fix(validator): prevent XML validator hang on recursive DTD entity expansion

[MD-Mushfiqur123]

Problem

The XML validator hangs indefinitely when parsing a file with recursive DTD entity definitions. The helium parser expands entities without depth or size limits, and ValidateSyntax() passes context.Background() with no timeout.

Any XML file with entities that reference other entities causes unbounded CPU usage — the process pins a core and never returns.

Root Cause

ctx := context.Background()
_, err := helium.NewParser().ValidateDTD(true).Parse(ctx, b)

context.Background() never expires, so there is nothing to abort the parse.

Fix

Wrap the parse call in a context with a 10-second timeout:

ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
defer cancel()
_, err := helium.NewParser().ValidateDTD(true).Parse(ctx, b)

This preserves DTD validation for normal files while preventing the hang. If the timeout fires, the parser returns a context.DeadlineExceeded error which is propagated as a validation failure.

Testing

• All existing validator tests pass
• Manual verification: a crafted XML file with recursive entities now returns a timeout error instead of hanging

Fixes #503

[kehoecj]

Please add a regression test. A minimal recursive entity is enough to prove the parser doesn't hang. Something like:

func Test_XMLRecursiveEntityDoesNotHang(t *testing.T) {
    recursive := []byte(`<?xml version="1.0"?>
    <!DOCTYPE foo [
    <!ENTITY a "&b;">
    <!ENTITY b "&a;">
    ]>
    <foo>&a;</foo>`)
 
    valid, err := XMLValidator{}.ValidateSyntax(recursive)
    require.False(t, valid)
    require.Error(t, err)
}

[kehoecj]

Please also add the same timeout to ValidateXSD — it has the same context.Background() pattern and the same risk:

func ValidateXSD(b []byte, schemaPath string) (bool, error) {
    ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
    defer cancel()
    ....

[kehoecj]

@MD-Mushfiqur123 Need to address this

[MD-Mushfiqur123]

@kehoecj regression test added — Test_XMLRecursiveEntityDoesNotHang verifies the parser returns an error on recursive entity declarations instead of hanging.

[MD-Mushfiqur123]

@kehoecj the regression test has been added — Test_XMLRecursiveEntityDoesNotHang verifies the parser returns an error on recursive entity declarations instead of hanging. Could you take another look?

[MD-Mushfiqur123]

All CI checks are passing and the PR is mergeable. @kehoecj could you take another look when you have a moment?

[kehoecj]

Hey @MD-Mushfiqur123 - just need this comment addressed and you're good to go: https://github.com/Boeing/config-file-validator/pull/509/changes#r3311052915