diff --git a/asciidoc/settings.adoc b/asciidoc/settings.adoc
index c18c9a2..770794f 100644
--- a/asciidoc/settings.adoc
+++ b/asciidoc/settings.adoc
@@ -23,6 +23,8 @@
 
 Settings are specified through an XML file, usually called `ivysettings.xml`. To configure Ivy from Ant, you just have to use the link:use/settings{outfilesuffix}[settings] datatype with the path of your settings file.
 
+In addition certain link:systemproperties{outfilesuffix}[Java system properties] affect the XML parsing behavior of Ivy.
+
 Here is an example of the settings file:
 
 [source, xml]
diff --git a/asciidoc/systemproperties.adoc b/asciidoc/systemproperties.adoc
new file mode 100644
index 0000000..4759243
--- /dev/null
+++ b/asciidoc/systemproperties.adoc
@@ -0,0 +1,67 @@
+////
+   Licensed to the Apache Software Foundation (ASF) under one
+   or more contributor license agreements.  See the NOTICE file
+   distributed with this work for additional information
+   regarding copyright ownership.  The ASF licenses this file
+   to you under the Apache License, Version 2.0 (the
+   "License"); you may not use this file except in compliance
+   with the License.  You may obtain a copy of the License at
+
+     https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing,
+   software distributed under the License is distributed on an
+   "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+   KIND, either express or implied.  See the License for the
+   specific language governing permissions and limitations
+   under the License.
+////
+
+= Java System Properties Affecting Ivy
+
+== XML Parser Settings
+
+Starting with Ivy 2.5.2 Ivy's XML parser can be controlled via the use
+of two newly introduced system properties.
+
+If you want to restore the default behavior of Ivy 2.5.1 and earlier
+you need to set `ivy.xml.allow-doctype-processing` to `true` and
+`ivy.xml.external-resources` to `ALL`.
+
+=== `ivy.xml.allow-doctype-processing`
+
+This system property accepts `true` or `false` as values. When set to
+`false` Ivy will not allow any processing of doctype declarations at
+all, while setting it to `true` enables it.
+
+The default is to allow doctype processing if and only if Ivy is
+parsing a Maven POM file.
+
+=== `ivy.xml.external-resources`
+
+This system property controls if external resources are read during
+doctype processing - and if so, where they can be loadad from. The
+value of this system property is only ever used if
+`ivy.xml.allow-doctype-processing` is not `false`.
+
+The accepted values are
+
+* `PROHIBIT` makes Ivy fail if any doctype tries to load an external
+  resource.
+* `IGNORE` makes Ivy ignore any external resource that the doctype
+  declaration wants to load.
+* `LOCAL_ONLY` allows external resources to be loaded via `file:` or
+  `jar:file` URIs only.
+* `ALL` allows external resources to be loaded from any URI.
+
+The default behavior is to not allow doctype processing at all, but if
+it is enabled the value `PROHIBIT` is assumed unless the property has
+been set explicitly.
+
+When reading Maven POMs a specific internal system id is recognized as
+resource and will be loaded from a resource shipping with the Ivy
+distribution in order to deal with invalid POM files accepted by
+Apache Maven - and the default value for this property is
+`IGNORE`in that case. See
+link:https://issues.apache.org/jira/browse/IVY-921[IVY-921] for
+details.
diff --git a/asciidoc/toc.json b/asciidoc/toc.json
index 2c8f190..c6f6ec4 100644
--- a/asciidoc/toc.json
+++ b/asciidoc/toc.json
@@ -151,6 +151,11 @@
                       ]
                   },
                   {
+                      "id": "systemproperties",
+                      "title": "System Properties",
+                      "children": []
+                  },
+                  {
                     "id":"settings",
                     "title":"Settings Files",
                     "children": [
diff --git a/src/java/org/apache/ivy/ant/IvyArtifactReport.java b/src/java/org/apache/ivy/ant/IvyArtifactReport.java
index 7e56348..2e66265 100644
--- a/src/java/org/apache/ivy/ant/IvyArtifactReport.java
+++ b/src/java/org/apache/ivy/ant/IvyArtifactReport.java
@@ -28,8 +28,6 @@
 
 import javax.xml.transform.OutputKeys;
 import javax.xml.transform.TransformerConfigurationException;
-import javax.xml.transform.TransformerFactoryConfigurationError;
-import javax.xml.transform.sax.SAXTransformerFactory;
 import javax.xml.transform.sax.TransformerHandler;
 import javax.xml.transform.stream.StreamResult;
 
