Entities double-encoded in attributes when using libxml2

[singpolyma]

When libstrophe uses libxml2 to parse the stream and an attribute contains a basic XML entity such as & the value given to xmpp_stanza_set_attribute will have the numeric form of the entity in it &#xx; instead of being decoded. As xmpp_stanza_set_attribute assumes you are passing the true value not an encoded value this eventually results in the value &#xx; being passed to the application.

Adding xmlCtxtUseOptions(parser->xmlctx, XML_PARSE_NOENT | XML_PARSE_NONET); fixes this, but there are a lot of scary warnings online about NOENT and I'm not 100% sure that NONET mitigates them all.

[sjaeckel]

Could you maybe create a testcase which shows this?
How does expat behave compared to libxml2?

[singpolyma]

diff --git a/tests/test_stanza.c b/tests/test_stanza.c
index dee9180..5e3a587 100644
--- a/tests/test_stanza.c
+++ b/tests/test_stanza.c
@@ -135,6 +135,26 @@ static void test_stanza_from_string(xmpp_ctx_t *ctx)
     assert(stanza == NULL);
 }
 
+static void test_stanza_with_entity_in_attribute(xmpp_ctx_t *ctx)
+{
+    xmpp_stanza_t *stanza;
+    char *buf;
+    size_t buflen;
+    int ret;
+
+    const char *str = "<anything title=\"Hello &amp; Goodbye\"/>";
+
+    stanza = xmpp_stanza_new_from_string(ctx, str);
+    assert(stanza != NULL);
+    const char *title = xmpp_stanza_get_attribute(stanza, "title");
+    COMPARE("Hello & Goodbye", title);
+    ret = xmpp_stanza_to_text(stanza, &buf, &buflen);
+    assert(ret == XMPP_EOK);
+    COMPARE(str, buf);
+    xmpp_free(ctx, buf);
+    xmpp_stanza_release(stanza);
+}
+
 static void test_stanza_error(xmpp_ctx_t *ctx)
 {
     xmpp_stanza_t *stanza;
@@ -293,6 +313,7 @@ int main()
     test_stanza_copy(ctx);
     test_stanza_add_child(ctx);
     test_stanza_from_string(ctx);
+    test_stanza_with_entity_in_attribute(ctx);
     test_stanza_error(ctx);
 
     xmpp_ctx_free(ctx);

this test passes under expat and fails under libxml2