gh-156796: Finalize the parser of an external entity in xml.sax

ExpatParser.close() returned early whenever _entity_stack was not empty,
so feed(b"", isFinal=True) was never called for the parser created by
external_entity_ref(). Expat therefore never checked the entity's input
for completeness, and an external entity whose content is not well-formed
was silently accepted. Errors expat detects while feeding data, such as a
mismatched tag, were still reported; only those detectable at the end of
the input, such as an unclosed element, were lost.

Finalize the entity's parser in that case, while still leaving the
document open, since the enclosing parse is what the early return was
there to protect.

Author: skdas20

Lib/test/test_sax.py

@@ -1039,6 +1039,26 @@ def test_expat_entityresolver_enabled(self):
         self.assertEqual(result.getvalue(), start +
                          b"<doc><entity></entity></doc>")
 
+    def test_expat_entityresolver_not_well_formed(self):
+        # gh-156796: the parser of an external entity was never finalized,
+        # so errors only detectable at the end of its input, such as an
+        # unclosed element, were silently ignored.
+        class NotWellFormedEntityResolver:
+            def resolveEntity(self, publicId, systemId):
+                inpsrc = InputSource()
+                inpsrc.setByteStream(BytesIO(b"<entity>"))
+                return inpsrc
+
+        parser = create_parser()
+        parser.setFeature(feature_external_ges, True)
+        parser.setEntityResolver(NotWellFormedEntityResolver())
+        parser.setContentHandler(XMLGenerator(BytesIO()))
+
+        with self.assertRaises(SAXParseException):
+            parser.feed('<!DOCTYPE doc [<!ENTITY test SYSTEM "whatever">]>'
+                        '<doc>&test;</doc>')
+            parser.close()
+
     def test_expat_entityresolver_default(self):
         parser = create_parser()
         self.assertEqual(parser.getFeature(feature_external_ges), False)

Lib/xml/sax/expatreader.py

@@ -238,9 +238,14 @@ def _close_source(self):
                 file.close()
 
     def close(self):
-        if (self._entity_stack or self._parser is None or
-            isinstance(self._parser, _ClosedParser)):
-            # If we are completing an external entity, do nothing here
+        if self._parser is None or isinstance(self._parser, _ClosedParser):
+            return
+        if self._entity_stack:
+            # We are completing an external entity.  Finalize its parser so
+            # that errors which are only detectable at the end of the input,
+            # such as an unclosed element, are reported, but do not end the
+            # document: the enclosing parse is still in progress.
+            self.feed(b"", isFinal=True)
             return
         try:
             self.feed(b"", isFinal=True)

Misc/NEWS.d/next/Library/2026-09-02-00-00-00.gh-issue-156796.k7Qw2P.rst

@@ -0,0 +1,4 @@
+Fix :mod:`xml.sax` not reporting an external entity whose content is not
+well-formed. The parser created for the entity was never finalized, so errors
+which are only detectable at the end of its input, such as an unclosed
+element, were silently ignored.