.gitignore

 /build
+/out
 /.gradle
 /gradle.properties
 /.idea/workspace.xml

build.gradle

-apply plugin: 'java'
+apply plugin: 'java-library'
 apply plugin: 'jacoco'
-apply plugin: 'maven'
+apply plugin: 'maven-publish'
 apply plugin: 'signing'
 
 group = 'org.dom4j'
@@ -19,20 +19,16 @@ repositories {
 
 dependencies {
 
-	compile(
+    implementation(
             'jaxen:jaxen:1.1.6',
-	)
-
-	compileOnly(
             'javax.xml.stream:stax-api:1.0-2',
             'net.java.dev.msv:xsdlib:2013.6.1',
-			'xpp3:xpp3:1.1.4c',
-			'pull-parser:pull-parser:2',
             'javax.xml.bind:jaxb-api:2.2.12',
+            'pull-parser:pull-parser:2',
+            'xpp3:xpp3:1.1.4c',
     )
 
-
-	testCompile(
+    testImplementation(
             'org.testng:testng:6.8.21',
 
             'xerces:xercesImpl:2.11.0',
@@ -57,9 +53,50 @@ task javadocJar(type: Jar, dependsOn: javadoc) {
     from javadoc.destinationDir
 }
 
-artifacts {
-	archives sourcesJar
-	archives javadocJar
+publishing {
+    publications {
+        mavenJava(MavenPublication) {
+            from components.java
+
+            artifact sourcesJar {
+                classifier "sources"
+            }
+
+            artifact javadocJar {
+                classifier "javadoc"
+            }
+
+            pom {
+                name = 'dom4j'
+                description = 'flexible XML framework for Java'
+                url = 'http://dom4j.github.io/'
+                licenses {
+                    license {
+                        name = 'BSD 3-clause New License'
+                        url = 'https://github.com/dom4j/dom4j/blob/master/LICENSE'
+                    }
+                }
+                developers {
+                    developer {
+                        name = 'Filip Jirsák'
+                        email = 'filip@jirsak.org'
+                        url = 'https://github.com/FilipJirsak'
+                    }
+                }
+                scm {
+                    connection = 'scm:git:git@github.com:dom4j/dom4j.git'
+                    developerConnection = 'scm:git:git@github.com:dom4j/dom4j.git'
+                    url = 'git@github.com:dom4j/dom4j.git'
+                }
+
+                withXml {
+                    asNode().dependencies.dependency.findAll { xmlDep ->
+                        xmlDep.appendNode('optional').value = 'true'
+                    }
+                }
+            }
+        }
+    }
 }
 
 test {
@@ -75,54 +112,26 @@ jacocoTestReport {
 check.dependsOn 'jacocoTestReport'
 
 if (project.hasProperty('ossrhUsername') && project.hasProperty('ossrhPassword')) {
-	signing {
-		sign configurations.archives
-	}
-
-	uploadArchives {
+    publishing {
         repositories {
-			mavenDeployer {
-				beforeDeployment {
-					deployment -> signing.signPom(deployment)
+            maven {
+                url 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
+                credentials {
+                    username = ossrhUsername
+                    password = ossrhPassword
                 }
-
-				repository(url: "https://oss.sonatype.org/service/local/staging/deploy/maven2/") {
-					authentication(userName: ossrhUsername, password: ossrhPassword)
             }
 
-				snapshotRepository(url: "https://oss.sonatype.org/content/repositories/snapshots/") {
-					authentication(userName: ossrhUsername, password: ossrhPassword)
-				}
-
-				pom.project {
-					name 'dom4j'
-					packaging 'jar'
-					description 'flexible XML framework for Java'
-					url 'http://dom4j.github.io/'
-					licenses {
-						license {
-							name 'BSD 3-clause New License'
-							url 'https://github.com/dom4j/dom4j/blob/master/LICENSE'
-						}
-					}
-					developers {
-						developer {
-							name 'Filip Jirsák'
-							email 'filip@jirsak.org'
-							url 'https://github.com/FilipJirsak'
-						}
-					}
-					scm {
-						connection 'scm:git:git@github.com:dom4j/dom4j.git'
-						developerConnection 'scm:git:git@github.com:dom4j/dom4j.git'
-						url 'git@github.com:dom4j/dom4j.git'
-					}
-				}
-			}
+//		mavenSnapshot{
+//		url "https://oss.sonatype.org/content/repositories/snapshots/"
+//			authentication(userName: ossrhUsername, password: ossrhPassword)
+//		}
         }
     }
 }
 