@@ -43,6 +41,7 @@
 import org.apache.ivy.core.resolve.ResolveOptions;
 import org.apache.ivy.core.resolve.ResolvedModuleRevision;
 import org.apache.ivy.core.retrieve.RetrieveOptions;
+import org.apache.ivy.util.XMLHelper;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.Project;
 import org.xml.sax.SAXException;
@@ -170,10 +169,8 @@
     }
 
     private TransformerHandler createTransformerHandler(FileOutputStream fileOutputStream)
-            throws TransformerFactoryConfigurationError, TransformerConfigurationException {
-        SAXTransformerFactory transformerFact = (SAXTransformerFactory) SAXTransformerFactory
-                .newInstance();
-        TransformerHandler saxHandler = transformerFact.newTransformerHandler();
+            throws TransformerConfigurationException {
+        TransformerHandler saxHandler = XMLHelper.getTransformerHandler();
         saxHandler.getTransformer().setOutputProperty(OutputKeys.ENCODING, "UTF-8");
         saxHandler.getTransformer().setOutputProperty(OutputKeys.INDENT, "yes");
         saxHandler.setResult(new StreamResult(fileOutputStream));
diff --git a/src/java/org/apache/ivy/ant/IvyReport.java b/src/java/org/apache/ivy/ant/IvyReport.java
index 662fd32..c3ba383 100644
--- a/src/java/org/apache/ivy/ant/IvyReport.java
+++ b/src/java/org/apache/ivy/ant/IvyReport.java
@@ -33,7 +33,6 @@
 import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerConfigurationException;
 import javax.xml.transform.TransformerException;
-import javax.xml.transform.TransformerFactory;
 import javax.xml.transform.stream.StreamResult;
 import javax.xml.transform.stream.StreamSource;
 
@@ -48,6 +47,7 @@
 import org.apache.ivy.plugins.report.XmlReportParser;
 import org.apache.ivy.util.FileUtil;
 import org.apache.ivy.util.Message;
+import org.apache.ivy.util.XMLHelper;
 import org.apache.tools.ant.BuildException;
 import org.apache.tools.ant.taskdefs.XSLTProcess;
 import org.apache.tools.ant.util.JAXPUtils;
@@ -313,8 +313,7 @@
             Source xsltSource = new StreamSource(xsltStream, JAXPUtils.getSystemId(style));
 
             // create transformer
-            TransformerFactory tFactory = TransformerFactory.newInstance();
-            Transformer transformer = tFactory.newTransformer(xsltSource);
+            Transformer transformer = XMLHelper.getTransformer(xsltSource);
 
             // add standard parameters
             transformer.setParameter("confs", conf);
diff --git a/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java b/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java
index 0c743c9..f791e69 100644
--- a/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java
+++ b/src/java/org/apache/ivy/core/settings/XmlSettingsParser.java
@@ -32,8 +32,6 @@
 import java.util.List;
 import java.util.Map;
 
