Boshen aed3669a02 fix(parser): parse HTML-like comments in unambiguous mode (#18442) ...

## Summary

Closes #18392

Support HTML-like comments (`<!--` and `-->`) per ECMAScript Annex B.1.1:

- **Script/CommonJS mode**: HTML comments recognized as single-line comments
- **Unambiguous mode (.js)**: HTML comments recognized; error deferred until ESM syntax detected
- **Module mode (.mjs)**: HTML comments at start of line emit "HTML comments are not allowed in modules" error; `<!--` in middle of expression (e.g. `foo <!--bar`) parses as operators

This enables proper detection of HTML comment injection vectors in security tools like [AikidoSec/zen-internals](https://github.com/AikidoSec/zen-internals/pull/125).

🤖 Generated with [Claude Code](https://claude.ai/code)

2026-01-23 11:35:33 +00:00

13 B

Raw Permalink Blame History

View Raw