xml.sax: the content of an external entity is not checked to be well-formed

Bug report

The parsing of an external entity is never finalized, so errors which are only detected at the end of the input are not reported. An external entity whose content is not well-formed is silently accepted.

import io, xml.sax
from xml.sax.handler import feature_external_ges
from xml.sax.xmlreader import InputSource

class Resolver:
    def resolveEntity(self, pubid, sysid):
        source = InputSource()
        source.setByteStream(io.BytesIO(b'<entity>'))   # no end tag
        return source

parser = xml.sax.make_parser()
parser.setFeature(feature_external_ges, True)
parser.setEntityResolver(Resolver())
parser.feed('<!DOCTYPE d [<!ENTITY e SYSTEM "x">]><d>&e;</d>')
parser.close()   # no error

ExpatParser.close() returns early when _entity_stack is not empty, so feed(b"", isFinal=True) is never called for the parser created for the entity. The check is needed to not end the document while the entity is being parsed, but it also skips finalizing the entity itself.

If the parser of the entity is finalized, the example above fails with "error in processing external entity reference", and test_sax still passes.

Errors which Expat detects while feeding data, like a mismatched tag, are reported even now. Only errors detected at the end of the input, like an unclosed element, are lost.

Linked PRs

• gh-156828

Beginne bei ExpatParser.close() und dem im Bericht beschriebenen Parserpfad für externe Entitäten; verwende den bereitgestellten Reproduzierer, um die fehlende Finalisierung zu bestätigen. Führe test_sax aus und überprüfe, dass fehlerhafte externe Entitäten den gemeldeten Fehler auslösen, während bestehende Tests weiterhin erfolgreich sind.