-task wrapper(type: Wrapper) {
-  gradleVersion = '4.1'
+if (project.hasProperty('signing.keyId')) {
+    signing {
+        sign configurations.archives
+    }
 }
\ No newline at end of file

debian/changelog

+dom4j (2.1.1-1) unstable; urgency=medium
+
+  * Team upload.
+  * New upstream release
+    - Refreshed the patches
+    - Updated the Maven pom
+  * Ignore the dependency on stax-api (already provided by the JDK)
+  * No longer attempt to install the removed doc files
+  * Standards-Version updated to 4.1.5
+  * Switch to debhelper level 11
+  * Use salsa.debian.org Vcs-* URLs
+
+ -- Emmanuel Bourg <ebourg@apache.org>  Mon, 30 Jul 2018 18:30:50 +0200
+
 dom4j (2.1.0-2) unstable; urgency=medium
 
   * Team upload

debian/compat

-10
+11

debian/control

@@ -7,7 +7,7 @@ Uploaders:
  Emmanuel Bourg <ebourg@apache.org>
 Build-Depends:
  antlr,
- debhelper (>= 10),
+ debhelper (>= 11~),
  default-jdk,
  gradle-debian-helper,
  junit,
@@ -19,9 +19,9 @@ Build-Depends:
  libxpp2-java (>= 2.1.10-8~),
  libxpp3-java,
  maven-repo-helper
-Standards-Version: 4.1.1
-Vcs-Git: https://anonscm.debian.org/git/pkg-java/dom4j.git
-Vcs-Browser: https://anonscm.debian.org/cgit/pkg-java/dom4j.git
+Standards-Version: 4.1.5
+Vcs-Git: https://salsa.debian.org/java-team/dom4j.git
+Vcs-Browser: https://salsa.debian.org/java-team/dom4j
 Homepage: https://dom4j.github.io
 
 Package: libdom4j-java

debian/libdom4j-java-doc.docs

-docs/*.html
-docs/images
-docs/style

debian/maven.ignoreRules

+javax.xml.stream stax-api

debian/maven.rules

 s/net.java.dev.msv/com.sun.msv.datatype.xsd/ xsdlib * s/.*/debian/
-s/javax.xml.stream/stax/ stax-api * s/.*/debian/

debian/patches/08_disable-jacoco.patch

@@ -4,12 +4,12 @@ Forwarded: not-needed
 --- a/build.gradle
 +++ b/build.gradle
 @@ -1,5 +1,4 @@
- apply plugin: 'java'
+ apply plugin: 'java-library'
 -apply plugin: 'jacoco'
- apply plugin: 'maven'
+ apply plugin: 'maven-publish'
  apply plugin: 'signing'
  
-@@ -66,13 +65,6 @@
+@@ -103,14 +102,6 @@
      useTestNG()
  }
  
@@ -20,6 +20,14 @@ Forwarded: not-needed
 -}
 -
 -check.dependsOn 'jacocoTestReport'
- 
+-
  if (project.hasProperty('ossrhUsername') && project.hasProperty('ossrhPassword')) {
+     publishing {
+         repositories {
+@@ -134,4 +125,4 @@
      signing {
+         sign configurations.archives
+     }
+-}
+\ No newline at end of file
++}

