[4.x] Parse language metadata files without warnings or network access - #65

Summary of Changes

LanguageHelper::parseXmlLanguageFile() loaded the metadata file of a language pack with a plain simplexml_load_file(). Reproduced: a malformed file emits a series of libxml warnings, and a well-formed <metafile> without a <metadata> child makes the foreach over null warn as well ("foreach() argument must be of type array|object").

The method now collects libxml errors internally (restoring the previous libxml_use_internal_errors() setting and clearing the errors afterwards), passes LIBXML_NONET so parsing never touches the network, and returns null for a file without <metadata>. Before, that case returned an empty array, which getMetadata() and parseLanguageFiles() already treated like null. External entities are not expanded by libxml ≥ 2.9 anyway, so this is hardening rather than an XXE fix.

Testing Instructions

New tests/MetadataXmlTest.php with the fixtures tests/data/metadata/broken.xml and no-metadata.xml (new files, so they do not conflict with #59): both return null without warnings, the libxml state is restored, and a valid file is still read. The two malformed-file tests fail without the change in src/LanguageHelper.php; the whole suite passes with it (php vendor/bin/phpunit).

Documentation Changes Required

docs/overview.md: a new paragraph at the end of "Things to know before you build on this" on malformed metadata files.

🤖 Generated with Claude Code