Unparseable vulnerable pattern

[davisjam]

The following pattern is vulnerable.
I found it in marked (in that discussion it is a more complex version of "n.2" which the detector does catch).

 /^<!--[\s\S]*?-->|^<\/?[a-zA-Z0-9\-]+(?:"[^"]*"|'[^']*'|\s[^<'">\/]*)*?\/?>/

It can be exploited with prefix <tag pump \t\t"" suffix <"\t/>a'a.

However, the detector says 'SKIPPED'. Not sure why.

$ java -cp 'weideman-RegexStaticAnalysis/bin:lib/gson-2.8.2.jar' driver.Main -i /tmp/query.regex --test-eda-exploit-string=false --ida=true --timeout=0 --full --ida=true 2>&1
---Interface settings:---
Input type:			FILE_INPUT
Is Verbose:			true
---Analysis settings:---
NFA Construction:		JAVA
Preprocessing type:		NONE
Epsilon loop removal:		FLATTENING
Priority removal:		UNPRIORITISE
Testing for IDA:		true
Construct EDA exploit strings:	true
Testing EDA exploit strings:	false
Construct IDA exploit strings:	true
Timeout:			DISABLED
------------------------
1. pattern = "^<!--[\s\S]*?-->|^<\/?[a-zA-Z0-9\-]+(?:"[^"]*"|'[^']*'|\s[^<'">\/\s]*)*?\/?>"
SKIPPED
Analysed:	0/1
	Safe:		0/1
	Vulnerable:	0/1
		EDA:		0/1
		IDA:		0/1
	Vulnerable EDA:	[]
	Vulnerable IDA:	[]
Skipped:	1/1
Timeout:	0/1
		EDA:	0/1
		IDA:	0/1
Total running time: 8

[davisjam]

Perhaps the issue is the use of '^...|^...', which is an unusual construction?

[davisjam]

Confirmed. This pattern is detected as vulnerable.

/<!--[\s\S]*?-->|<\/?[a-zA-Z0-9\-]+(?:"[^"]*"|'[^']*'|\s[^<'">\/]*)*?\/?>/

(note there is now no '^' leading the disjunctions).

Is the '^...|^...' construction legal in Java?