debian/patches/09_disable-publish-plugin.patch

+Description: Disables the Maven publish plugin
+Author: Emmanuel Bourg <ebourg@apache.org>
+Forwarded: not-needed
+--- a/build.gradle
++++ b/build.gradle
+@@ -1,5 +1,4 @@
+ apply plugin: 'java-library'
+-apply plugin: 'maven-publish'
+ apply plugin: 'signing'
+ 
+ group = 'org.dom4j'
+@@ -52,75 +51,10 @@
+     from javadoc.destinationDir
+ }
+ 
+-publishing {
+-    publications {
+-        mavenJava(MavenPublication) {
+-            from components.java
+-
+-            artifact sourcesJar {
+-                classifier "sources"
+-            }
+-
+-            artifact javadocJar {
+-                classifier "javadoc"
+-            }
+-
+-            pom {
+-                name = 'dom4j'
+-                description = 'flexible XML framework for Java'
+-                url = 'http://dom4j.github.io/'
+-                licenses {
+-                    license {
+-                        name = 'BSD 3-clause New License'
+-                        url = 'https://github.com/dom4j/dom4j/blob/master/LICENSE'
+-                    }
+-                }
+-                developers {
+-                    developer {
+-                        name = 'Filip Jirsák'
+-                        email = 'filip@jirsak.org'
+-                        url = 'https://github.com/FilipJirsak'
+-                    }
+-                }
+-                scm {
+-                    connection = 'scm:git:git@github.com:dom4j/dom4j.git'
+-                    developerConnection = 'scm:git:git@github.com:dom4j/dom4j.git'
+-                    url = 'git@github.com:dom4j/dom4j.git'
+-                }
+-
+-                withXml {
+-                    asNode().dependencies.dependency.findAll { xmlDep ->
+-                        xmlDep.appendNode('optional').value = 'true'
+-                    }
+-                }
+-            }
+-        }
+-    }
+-}
+-
+ test {
+     useTestNG()
+ }
+ 
+-if (project.hasProperty('ossrhUsername') && project.hasProperty('ossrhPassword')) {
+-    publishing {
+-        repositories {
+-            maven {
+-                url 'https://oss.sonatype.org/service/local/staging/deploy/maven2/'
+-                credentials {
+-                    username = ossrhUsername
+-                    password = ossrhPassword
+-                }
+-            }
+-
+-//		mavenSnapshot{
+-//		url "https://oss.sonatype.org/content/repositories/snapshots/"
+-//			authentication(userName: ossrhUsername, password: ossrhPassword)
+-//		}
+-        }
+-    }
+-}
+-
+ if (project.hasProperty('signing.keyId')) {
+     signing {
+         sign configurations.archives

debian/patches/series

 04_headless-test.patch
 07_xpp2-compatibility.patch
 08_disable-jacoco.patch
+09_disable-publish-plugin.patch

debian/pom.xml

 <?xml version="1.0" encoding="UTF-8"?>
-<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
-    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.dom4j</groupId>
   <artifactId>dom4j</artifactId>
-  <version>2.1.0</version>
+  <version>2.1.1</version>
   <name>dom4j</name>
   <description>flexible XML framework for Java</description>
   <url>http://dom4j.github.io/</url>
@@ -31,25 +30,43 @@
       <groupId>jaxen</groupId>
       <artifactId>jaxen</artifactId>
       <version>1.1.6</version>
-      <scope>compile</scope>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
-      <groupId>org.testng</groupId>
-      <artifactId>testng</artifactId>
-      <version>6.8.21</version>
-      <scope>test</scope>
+      <groupId>javax.xml.stream</groupId>
+      <artifactId>stax-api</artifactId>
+      <version>1.0-2</version>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
-      <groupId>xerces</groupId>
-      <artifactId>xercesImpl</artifactId>
-      <version>2.11.0</version>
-      <scope>test</scope>
+      <groupId>net.java.dev.msv</groupId>
+      <artifactId>xsdlib</artifactId>
+      <version>2013.6.1</version>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
     <dependency>
-      <groupId>xalan</groupId>
-      <artifactId>xalan</artifactId>
-      <version>2.7.2</version>
-      <scope>test</scope>
+      <groupId>javax.xml.bind</groupId>
+      <artifactId>jaxb-api</artifactId>
+      <version>2.2.12</version>
+      <scope>runtime</scope>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <groupId>pull-parser</groupId>
+      <artifactId>pull-parser</artifactId>
+      <version>2</version>
+      <scope>runtime</scope>
+      <optional>true</optional>
+    </dependency>
+    <dependency>
+      <groupId>xpp3</groupId>
+      <artifactId>xpp3</artifactId>
+      <version>1.1.4c</version>
+      <scope>runtime</scope>
+      <optional>true</optional>
     </dependency>
   </dependencies>
 </project>

debian/rules

@@ -8,6 +8,3 @@ override_dh_auto_build:
 
 override_dh_auto_test:
 	dh_auto_build -- test
-
-get-orig-source:
-	uscan --force-download --rename

src/main/java/org/dom4j/DocumentHelper.java

@@ -18,6 +18,7 @@ import org.dom4j.rule.Pattern;
 import org.jaxen.VariableContext;
 
 import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
 
 /**
  * <code>DocumentHelper</code> is a collection of helper methods for using
@@ -257,6 +258,8 @@ public final class DocumentHelper {
      * returns the newly created Document.
      * </p>
      *
+     * Loading external DTD and entities is disabled (if it is possible) for security reasons.
+     * 
      * @param text
      *            the XML text to be parsed
      * 
@@ -267,6 +270,14 @@ public final class DocumentHelper {
      */
     public static Document parseText(String text) throws DocumentException {
         SAXReader reader = new SAXReader();
+        try {
+            reader.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+            reader.setFeature("http://xml.org/sax/features/external-general-entities", false);
+            reader.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        } catch (SAXException e) {
+            //Parse with external resources downloading allowed.
+        }
+
         String encoding = getEncoding(text);
 