-import javax.xml.parsers.SAXParserFactory;
-
 import org.apache.ivy.core.IvyPatternHelper;
 import org.apache.ivy.core.cache.RepositoryCacheManager;
 import org.apache.ivy.core.module.status.StatusManager;
@@ -46,6 +44,7 @@
 import org.apache.ivy.util.Configurator;
 import org.apache.ivy.util.FileResolver;
 import org.apache.ivy.util.Message;
+import org.apache.ivy.util.XMLHelper;
 import org.apache.ivy.util.url.CredentialsStore;
 import org.apache.ivy.util.url.TimeoutConstrainedURLHandler;
 import org.apache.ivy.util.url.URLHandlerRegistry;
@@ -151,10 +150,8 @@
     @SuppressWarnings("deprecation")
     private void doParse(URL settingsUrl) throws IOException, ParseException {
         this.settings = settingsUrl;
-        try (InputStream stream = URLHandlerRegistry.getDefault().openStream(settingsUrl)) {
-            InputSource inSrc = new InputSource(stream);
-            inSrc.setSystemId(settingsUrl.toExternalForm());
-            SAXParserFactory.newInstance().newSAXParser().parse(settingsUrl.toExternalForm(), this);
+        try {
+            XMLHelper.parse(settingsUrl, null, this);
             ivy.validate();
         } catch (IOException e) {
             throw e;
diff --git a/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java b/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java
index 41bf076..fc5557f 100644
--- a/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java
+++ b/src/java/org/apache/ivy/osgi/obr/xml/OBRXMLWriter.java
@@ -22,9 +22,7 @@
 import java.util.Set;
 
 import javax.xml.transform.OutputKeys;
-import javax.xml.transform.Transformer;
 import javax.xml.transform.TransformerConfigurationException;
-import javax.xml.transform.sax.SAXTransformerFactory;
 import javax.xml.transform.sax.TransformerHandler;
 import javax.xml.transform.stream.StreamResult;
 
@@ -45,6 +43,7 @@
 import org.apache.ivy.osgi.util.Version;
 import org.apache.ivy.osgi.util.VersionRange;
 import org.apache.ivy.util.Message;
+import org.apache.ivy.util.XMLHelper;
 import org.xml.sax.ContentHandler;
 import org.xml.sax.SAXException;
 import org.xml.sax.helpers.AttributesImpl;
@@ -53,12 +52,10 @@
 
     public static ContentHandler newHandler(OutputStream out, String encoding, boolean indent)
             throws TransformerConfigurationException {
-        SAXTransformerFactory tf = (SAXTransformerFactory) SAXTransformerFactory.newInstance();
-        TransformerHandler hd = tf.newTransformerHandler();
-        Transformer serializer = tf.newTransformer();
+        TransformerHandler hd = XMLHelper.getTransformerHandler();
+        hd.getTransformer().setOutputProperty(OutputKeys.ENCODING, encoding);
+        hd.getTransformer().setOutputProperty(OutputKeys.INDENT, indent ? "yes" : "no");
         StreamResult stream = new StreamResult(out);
-        serializer.setOutputProperty(OutputKeys.ENCODING, encoding);
-        serializer.setOutputProperty(OutputKeys.INDENT, indent ? "yes" : "no");
         hd.setResult(stream);
         return hd;
     }
diff --git a/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java b/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java
index 88c9d70..2bafc9b 100644
--- a/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java
+++ b/src/java/org/apache/ivy/plugins/parser/m2/PomReader.java
@@ -130,12 +130,13 @@
                 public InputSource resolveEntity(String publicId, String systemId)
                         throws SAXException, IOException {
                     if (systemId != null && systemId.endsWith("m2-entities.ent")) {
+                        // IVY-921: return an InputSource for our local packaged m2-entities.ent file
                         return new InputSource(
                                 PomReader.class.getResourceAsStream("m2-entities.ent"));
                     }
                     return null;
                 }
-            });
+            }, true, XMLHelper.ExternalResources.IGNORE);
             projectElement = pomDomDoc.getDocumentElement();
             if (!PROJECT.equals(projectElement.getNodeName())
                     && !MODEL.equals(projectElement.getNodeName())) {
diff --git a/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java b/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java
index 352cd7f..532bcd2 100644
--- a/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java
+++ b/src/java/org/apache/ivy/plugins/parser/xml/XmlModuleDescriptorParser.java
@@ -17,9 +17,13 @@
  */
 package org.apache.ivy.plugins.parser.xml;
 
