From d53ba0588ef03c910d8956cbfec8a640e528059d Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Sat, 23 Aug 2025 14:59:50 +0200
Subject: [PATCH] valid: Don't add ids when validating entity content

The id table shouldn't reference ids in entities. The id will be created
when expanding the entity.

Probably regressed with d025cfbb.

Note that we still register ids in entities if entities are not
replaced. This is required to make IDREF checks work.

Fixes #974.
---
 SAX2.c                   | 22 ++++++++++++++++++++++
 include/private/parser.h |  4 ++++
 valid.c                  |  3 ++-
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/SAX2.c b/SAX2.c
index 8e6ba6c7c..17c8e0e2e 100644
--- a/SAX2.c
+++ b/SAX2.c
@@ -1190,8 +1190,19 @@ xmlSAX1Attribute(xmlParserCtxtPtr ctxt, const xmlChar *fullname,
                 xmlFree(val);
 	    }
 	} else {
+            /*
+             * When replacing entities, make sure that IDs in
+             * entities aren't registered. This also shouldn't be
+             * done when entities aren't replaced, but this would
+             * require to rework IDREF checks.
+             */
+            if (ctxt->input->entity != NULL)
+                ctxt->vctxt.flags |= XML_VCTXT_IN_ENTITY;
+
 	    ctxt->valid &= xmlValidateOneAttribute(&ctxt->vctxt, ctxt->myDoc,
 					       ctxt->node, ret, value);
+
+            ctxt->vctxt.flags &= ~XML_VCTXT_IN_ENTITY;
 	}
     } else
 #endif /* LIBXML_VALID_ENABLED */
@@ -2057,8 +2068,19 @@ xmlSAX2AttributeNs(xmlParserCtxtPtr ctxt,
             if (dup == NULL)
                 xmlSAX2ErrMemory(ctxt);
 
+            /*
+             * When replacing entities, make sure that IDs in
+             * entities aren't registered. This also shouldn't be
+             * done when entities aren't replaced, but this would
+             * require to rework IDREF checks.
+             */
+            if (ctxt->input->entity != NULL)
+                ctxt->vctxt.flags |= XML_VCTXT_IN_ENTITY;
+
 	    ctxt->valid &= xmlValidateOneAttribute(&ctxt->vctxt,
 	                             ctxt->myDoc, ctxt->node, ret, dup);
+
+            ctxt->vctxt.flags &= ~XML_VCTXT_IN_ENTITY;
 	}
     } else
 #endif /* LIBXML_VALID_ENABLED */
diff --git a/include/private/parser.h b/include/private/parser.h
index a1c3d04a5..7066118ad 100644
--- a/include/private/parser.h
+++ b/include/private/parser.h
@@ -22,6 +22,10 @@
  * Set if the validation is enabled.
  */
 #define XML_VCTXT_VALIDATE (1u << 2)
+/**
+ * Set when parsing entities.
+ */
+#define XML_VCTXT_IN_ENTITY (1u << 3)
 
 /*
  * TODO: Rename to avoid confusion with xmlParserInputFlags
diff --git a/valid.c b/valid.c
index 30a29d715..f7c3b33e3 100644
--- a/valid.c
+++ b/valid.c
@@ -3962,7 +3962,8 @@ xmlValidateOneAttribute(xmlValidCtxt *ctxt, xmlDoc *doc,
     }
 
     /* Validity Constraint: ID uniqueness */
-    if (attrDecl->atype == XML_ATTRIBUTE_ID) {
+    if (attrDecl->atype == XML_ATTRIBUTE_ID &&
+        (ctxt->flags & XML_VCTXT_IN_ENTITY) == 0) {
         if (xmlAddID(ctxt, doc, value, attr) == NULL)
 	    ret = 0;
     }