         InputSource source = new InputSource(new StringReader(text));

src/main/java/org/dom4j/Namespace.java

@@ -49,6 +49,10 @@ public class Namespace extends AbstractNode {
     public Namespace(String prefix, String uri) {
         this.prefix = (prefix != null) ? prefix : "";
         this.uri = (uri != null) ? uri : "";
+
+        if (!this.prefix.isEmpty()) {
+            QName.validateNCName(this.prefix);
+        }
     }
 
     /**

src/main/java/org/dom4j/QName.java

@@ -11,6 +11,7 @@ import java.io.IOException;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.Serializable;
+import java.util.regex.Pattern;
 
 import org.dom4j.tree.QNameCache;
 import org.dom4j.util.SingletonStrategy;
@@ -21,11 +22,86 @@ import org.dom4j.util.SingletonStrategy;
  * object is immutable.
  *
  * @author <a href="mailto:jstrachan@apache.org">James Strachan </a>
+ * @author Filip Jirsák
  */
 public class QName implements Serializable {
     /** The Singleton instance */
     private static SingletonStrategy<QNameCache> singleton = null;
 
+    /**
+     * {@code NameStartChar} without colon.
+     *
+     * <pre>NameStartChar	::=	":" | [A-Z] | "_" | [a-z] | [#xC0-#xD6] | [#xD8-#xF6] | [#xF8-#x2FF] | [#x370-#x37D] | [#x37F-#x1FFF] | [#x200C-#x200D] | [#x2070-#x218F] | [#x2C00-#x2FEF] | [#x3001-#xD7FF] | [#xF900-#xFDCF] | [#xFDF0-#xFFFD] | [#x10000-#xEFFFF]</pre>
+     *
+     * @see <a href="https://www.w3.org/TR/xml/#sec-common-syn">XML 1.0 – 2.3 Common Syntactic Constructs</a>
+     * @see <a href="https://www.w3.org/TR/2006/REC-xml11-20060816/#sec-common-syn">XML 1.1 – 2.3 Common Syntactic Constructs</a>
+     */
+    private static final String NAME_START_CHAR = "_A-Za-z\u00C0-\u00D6\u00D8-\u00F6\u00F8-\u02FF\u0370-\u037D\u037F-\u1FFF\u200C-\u200D\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD";
+
+    /**
+     * {@code NameChar} without colon.
+     *
+     * <pre>NameChar	::=	NameStartChar | "-" | "." | [0-9] | #xB7 | [#x0300-#x036F] | [#x203F-#x2040]</pre>
+     *
+     * @see <a href="https://www.w3.org/TR/xml/#sec-common-syn">XML 1.0 – 2.3 Common Syntactic Constructs</a>
+     * @see <a href="https://www.w3.org/TR/2006/REC-xml11-20060816/#sec-common-syn">XML 1.1 – 2.3 Common Syntactic Constructs</a>
+     */
+    private static final String NAME_CHAR = NAME_START_CHAR + "-.0-9\u00B7\u0300-\u036F\u203F-\u2040";
+
+    /**
+     * {@code NCName}
+     *
+     * <pre>
+     * NCName		::=	NCNameStartChar NCNameChar*	(An XML Name, minus the ":")
+     * NCNameChar	::=	NameChar -':'
+     * NCNameStartChar	::=	NameStartChar -':'
+     * </pre>
+     *
+     * @see <a href="https://www.w3.org/TR/xml-names/#ns-qualnames">Namespaces in XML 1.0 – 4 Qualified Names</a>
+     * @see <a href="https://www.w3.org/TR/2006/REC-xml-names11-20060816/#ns-qualnames">Namespaces in XML 1.1 – 4 Qualified Names</a>
+     */
+    private static final String NCNAME = "["+NAME_START_CHAR+"]["+NAME_CHAR+"]*";
+
+    /**
+     * Regular expression for {@code Name} (with colon).
+     *
+     * <pre>Name	::=	NameStartChar (NameChar)*</pre>
+     *
+     * @see <a href="https://www.w3.org/TR/xml/#sec-common-syn">XML 1.0 – 2.3 Common Syntactic Constructs</a>
+     * @see <a href="https://www.w3.org/TR/2006/REC-xml11-20060816/#sec-common-syn">XML 1.1 – 2.3 Common Syntactic Constructs</a>
+     */
+    private static final Pattern RE_NAME = Pattern.compile("[:"+NAME_START_CHAR+"][:"+NAME_CHAR+"]*");
+
+    /**
+     * Regular expression for {@code NCName}.
+     *
+     * <pre>
+     * NCName		::=	NCNameStartChar NCNameChar*	(An XML Name, minus the ":")
+     * NCNameChar	::=	NameChar -':'
+     * NCNameStartChar	::=	NameStartChar -':'
+     * </pre>
+     *
+     * @see <a href="https://www.w3.org/TR/xml-names/#ns-qualnames">Namespaces in XML 1.0 – 4 Qualified Names</a>
+     * @see <a href="https://www.w3.org/TR/2006/REC-xml-names11-20060816/#ns-qualnames">Namespaces in XML 1.1 – 4 Qualified Names</a>
+     */
+    private static final Pattern RE_NCNAME = Pattern.compile(NCNAME);
+
+    /**
+     * Regular expression for {@code QName}.
+     *
+     * <pre>
+     * QName		::=	PrefixedName | UnprefixedName
+     * PrefixedName	::=	Prefix ':' LocalPart
+     * UnprefixedName	::=	LocalPart
+     * Prefix		::=	NCName
+     * LocalPart	::=	NCName
+     * </pre>
+     *
+     * @see <a href="https://www.w3.org/TR/xml-names/#ns-qualnames">Namespaces in XML 1.0 – 4 Qualified Names</a>
+     * @see <a href="https://www.w3.org/TR/2006/REC-xml-names11-20060816/#ns-qualnames">Namespaces in XML 1.1 – 4 Qualified Names</a>
+     */
+    private static final Pattern RE_QNAME = Pattern.compile("(?:"+NCNAME+":)?"+NCNAME);
+
     static {
         try {
             String defaultSingletonClass = "org.dom4j.util.SimpleSingleton";
@@ -71,6 +147,11 @@ public class QName implements Serializable {
         this.name = (name == null) ? "" : name;
         this.namespace = (namespace == null) ? Namespace.NO_NAMESPACE
                 : namespace;
+        if (this.namespace.equals(Namespace.NO_NAMESPACE)) {
+            validateName(this.name);
+        } else {
+            validateNCName(this.name);
+        }
     }
 
