The attached program demonstrates that the ContentHandler.skippedEntity
callback is not invoked for all skipped entities.  Specifically, it is
not invoked for those in attribute values.  Additionally, it
demonstrates that when parsing a document with no DOCTYPE, skippedEntity
is not called at all; instead the parser raises an exception about an
"undefined entity".

After further investigation, I've learned a bit more.  External entities
are forbidden in attribute values.  Their presence constitutes a "fatal
error" according to <http://www.w3.org/TR/REC-xml/#forbidden>.  This
means that dropping entities in an attribute value is incorrect. 
Instead the fatal error hook must be called.

Neither the title nor your two posts identify the module you think needs
to be changed.  Changing the title to include that might better get
attention from someone who is familiar with that module and could deal
with the request.

Hi,

There are two issues commented in this bug, both are part of libexpat.
The one related the code inconsistency is due the design of Xml_Parser.

Reading Modules/expat/xmlparse.c:5036
        else if (!entity) {
          /* Cannot report skipped entity here - see comments on
             skippedEntityHandler.
          if (skippedEntityHandler)
            skippedEntityHandler(handlerArg, name, 0);
          */
          /* Cannot call the default handler because this would be
             out of sync with the call to the startElementHandler.
          if ((pool == &tempPool) && defaultHandler)
            reportDefault(parser, enc, ptr, next);
          */
          break;
        }

That's so because libexpat startElementHandler should be called before the skippedEntityHandler, but this piece of code is processed before the call to startElementHandler.
To fix this, it would require a change in the libexpat API, adding the concept of futures to the attributes processing, and a way to obtain them with an iterator.
In any case, I don't think this is a python issue, but a known libexpat limitation. It might be forwarded to libexpat developers, but from the python point of view, it should be closed.

The second issue, is not really an issue. It's the default behaviour if an entity reference is found but there is no dtd specified (the entities declaration is a xml extension). This part is working as intended.