xml.sax: the content of an external entity is not checked to be well-formed

Bug report

The parsing of an external entity is never finalized, so errors which are only detected at the end of the input are not reported. An external entity whose content is not well-formed is silently accepted.

import io, xml.sax
from xml.sax.handler import feature_external_ges
from xml.sax.xmlreader import InputSource

class Resolver:
    def resolveEntity(self, pubid, sysid):
        source = InputSource()
        source.setByteStream(io.BytesIO(b'<entity>'))   # no end tag
        return source

parser = xml.sax.make_parser()
parser.setFeature(feature_external_ges, True)
parser.setEntityResolver(Resolver())
parser.feed('<!DOCTYPE d [<!ENTITY e SYSTEM "x">]><d>&e;</d>')
parser.close()   # no error

ExpatParser.close() returns early when _entity_stack is not empty, so feed(b"", isFinal=True) is never called for the parser created for the entity. The check is needed to not end the document while the entity is being parsed, but it also skips finalizing the entity itself.

If the parser of the entity is finalized, the example above fails with "error in processing external entity reference", and test_sax still passes.

Errors which Expat detects while feeding data, like a mismatched tag, are reported even now. Only errors detected at the end of the input, like an unclosed element, are lost.

Linked PRs

• gh-156828

從 ExpatParser.close() 和報告中描述的外部實體解析器路徑開始；使用提供的重現程式確認缺少最終化處理。執行 test_sax，並驗證格式錯誤的外部實體會引發報告中的錯誤，同時現有測試仍然通過。