     public QName(String name, Namespace namespace, String qualifiedName) {
@@ -78,6 +159,8 @@ public class QName implements Serializable {
         this.qualifiedName = qualifiedName;
         this.namespace = (namespace == null) ? Namespace.NO_NAMESPACE
                 : namespace;
+        validateNCName(this.name);
+        validateQName(this.qualifiedName);
     }
 
     public static QName get(String name) {
@@ -251,6 +334,24 @@ public class QName implements Serializable {
         QNameCache cache = singleton.instance();
         return cache;
     }
+
+    private static void validateName(String name) {
+        if (!RE_NAME.matcher(name).matches()) {
+            throw new IllegalArgumentException(String.format("Illegal character in name: '%s'.", name));
+        }
+    }
+
+    protected static void validateNCName(String ncname) {
+        if (!RE_NCNAME.matcher(ncname).matches()) {
+            throw new IllegalArgumentException(String.format("Illegal character in local name: '%s'.", ncname));
+        }
+    }
+
+    private static void validateQName(String qname) {
+        if (!RE_QNAME.matcher(qname).matches()) {
+            throw new IllegalArgumentException(String.format("Illegal character in qualified name: '%s'.", qname));
+        }
+    }
 }
 
 

src/main/java/org/dom4j/datatype/SchemaParser.java

@@ -180,15 +180,19 @@ public class SchemaParser {
             DocumentFactory parentFactory) {
         String name = xsdElement.attributeValue("name");
         String type = xsdElement.attributeValue("type");
-        QName qname = getQName(name);
 