+import java.io.BufferedReader;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.io.StringReader;
+import java.io.UnsupportedEncodingException;
 import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -80,6 +84,7 @@
 import org.apache.ivy.util.XMLHelper;
 import org.apache.ivy.util.extendable.ExtendableItemHelper;
 import org.xml.sax.Attributes;
+import org.xml.sax.InputSource;
 import org.xml.sax.SAXException;
 
 import static org.apache.ivy.core.module.descriptor.Configuration.Visibility.getVisibility;
@@ -216,6 +221,8 @@
         protected static final List<String> ALLOWED_VERSIONS = Arrays.asList("1.0",
                 "1.1", "1.2", "1.3", "1.4", "2.0", "2.1", "2.2", "2.3", "2.4");
 
+        private static final String IVY_XSD_CONTENT;
+
         /* how and what do we have to parse */
         private ParserSettings settings;
 
@@ -248,6 +255,40 @@
 
         private Stack<ExtraInfoHolder> extraInfoStack = new Stack<>();
 
+        static {
+            String ivyXSDContent = null;
+            final InputStream is = Parser.class.getResourceAsStream("ivy.xsd");
+            if (is != null) {
+                final StringBuilder sb = new StringBuilder();
+                try {
+                    try {
+                        final BufferedReader reader = new BufferedReader(new InputStreamReader(is, "UTF-8"));
+                        String line = null;
+                        while ((line = reader.readLine()) != null) {
+                            if (sb.length() != 0) {
+                                sb.append("\n");
+                            }
+                            sb.append(line);
+                        }
+                    } catch (UnsupportedEncodingException e) {
+                        // ignore
+                        ivyXSDContent = null;
+                    } catch (IOException e) {
+                        // ignore
+                        ivyXSDContent = null;
+                    }
+                } finally {
+                    try {
+                        is.close();
+                    } catch (Exception e) {
+                        // ignore
+                    }
+                }
+                ivyXSDContent = sb.length() == 0 ? null : sb.toString();
+            }
+            IVY_XSD_CONTENT = ivyXSDContent;
+        }
+
         public Parser(ModuleDescriptorParser parser, ParserSettings ivySettings) {
             super(parser);
             settings = ivySettings;
@@ -268,10 +309,14 @@
         public void parse() throws ParseException {
             try {
                 URL schemaURL = validate ? getSchemaURL() : null;
+                XMLHelper.ExternalResources e =
+                    validate && System.getProperty(XMLHelper.EXTERNAL_RESOURCES) == null
+                    ? XMLHelper.ExternalResources.IGNORE
+                    : XMLHelper.ExternalResources.fromSystemProperty();
                 if (descriptorURL != null) {
-                    XMLHelper.parse(descriptorURL, schemaURL, this);
+                    XMLHelper.parse(descriptorURL, schemaURL, this, null, e);
                 } else {
-                    XMLHelper.parse(descriptorInput, schemaURL, this, null);
+                    XMLHelper.parse(descriptorInput, schemaURL, this, null, e);
                 }
                 checkConfigurations();
                 replaceConfigurationWildcards();
@@ -297,6 +342,26 @@
         }
 
         @Override
+        public InputSource resolveEntity(final String publicId, final String systemId)
+                throws IOException, SAXException {
+            if (isApacheOrgIvyXSDSystemId(systemId) && IVY_XSD_CONTENT != null) {
+                // redirect the schema location to local file based ivy.xsd whose content
+                // we have already read and is available in-memory.
+                final InputSource source = new InputSource(new StringReader(IVY_XSD_CONTENT));
+                return source;
+            }
+            return super.resolveEntity(publicId, systemId);
+        }
+
+        private static boolean isApacheOrgIvyXSDSystemId(final String systemId) {
+            if (systemId == null) {
+                return false;
+            }
+            return systemId.equals("http://ant.apache.org/ivy/schemas/ivy.xsd")
+                    || systemId.equals("https://ant.apache.org/ivy/schemas/ivy.xsd");
+        }
+
+        @Override
         public void startElement(String uri, String localName, String qName, Attributes attributes)
                 throws SAXException {
             try {
diff --git a/src/java/org/apache/ivy/plugins/report/XmlReportParser.java b/src/java/org/apache/ivy/plugins/report/XmlReportParser.java
index b35c483..e791cf0 100644
--- a/src/java/org/apache/ivy/plugins/report/XmlReportParser.java
+++ b/src/java/org/apache/ivy/plugins/report/XmlReportParser.java
@@ -27,9 +27,6 @@
 import java.util.SortedMap;
 import java.util.TreeMap;
 
