JS: Parse EJS-style template tags

asgerf · asgerf · commit e678c16d5981 · 2021-08-10T12:15:44.000+02:00
diff --git a/javascript/extractor/src/com/semmle/jcorn/Parser.java b/javascript/extractor/src/com/semmle/jcorn/Parser.java
@@ -618,6 +618,15 @@ private Token readToken_lt_gt(int code) { // '<>'
       this.skipSpace();
       return this.nextToken();
     }
+    if (next == '%' && code == '<' && this.options.allowGeneratedCodeExprs()) {
+      // `<%`, the beginning of an EJS-style template tag
+      size = 2;
+      int nextNext = charAt(this.pos + 2);
+      if (nextNext == '=' || nextNext == '-') {
+        ++size;
+      }
+      return this.finishOp(TokenType.generatedCodeDelimiterEJS, size);
+    }
     if (next == 61) size = 2;
     return this.finishOp(TokenType.relational, size);
   }
@@ -1689,6 +1698,9 @@ protected Expression parseExprAtom(DestructuringErrors refDestructuringErrors) {
       return this.parseNew();
     } else if (this.type == TokenType.backQuote) {
       return this.parseTemplate(false);
+    } else if (this.type == TokenType.generatedCodeDelimiterEJS) {
+      String openingDelimiter = (String) this.value;
+      return this.parseGeneratedCodeExpr(this.startLoc, openingDelimiter, "%>");
     } else {
       this.unexpected();
       return null;
diff --git a/javascript/extractor/src/com/semmle/jcorn/TokenType.java b/javascript/extractor/src/com/semmle/jcorn/TokenType.java
@@ -1,9 +1,10 @@
 package com.semmle.jcorn;
 
-import com.semmle.jcorn.Parser.TokContext;
 import java.util.LinkedHashMap;
 import java.util.Map;
 
+import com.semmle.jcorn.Parser.TokContext;
+
 /// tokentype.js
 
 // ## Token types
@@ -91,6 +92,7 @@ public void updateContext(Parser parser, TokenType prevType) {
       invalidTemplate = new TokenType(new Properties("invalidTemplate")),
       generatedCodeExpr = new TokenType(new Properties("generatedCodeExpr")),
       generatedCodeDelimiter = new TokenType(new Properties("generatedCodeDelimiter")),
+      generatedCodeDelimiterEJS = new TokenType(new Properties("<%/%>")),
       ellipsis = new TokenType(new Properties("...").beforeExpr()),
       backQuote =
           new TokenType(new Properties("`").startsExpr()) {
diff --git a/javascript/extractor/src/com/semmle/jcorn/jsx/JSXParser.java b/javascript/extractor/src/com/semmle/jcorn/jsx/JSXParser.java
@@ -420,8 +420,9 @@ protected Token readToken(int code) {
         && code == 60
         && this.exprAllowed
         &&
-        // avoid getting confused on HTML comments
-        this.charAt(this.pos + 1) != '!') {
+        // avoid getting confused on HTML comments or EJS-style template tags
+        this.charAt(this.pos + 1) != '!' &&
+        this.charAt(this.pos + 1) != '%') {
       ++this.pos;
       return this.finishToken(jsxTagStart);
     }
diff --git a/javascript/extractor/tests/generatedcode/input/ejs.js b/javascript/extractor/tests/generatedcode/input/ejs.js
@@ -0,0 +1,7 @@
+let data1 = <%= user_data1 %>;
+let data2 = <%- user_data2 %>;
+if (<%something%>) {}
+foo(<%bar%>, <%baz%>);
+
+<% generated_code %>
+let string = "<%= not_generated_code %>"; // parse as string literal
diff --git a/javascript/extractor/tests/generatedcode/output/trap/ejs.js.trap b/javascript/extractor/tests/generatedcode/output/trap/ejs.js.trap