-        DatatypeElementFactory factory = getDatatypeElementFactory(qname);
+        QName qname = null;
+        DatatypeElementFactory factory = null;
+        if (name != null) {
+            qname = getQName(name);
+            factory = getDatatypeElementFactory(qname);
+        }
 
         if (type != null) {
             // register type with this element name
             XSDatatype dataType = getTypeByName(type);
 
-            if (dataType != null) {
+            if (dataType != null && factory != null) {
                 factory.setChildElementXSDatatype(qname, dataType);
             } else {
                 QName typeQName = getQName(type);
@@ -205,19 +209,19 @@ public class SchemaParser {
         if (xsdSimpleType != null) {
             XSDatatype dataType = loadXSDatatypeFromSimpleType(xsdSimpleType);
 
-            if (dataType != null) {
+            if (dataType != null && factory != null) {
                 factory.setChildElementXSDatatype(qname, dataType);
             }
         }
 
         Element schemaComplexType = xsdElement.element(XSD_COMPLEXTYPE);
 
-        if (schemaComplexType != null) {
+        if (schemaComplexType != null && factory != null) {
             onSchemaComplexType(schemaComplexType, factory);
         }
 
+        if (factory != null) {
             Iterator<Element> iter = xsdElement.elementIterator(XSD_ATTRIBUTE);
-
             if (iter.hasNext()) {
                 do {
                     onDatatypeAttribute(xsdElement, factory, iter
@@ -225,6 +229,7 @@ public class SchemaParser {
                 } while (iter.hasNext());
             }
         }
+    }
 
     /**
      * processes an named XML Schema &lt;complexTypegt; tag

src/main/java/org/dom4j/io/SAXHelper.java

@@ -103,6 +103,21 @@ class SAXHelper {
             throw new SAXException("Couldn't create SAX reader");
         }
 
+        // configure namespace support
+        SAXHelper.setParserFeature(reader, "http://xml.org/sax/features/namespaces", true);
+        SAXHelper.setParserFeature(reader, "http://xml.org/sax/features/namespace-prefixes", false);
+
+        // external entites
+        SAXHelper.setParserFeature(reader, "http://xml.org/sax/properties/external-general-entities", false);
+        SAXHelper.setParserFeature(reader, "http://xml.org/sax/properties/external-parameter-entities", false);
+
+        // external DTD
+        SAXHelper.setParserFeature(reader,"http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+
+
+        // use Locator2 if possible
+        SAXHelper.setParserFeature(reader,"http://xml.org/sax/features/use-locator2", true);
+
         return reader;
     }
 

src/main/java/org/dom4j/io/SAXReader.java

@@ -65,10 +65,6 @@ import org.xml.sax.helpers.XMLReaderFactory;
 public class SAXReader {
     private static final String SAX_STRING_INTERNING = 
             "http://xml.org/sax/features/string-interning";
-    private static final String SAX_NAMESPACE_PREFIXES = 
-            "http://xml.org/sax/features/namespace-prefixes";
-    private static final String SAX_NAMESPACES = 
-            "http://xml.org/sax/features/namespaces";
     private static final String SAX_DECL_HANDLER =
             "http://xml.org/sax/properties/declaration-handler";
     private static final String SAX_LEXICAL_HANDLER = 
@@ -902,27 +898,10 @@ public class SAXReader {
             SAXHelper.setParserProperty(reader, SAX_DECL_HANDLER, handler);
         }
 
-        // configure namespace support
-        SAXHelper.setParserFeature(reader, SAX_NAMESPACES, true);
-
-        SAXHelper.setParserFeature(reader, SAX_NAMESPACE_PREFIXES, false);
-
         // string interning
         SAXHelper.setParserFeature(reader, SAX_STRING_INTERNING,
                 isStringInternEnabled());
 
-        // external entites
-        /*
-         * SAXHelper.setParserFeature( reader,
-         * "http://xml.org/sax/properties/external-general-entities",
-         * includeExternalGeneralEntities ); SAXHelper.setParserFeature( reader,
-         * "http://xml.org/sax/properties/external-parameter-entities",
-         * includeExternalParameterEntities );
-         */
-        // use Locator2 if possible
-        SAXHelper.setParserFeature(reader,
-                "http://xml.org/sax/features/use-locator2", true);
-
         try {
             // configure validation support
             reader.setFeature("http://xml.org/sax/features/validation",

src/main/java/org/dom4j/io/XMLWriter.java

@@ -574,6 +574,7 @@ public class XMLWriter extends XMLFilterImpl implements LexicalHandler {
     public void writeOpen(Element element) throws IOException {
         writer.write("<");
         writer.write(element.getQualifiedName());
+        writeNamespaces(element);
         writeAttributes(element);
         writer.write(">");
     }
@@ -1206,6 +1207,19 @@ public class XMLWriter extends XMLFilterImpl implements LexicalHandler {
         writer.write("\"");
     }
 
