codehaus-plexus
diff --git a/‎pom.xml
Copy file name to clipboardExpand all lines: pom.xml
+6Lines changed: 6 additions & 0 deletions b/‎pom.xml
Copy file name to clipboardExpand all lines: pom.xml
+6Lines changed: 6 additions & 0 deletions
diff --git a/‎src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
Copy file name to clipboardExpand all lines: src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
+4-2Lines changed: 4 additions & 2 deletions b/‎src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
Copy file name to clipboardExpand all lines: src/main/java/org/codehaus/plexus/util/xml/pull/MXParser.java
+4-2Lines changed: 4 additions & 2 deletions
diff --git a/‎src/test/java/org/codehaus/plexus/util/xml/pull/MXParserTest.java
Copy file name to clipboardExpand all lines: src/test/java/org/codehaus/plexus/util/xml/pull/MXParserTest.java
+22Lines changed: 22 additions & 0 deletions b/‎src/test/java/org/codehaus/plexus/util/xml/pull/MXParserTest.java
Copy file name to clipboardExpand all lines: src/test/java/org/codehaus/plexus/util/xml/pull/MXParserTest.java
+22Lines changed: 22 additions & 0 deletions
@@ -76,6 +76,12 @@ limitations under the License.
       <version>5.9.2</version>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.hamcrest</groupId>
+      <artifactId>hamcrest</artifactId>
+      <version>2.2</version>
+      <scope>test</scope>
+    </dependency>
   </dependencies>
 
   <build>
 
@@ -2528,9 +2528,11 @@ private void parsePI() throws XmlPullParserException, IOException {
                             if ((buf[piTargetStart] == 'x' || buf[piTargetStart] == 'X')
                                     && (buf[piTargetStart + 1] == 'm' || buf[piTargetStart + 1] == 'M')
                                     && (buf[piTargetStart + 2] == 'l' || buf[piTargetStart + 2] == 'L')) {
-                                if (piTargetStart > 3) { // <?xml is allowed as first characters in input ...
+                                if (piTargetStart > 2) { // <?xml is allowed as first characters in input ...
                                     throw new XmlPullParserException(
-                                            "processing instruction can not have PITarget with reserved xml name",
+                                            eventType == 0
+                                                    ? "XMLDecl is only allowed as first characters in input"
+                                                    : "processing instruction can not have PITarget with reserved xml name",
                                             this,
                                             null);
                                 } else {
 
@@ -30,7 +30,11 @@
 import org.codehaus.plexus.util.IOUtil;
 import org.codehaus.plexus.util.xml.XmlStreamReader;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
 
+import static org.hamcrest.MatcherAssert.*;
+import static org.hamcrest.Matchers.*;
 import static org.junit.jupiter.api.Assertions.*;
 
 /**
@@ -1473,4 +1477,22 @@ public void testProcessingInstructionTokenizeAfterXMLDeclAndBeforeFirstTag() thr
         assertEquals(XmlPullParser.END_TAG, parser.nextToken());
         assertEquals(XmlPullParser.END_DOCUMENT, parser.nextToken());
     }
+
+    @ParameterizedTest
+    @ValueSource(strings = {" ", "\n", "\r", "\r\n", "  ", "\n "})
+    void testBlankAtBeginning(String ws) throws XmlPullParserException, IOException {
+        String xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?><test>nnn</test>";
+
+        MXParser parser = new MXParser();
+        parser.setInput(new StringReader(ws + xml));
+        assertThat(
+                assertThrows(XmlPullParserException.class, parser::next).getMessage(),
+                containsString("XMLDecl is only allowed as first characters in input"));
+
+        parser.setInput(new StringReader(ws + xml));
+        assertEquals(XmlPullParser.IGNORABLE_WHITESPACE, parser.nextToken());
+        assertThat(
+                assertThrows(XmlPullParserException.class, parser::nextToken).getMessage(),
+                containsString("processing instruction can not have PITarget with reserved xml name"));
+    }
 }