xml.sax: the content of an external entity is not checked to be well-formed

Bug report

The parsing of an external entity is never finalized, so errors which are only detected at the end of the input are not reported. An external entity whose content is not well-formed is silently accepted.

import io, xml.sax
from xml.sax.handler import feature_external_ges
from xml.sax.xmlreader import InputSource

class Resolver:
    def resolveEntity(self, pubid, sysid):
        source = InputSource()
        source.setByteStream(io.BytesIO(b'<entity>'))   # no end tag
        return source

parser = xml.sax.make_parser()
parser.setFeature(feature_external_ges, True)
parser.setEntityResolver(Resolver())
parser.feed('<!DOCTYPE d [<!ENTITY e SYSTEM "x">]><d>&e;</d>')
parser.close()   # no error

ExpatParser.close() returns early when _entity_stack is not empty, so feed(b"", isFinal=True) is never called for the parser created for the entity. The check is needed to not end the document while the entity is being parsed, but it also skips finalizing the entity itself.

If the parser of the entity is finalized, the example above fails with "error in processing external entity reference", and test_sax still passes.

Errors which Expat detects while feeding data, like a mismatched tag, are reported even now. Only errors detected at the end of the input, like an unclosed element, are lost.

Linked PRs

• gh-156828

Commencez par ExpatParser.close() et le chemin de l’analyseur d’entités externes décrit dans le rapport ; utilisez le reproducteur fourni pour confirmer la finalisation manquante. Exécutez test_sax et vérifiez que les entités externes malformées lèvent l’erreur signalée, tandis que les tests existants réussissent toujours.