-import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
-
 import org.apache.ivy.core.cache.ArtifactOrigin;
 import org.apache.ivy.core.module.descriptor.Artifact;
 import org.apache.ivy.core.module.descriptor.DefaultArtifact;
@@ -38,6 +35,7 @@
 import org.apache.ivy.core.report.DownloadStatus;
 import org.apache.ivy.core.report.MetadataArtifactDownloadReport;
 import org.apache.ivy.util.DateUtil;
+import org.apache.ivy.util.XMLHelper;
 import org.apache.ivy.util.extendable.ExtendableItemHelper;
 import org.xml.sax.Attributes;
 import org.xml.sax.SAXException;
@@ -242,8 +240,7 @@
         }
 
         public void parse() throws Exception {
-            SAXParser saxParser = SAXParserFactory.newInstance().newSAXParser();
-            saxParser.parse(report, new XmlReportParserHandler());
+            XMLHelper.parse(report.toURI().toURL(), null, new XmlReportParserHandler());
         }
 
         private static boolean parseBoolean(String str) {
diff --git a/src/java/org/apache/ivy/util/XMLHelper.java b/src/java/org/apache/ivy/util/XMLHelper.java
index 5737368..e5bfa7b 100644
--- a/src/java/org/apache/ivy/util/XMLHelper.java
+++ b/src/java/org/apache/ivy/util/XMLHelper.java
@@ -19,6 +19,7 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.StringReader;
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
@@ -28,13 +29,24 @@
 import javax.xml.parsers.ParserConfigurationException;
 import javax.xml.parsers.SAXParser;
 import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.Source;
+import javax.xml.transform.Transformer;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.TransformerFactory;
+import javax.xml.transform.sax.SAXTransformerFactory;
+import javax.xml.transform.sax.TransformerHandler;
 
 import org.apache.ivy.util.url.URLHandlerRegistry;
 import org.w3c.dom.Document;
+import org.xml.sax.Attributes;
 import org.xml.sax.EntityResolver;
 import org.xml.sax.InputSource;
+import org.xml.sax.Locator;
 import org.xml.sax.SAXException;
 import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+import org.xml.sax.SAXParseException;
+import org.xml.sax.XMLReader;
 import org.xml.sax.ext.LexicalHandler;
 import org.xml.sax.helpers.DefaultHandler;
 
@@ -50,49 +62,38 @@
 
     static final String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema";
 
-    private static boolean canUseSchemaValidation = true;
+    private static final String XML_ACCESS_EXTERNAL_SCHEMA = "http://javax.xml.XMLConstants/property/accessExternalSchema";
+    private static final String XML_ACCESS_EXTERNAL_DTD = "http://javax.xml.XMLConstants/property/accessExternalDTD";
+    public static final String ALLOW_DOCTYPE_PROCESSING = "ivy.xml.allow-doctype-processing";
+    public static final String EXTERNAL_RESOURCES = "ivy.xml.external-resources";
 
-    private static Boolean canDisableExternalDtds = null;
-
-    private static SAXParser newSAXParser(URL schema, InputStream schemaStream,
-            boolean loadExternalDtds) throws ParserConfigurationException, SAXException {
-        SAXParserFactory parserFactory = SAXParserFactory.newInstance();
+    private static SAXParser newSAXParser(final URL schema, final InputStream schemaStream,
+        final boolean allowXmlDoctypeProcessing, final ExternalResources externalResources)
+        throws ParserConfigurationException, SAXException {
+        final SAXParserFactory parserFactory = SAXParserFactory.newInstance();
         parserFactory.setNamespaceAware(true);
-        parserFactory.setValidating(canUseSchemaValidation && (schema != null));
-        if (!loadExternalDtds && canDisableExternalDtds(parserFactory)) {
-            parserFactory.setFeature(XERCES_LOAD_EXTERNAL_DTD, false);
-        }
-        SAXParser parser = parserFactory.newSAXParser();
+        parserFactory.setValidating(schema != null);
+        configureSafeFeatures(parserFactory, allowXmlDoctypeProcessing, externalResources);
 
