Uncancellable infinite loop in xpath() with entity references

Hi

While investigating an interrupt issue with libxml2 queries I found a
query that cannot be cancelled and runs indefinitely. While inside
libxml2, a backend ignores cancel, statement_timeout and
pg_terminate_backend(), so the only way I found was a kill -9 and a
cluster restart.

psql (20devel)
Type "help" for help.

postgres=# SELECT xpath('/r/text()/following::comment()',
'<!DOCTYPE r [<!ENTITY e "y">]><r>u&e;</r>');
^CCancel request sent
^CCancel request sent
^CCancel request sent

Most likely a bug in libxml2 (xmlXPathNextFollowing) -- I will
investigate that and report.

It only happens because xpath_internal() and XmlTableSetDocument() parse
without XML_PARSE_NOENT, so entity references stay in the tree.
xml_parse() does use it:

...
options = XML_PARSE_NOENT | XML_PARSE_DTDATTR
| (preserve_whitespace ? 0 : XML_PARSE_NOBLANKS);

As a result,xpath() evaluates a different document than the rest of the
xml code sees:

psql (20devel)
Type "help" for help.

postgres=# select xmlserialize(document '<!DOCTYPE r [<!ENTITY e
"<b>z</b>">]><r>&e;&e;</r>'::xml as text indent);
xmlserialize
------------------------
<!DOCTYPE r [ +
<!ENTITY e "<b>z</b>">+
]> +
<r> +
<b>z</b> +
<b>z</b> +
</r>
(1 row)

postgres=# select xpath('count(//b)', '<!DOCTYPE r [<!ENTITY e
"<b>z</b>">]><r>&e;&e;</r>');
xpath
-------
{0}
(1 row)

postgres=# with t (x) as (
select xmlserialize(document '<!DOCTYPE r [<!ENTITY e
"<b>z</b>">]><r>&e;&e;</r>'::xml as text indent)
)
select xpath('count(//b)', x::xml) from t;
xpath
-------
{2}
(1 row)

BTW, the deprecated xml2 parses with XML_PARSE_NOENT .

The attached patch adds XML_PARSE_NOENT to both calls (+ some tests).
That fixes the endless loop and makes xpath(), xmlexists() and XMLTABLE
see entity content.

psql (20devel)
Type "help" for help.

postgres=# SELECT xpath('/r/text()/following::comment()',
'<!DOCTYPE r [<!ENTITY e "y">]><r>u&e;</r>');
xpath
-------
{}
(1 row)

postgres=# select xpath('count(//b)', '<!DOCTYPE r [<!ENTITY e
"<b>z</b>">]><r>&e;&e;</r>');
xpath
-------
{2}
(1 row)

This changes results for documents that use entity references, but it's
arguably an improvement, e.g.

-- master

postgres=# select xpath('/r/text()', '<!DOCTYPE r [<!ENTITY e
"y">]><r>u&e;</r>');
xpath
-------
{u}
(1 row)

-- patched

postgres=# select xpath('/r/text()', '<!DOCTYPE r [<!ENTITY e
"y">]><r>u&e;</r>');
xpath
-------
{uy}
(1 row)

Documents without entity references are not affected.

WDYT?

Best, Jim