Prevent errors, because of incorrect scope, in the XMLParserBase._resolveEntities method (issue 10407)

[Snuffleupagus]

Now with a unit-test, courtesy of #10408 (comment).

Fixes #10407.

[timvandermeij]

I looked into this and managed to create a unit test:

+  it('should resolve entities correctly (issue 10407)', function() {
+    const data = '<x:xmpmeta xmlns:x=\'adobe:ns:meta/\'>' +
+      '<rdf:RDF xmlns:rdf=\'http://www.w3.org/1999/02/22-rdf-syntax-ns#\'>' +
+      '<rdf:Description xmlns:dc=\'http://purl.org/dc/elements/1.1/\'>' +
+      '<dc:title><rdf:Alt><rdf:li xml:lang="x-default">&apos;Foo bar baz&apos;</rdf:li>' +
+      '</rdf:Alt></dc:title></rdf:Description></rdf:RDF></x:xmpmeta>';
+    const metadata = new Metadata(data);
+
+    expect(metadata.has('dc:title')).toBeTruthy();
+    expect(metadata.has('dc:qux')).toBeFalsy();
+
+    expect(metadata.get('dc:title')).toEqual('\'Foo bar baz\'');
+    expect(metadata.get('dc:qux')).toEqual(null);
+
+    expect(metadata.getAll()).toEqual({ 'dc:title': '\'Foo bar baz\'', });
+  });

It's equal to the first unit test in the file with the title now containing ', which needs to be resolved. I confirmed that this breaks without your fix and works with your fix, but please check as well and if it works, let's add it in this PR.

[dhollenbeck]

Sorry about not providing a test pdf on the original issue. However, I would like to provide one now.
issue-10407.pdf

I was able to reproduce a test case PDF file with all of the sensitive data striped out by using the following steps:

• pdftk ./source.pdf burst
• qpdf.exe pg_0001.pdf --pages qpdf-manual.pdf 1 -- out.pdf

[timvandermeij]

Thank you for providing this, @dhollenbeck! It will definitely help us to verify the fix with the actual bad metadata.

[Snuffleupagus]

/botio test

[pdfjsbot]

From: Bot.io (Linux m4)

---

Received

Command cmd_test from @Snuffleupagus received. Current queue size: 0

Live output at: http://54.67.70.0:8877/aa696ea48a2f450/output.txt

[pdfjsbot]

From: Bot.io (Windows)

---

Received

Command cmd_test from @Snuffleupagus received. Current queue size: 0

Live output at: http://54.215.176.217:8877/7b2b43618af4d28/output.txt

[pdfjsbot]

From: Bot.io (Linux m4)

---

Success

Full output at http://54.67.70.0:8877/aa696ea48a2f450/output.txt

Total script time: 17.59 mins

• Font tests: Passed
• Unit tests: Passed
• Regression tests: Passed

[pdfjsbot]

From: Bot.io (Windows)

---

Success

Full output at http://54.215.176.217:8877/7b2b43618af4d28/output.txt

Total script time: 23.37 mins

• Font tests: Passed
• Unit tests: Passed
• Regression tests: Passed

[timvandermeij]

Nice work!