comments (`<!--` and `-->`) per ECMAScript Annex B.1.1:

- **Script/CommonJS mode**: HTML comments recognized as single-line comments
- **Unambiguous mode (.js)**: HTML comments recognized; error deferred until ESM syntax detected
- **Module mode (.mjs)**: HTML comments at start of line emit "HTML comments are not allowed in modules" error; `<!--` in middle of expression (e.g. `foo <!--bar`) parses as operators

This enables proper detection of HTML comment injection vectors in security tools like [AikidoSec/zen-internals](https://github.com/AikidoSec/zen-internals/pull/125).

🤖 Generated with [Claude Code](https://claude.ai/code)

2026-01-23 11:35:33 +00:00

2 lines

13 B

JavaScript

Raw Permalink Blame History

<!-- comment