classification
Title: xml.sax.expatreader.ExpatParser incorrectly silently skips external character entities in attribute values
Type: Stage:
Components: Library (Lib) Versions:
process
Status: open Resolution:
Dependencies: Superseder:
Assigned To: Nosy List: exarkun, terry.reedy
Priority: normal Keywords:

Created on 2009-01-15 22:34 by exarkun, last changed 2009-01-17 15:42 by exarkun.

Files
File name Uploaded Description Edit
entity-skipped-in-attribute-value.py exarkun, 2009-01-15 22:34
Messages (3)
msg79920 - (view) Author: Jean-Paul Calderone (exarkun) * (Python committer) Date: 2009-01-15 22:34
The attached program demonstrates that the ContentHandler.skippedEntity
callback is not invoked for all skipped entities.  Specifically, it is
not invoked for those in attribute values.  Additionally, it
demonstrates that when parsing a document with no DOCTYPE, skippedEntity
is not called at all; instead the parser raises an exception about an
"undefined entity".
msg79960 - (view) Author: Jean-Paul Calderone (exarkun) * (Python committer) Date: 2009-01-16 16:39
After further investigation, I've learned a bit more.  External entities
are forbidden in attribute values.  Their presence constitutes a "fatal
error" according to <http://www.w3.org/TR/REC-xml/#forbidden>.  This
means that dropping entities in an attribute value is incorrect. 
Instead the fatal error hook must be called.
msg80006 - (view) Author: Terry J. Reedy (terry.reedy) * (Python committer) Date: 2009-01-17 08:00
Neither the title nor your two posts identify the module you think needs
to be changed.  Changing the title to include that might better get
attention from someone who is familiar with that module and could deal
with the request.
History
Date User Action Args
2009-01-17 15:42:31exarkunsettitle: inconsistent, perhaps incorrect, behavior with respect to entities parsed by xml.sax -> xml.sax.expatreader.ExpatParser incorrectly silently skips external character entities in attribute values
2009-01-17 08:00:43terry.reedysetnosy: + terry.reedy
messages: + msg80006
2009-01-16 16:39:41exarkunsetmessages: + msg79960
2009-01-15 22:34:30exarkuncreate