+    /**
+     * Writes all namespaces declared directly on element.
+     *
+     * @throws IOException
+     */
+    protected void writeNamespaces(Element element) throws IOException {
+        assert element != null;
+        for (Namespace ns : element.declaredNamespaces()) {
+            writeNamespace(ns);
+            namespaceStack.push(ns);
+        }
+    }
+
     protected void writeProcessingInstruction(ProcessingInstruction pi)
             throws IOException {
         // indent();
@@ -1631,44 +1645,37 @@ public class XMLWriter extends XMLFilterImpl implements LexicalHandler {
 
         for (i = 0; i < size; i++) {
             String entity = null;
-            char c = text.charAt(i);
 
+            int c = text.codePointAt(i);
             switch (c) {
                 case '<':
                     entity = "&lt;";
-
                     break;
-
                 case '>':
                     entity = "&gt;";
-
                     break;
-
                 case '&':
                     entity = "&amp;";
-
                     break;
-
                 case '\t':
                 case '\n':
                 case '\r':
-
                     // don't encode standard whitespace characters
                     if (preserve) {
-                        entity = String.valueOf(c);
+                        entity = String.valueOf((char) c);
                     }
-
                     break;
 
                 default:
 
                     if ((c < 32) || shouldEncodeChar(c)) {
-                        entity = "&#" + (int) c + ";";
+                        entity = "&#" + c + ";";
                     }
 
                     break;
             }
 
+
             if (entity != null) {
                 if (block == null) {
                     block = text.toCharArray();
@@ -1677,6 +1684,12 @@ public class XMLWriter extends XMLFilterImpl implements LexicalHandler {
                 buffer.append(block, last, i - last);
                 buffer.append(entity);
                 last = i + 1;
+                if (Character.isSupplementaryCodePoint(c)) {
+                    last++;
+                }
+            }
+            if (Character.isSupplementaryCodePoint(c)) {
+                i++;
             }
         }
 
@@ -1725,53 +1738,37 @@ public class XMLWriter extends XMLFilterImpl implements LexicalHandler {
 
         for (i = 0; i < size; i++) {
             String entity = null;
-            char c = text.charAt(i);
+            int c = text.codePointAt(i);
 
             switch (c) {
                 case '<':
                     entity = "&lt;";
-
                     break;
-
                 case '>':
                     entity = "&gt;";
-
                     break;
-
                 case '\'':
-
                     if (quote == '\'') {
                         entity = "&apos;";
                     }
-
                     break;
-
                 case '\"':
-
                     if (quote == '\"') {
                         entity = "&quot;";
                     }
-
                     break;
-
                 case '&':
                     entity = "&amp;";
-
                     break;
-
                 case '\t':
                 case '\n':
                 case '\r':
-
                     // don't encode standard whitespace characters
                     break;
-
                 default:
-
                     if ((c < 32) || shouldEncodeChar(c)) {
-                        entity = "&#" + (int) c + ";";
+                        entity = "&#" + c + ";";
                     }
-
                     break;
             }
 
@@ -1783,6 +1780,12 @@ public class XMLWriter extends XMLFilterImpl implements LexicalHandler {
                 buffer.append(block, last, i - last);
                 buffer.append(entity);
                 last = i + 1;
+                if(Character.isSupplementaryCodePoint(c)) {
+                    last++;
+                }
+            }
+            if(Character.isSupplementaryCodePoint(c)) {
+                i++;
             }
         }
 
@@ -1808,15 +1811,15 @@ public class XMLWriter extends XMLFilterImpl implements LexicalHandler {
      * Should the given character be escaped. This depends on the encoding of
      * the document.
      * 
-     * @param c
+     * @param codepoint Unicode codepoint.
      *            DOCUMENT ME!
      * 
      * @return boolean
      */
-    protected boolean shouldEncodeChar(char c) {
+    protected boolean shouldEncodeChar(int codepoint) {
         int max = getMaximumAllowedCharacter();
 
-        return (max > 0) && (c > max);
+        return (max > 0) && (codepoint > max);
     }
 
     /**