-        if (canUseSchemaValidation && schema != null) {
+        SAXParser parser = parserFactory.newSAXParser();
+        if (schema != null) {
             try {
                 parser.setProperty(JAXP_SCHEMA_LANGUAGE, W3C_XML_SCHEMA);
                 parser.setProperty(JAXP_SCHEMA_SOURCE, schemaStream);
             } catch (SAXNotRecognizedException ex) {
                 Message.warn("problem while setting JAXP validating property on SAXParser... "
                         + "XML validation will not be done", ex);
-                canUseSchemaValidation = false;
                 parserFactory.setValidating(false);
                 parser = parserFactory.newSAXParser();
             }
         }
-
-        parser.getXMLReader().setFeature(XML_NAMESPACE_PREFIXES, true);
+        final XMLReader reader = parser.getXMLReader();
+        reader.setFeature(XML_NAMESPACE_PREFIXES, true);
+        reader.setProperty(XML_ACCESS_EXTERNAL_SCHEMA, externalResources.getAllowedProtocols());
+        reader.setProperty(XML_ACCESS_EXTERNAL_DTD, externalResources.getAllowedProtocols());
         return parser;
     }
 
-    private static boolean canDisableExternalDtds(SAXParserFactory parserFactory) {
-        if (canDisableExternalDtds == null) {
-            try {
-                parserFactory.getFeature(XERCES_LOAD_EXTERNAL_DTD);
-                canDisableExternalDtds = Boolean.TRUE;
-            } catch (Exception ex) {
-                canDisableExternalDtds = Boolean.FALSE;
-            }
-        }
-        return canDisableExternalDtds;
-    }
-
     /**
      * Convert an URL to a valid systemId according to RFC 2396.
      *
@@ -116,36 +117,58 @@
         parse(xmlURL, schema, handler, null);
     }
 
-    @SuppressWarnings("deprecation")
     public static void parse(URL xmlURL, URL schema, DefaultHandler handler, LexicalHandler lHandler)
             throws SAXException, IOException, ParserConfigurationException {
+        parse(xmlURL, schema, handler, lHandler, ExternalResources.fromSystemProperty());
+    }
+
+    @SuppressWarnings("deprecation")
+    public static void parse(URL xmlURL, URL schema, DefaultHandler handler, LexicalHandler lHandler,
+            final ExternalResources externalResources)
+            throws SAXException, IOException, ParserConfigurationException {
         try (InputStream xmlStream = URLHandlerRegistry.getDefault().openStream(xmlURL)) {
             InputSource inSrc = new InputSource(xmlStream);
             inSrc.setSystemId(toSystemId(xmlURL));
-            parse(inSrc, schema, handler, lHandler);
+            parse(inSrc, schema, handler, lHandler, externalResources);
         }
     }
 
     public static void parse(InputStream xmlStream, URL schema, DefaultHandler handler,
             LexicalHandler lHandler) throws SAXException, IOException, ParserConfigurationException {
+        parse(xmlStream, schema, handler, lHandler, ExternalResources.fromSystemProperty());
+    }
+
+    public static void parse(InputStream xmlStream, URL schema, DefaultHandler handler,
+            LexicalHandler lHandler, final ExternalResources externalResources)
+            throws SAXException, IOException, ParserConfigurationException {
         parse(new InputSource(xmlStream), schema, handler, lHandler);
     }
 
     public static void parse(InputSource xmlStream, URL schema, DefaultHandler handler,
             LexicalHandler lHandler) throws SAXException, IOException, ParserConfigurationException {
-        parse(xmlStream, schema, handler, lHandler, true);
+        parse(xmlStream, schema, handler, lHandler, ExternalResources.fromSystemProperty());
+    }
+
+    public static void parse(final InputSource xmlStream, final URL schema,
+                             final DefaultHandler handler, final LexicalHandler lHandler,
+                             final boolean loadExternalDtds) throws SAXException, IOException,
+            ParserConfigurationException {
+        parse(xmlStream, schema, handler, lHandler,
+            loadExternalDtds ? ExternalResources.LOCAL_ONLY : ExternalResources.PROHIBIT);
     }
 
