{"record":{"id":"77346bbf9fa7ba77","repo":"apache/maven","slug":"entities-are-not-supported-in-strict-mode-77346b","errorCode":null,"errorMessage":"Entities are not supported in strict mode","messagePattern":"Entities are not supported in strict mode","errorType":"exception","errorClass":"XMLStreamException","httpStatus":null,"severity":"error","filePath":"src/mdo/reader.vm","lineNumber":1092,"sourceCode":"                    return next;\n            }\n        }\n    } //-- int nextTag(XMLStreamReader)\n\n    private String nextText(XMLStreamReader parser, boolean strict) throws XMLStreamException {\n        int eventType = parser.getEventType();\n        if (eventType != XMLStreamReader.START_ELEMENT) {\n            throw new XMLStreamException(\"parser must be on START_ELEMENT to read next text\", parser.getLocation(), null);\n        }\n        eventType = parser.next();\n        StringBuilder result = new StringBuilder();\n        while (true) {\n            if (eventType == XMLStreamReader.CHARACTERS || eventType == XMLStreamReader.CDATA) {\n                result.append(parser.getText());\n            } else if (eventType == XMLStreamReader.ENTITY_REFERENCE) {\n                String val = null;\n                if (strict) {\n                    throw new XMLStreamException(\"Entities are not supported in strict mode\", parser.getLocation(), null);\n                } else if (addDefaultEntities) {\n                    val = DEFAULT_ENTITIES.get(parser.getLocalName());\n                }\n                if (val != null) {\n                    result.append(val);\n                } else {\n                    result.append(\"&\").append(parser.getLocalName()).append(\";\");\n                }\n            } else if (eventType != XMLStreamReader.COMMENT) {\n                break;\n            }\n            eventType = parser.next();\n        }\n        if (eventType != XMLStreamReader.END_ELEMENT) {\n            throw new XMLStreamException(\n                    \"TEXT must be immediately followed by END_ELEMENT and not \" + eventType /*TODO: TYPES[eventType]*/, parser.getLocation(), null);\n        }\n        return result.toString();","sourceCodeStart":1074,"sourceCodeEnd":1110,"githubUrl":"https://github.com/apache/maven/blob/e4093d4e120eac99d6bdce5ba67cace2f3085c97/src/mdo/reader.vm#L1074-L1110","documentation":"The Modello-generated reader's nextText helper (src/mdo/reader.vm) encounters an ENTITY_REFERENCE event while reading element text and the reader is in strict mode. Only the five default XML entities are tolerated when addDefaultEntities is enabled; any other entity reference (e.g. &nbsp;, &copy;, custom DTD entities) causes javax.xml.stream.XMLStreamException 'Entities are not supported in strict mode'. Non-strict mode substitutes known default entities or keeps the raw &name; text.","triggerScenarios":"Reading a POM or metadata file containing HTML-style entities such as &nbsp; or &eacute; in description/name elements with a strict reader. Note that standard predefined entities like &amp; and &lt; are resolved by the parser itself and do not trigger this; only entity references the parser reports as events (typically with a DTD or non-standard entities) do.","commonSituations":"Documentation text copied from HTML into <description>/<name> in pom.xml; files processed by tools that convert UTF-8 characters to named entities; custom entities defined via DOCTYPE in model files.","solutions":["Replace named HTML entities in the XML with their literal UTF-8 characters or numeric references (&#160;).","Remove any DOCTYPE/entity declarations from the model file.","Read with strict=false (and addDefaultEntities enabled) if you must accept entity-laden documents.","Sanitize upstream documentation before it is written into model XML."],"exampleFix":"<!-- before -->\n<description>Use&nbsp;this plugin</description>\n<!-- after -->\n<description>Use&#160;this plugin</description>","handlingStrategy":"validation","validationCode":"static final Pattern NAMED_ENTITY = Pattern.compile(\"&[a-zA-Z][a-zA-Z0-9]*;\");\nstatic final Set<String> DEFAULTS = Set.of(\"amp\", \"lt\", \"gt\", \"quot\", \"apos\");\nboolean hasNonDefaultEntities(String xml) {\n    Matcher m = NAMED_ENTITY.matcher(xml);\n    while (m.find()) if (!DEFAULTS.contains(m.group().substring(1, m.group().length() - 1))) return true;\n    return false;\n}","typeGuard":null,"tryCatchPattern":"try {\n    reader.read(in, true);\n} catch (XMLStreamException e) {\n    if (e.getMessage().contains(\"Entities are not supported\")) { // replace with numeric refs and retry\n        String fixed = NAMED_ENTITY.matcher(raw).replaceAll(m -> numericRefFor(m.group()));\n        model = reader.read(new StringReader(fixed), true);\n    }\n}","preventionTips":["Use UTF-8 characters or numeric character references in POM/model text.","Strip DOCTYPE declarations from machine-generated model files.","Sanitize HTML-sourced descriptions before embedding in XML."],"tags":["xml","stax","modello","entities","strict-parsing"],"backgroundTag":"unsupported-xml-entities","analyzedSha":"e4093d4e120eac99d6bdce5ba67cace2f3085c97","analyzedAt":"2026-08-21T22:58:24.034Z","schemaVersion":2},"datasetVersion":"2026-08-21T23:17:16.201Z"}