     @SuppressWarnings("deprecation")
-    public static void parse(InputSource xmlStream, URL schema, DefaultHandler handler,
-            LexicalHandler lHandler, boolean loadExternalDtds) throws SAXException, IOException,
+    public static void parse(final InputSource xmlStream, final URL schema,
+                             final DefaultHandler handler, final LexicalHandler lHandler,
+                             final ExternalResources externalResources) throws SAXException, IOException,
             ParserConfigurationException {
         InputStream schemaStream = null;
         try {
             if (schema != null) {
                 schemaStream = URLHandlerRegistry.getDefault().openStream(schema);
             }
-            SAXParser parser = XMLHelper.newSAXParser(schema, schemaStream, loadExternalDtds);
+            SAXParser parser = XMLHelper.newSAXParser(schema, schemaStream,
+                    isXmlDoctypeProcessingAllowed(), externalResources);
 
             if (lHandler != null) {
                 try {
@@ -157,7 +180,10 @@
                 }
             }
 
-            parser.parse(xmlStream, handler);
+            DefaultHandler h = externalResources == ExternalResources.IGNORE
+                ? new NoopEntityResolverDefaultHandler(handler)
+                : handler;
+            parser.parse(xmlStream, h);
         } finally {
             if (schemaStream != null) {
                 try {
@@ -170,7 +196,7 @@
     }
 
     public static boolean canUseSchemaValidation() {
-        return canUseSchemaValidation;
+        return true;
     }
 
     /**
@@ -216,15 +242,33 @@
 
     public static Document parseToDom(InputSource source, EntityResolver entityResolver)
             throws IOException, SAXException {
-        DocumentBuilder docBuilder = getDocBuilder(entityResolver);
+        return parseToDom(source, entityResolver, isXmlDoctypeProcessingAllowed(),
+            ExternalResources.fromSystemProperty());
+    }
+
+    public static Document parseToDom(InputSource source, EntityResolver entityResolver,
+            boolean allowXmlDoctypeProcessing, ExternalResources externalResources)
+            throws IOException, SAXException {
+        DocumentBuilder docBuilder = getDocBuilder(entityResolver, allowXmlDoctypeProcessing,
+            externalResources);
         return docBuilder.parse(source);
     }
 
     public static DocumentBuilder getDocBuilder(EntityResolver entityResolver) {
+        return getDocBuilder(entityResolver, isXmlDoctypeProcessingAllowed(),
+            ExternalResources.fromSystemProperty());
+    }
+
+    public static DocumentBuilder getDocBuilder(EntityResolver entityResolver,
+            boolean allowXmlDoctypeProcessing, ExternalResources externalResources) {
         try {
-            DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+            final DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
             factory.setValidating(false);
+            configureSafeFeatures(factory, allowXmlDoctypeProcessing, externalResources);
             DocumentBuilder docBuilder = factory.newDocumentBuilder();
+            if (externalResources == ExternalResources.IGNORE) {
+                entityResolver = new NoopEntityResolver(entityResolver);
+            }
             if (entityResolver != null) {
                 docBuilder.setEntityResolver(entityResolver);
             }
@@ -234,7 +278,335 @@
         }
     }
 
+    public static Transformer getTransformer(Source source) throws TransformerConfigurationException {
+        TransformerFactory factory = getTransformerFactory();
+        return factory.newTransformer(source);
+    }
+
+    public static TransformerHandler getTransformerHandler() throws TransformerConfigurationException {
+        SAXTransformerFactory factory = getTransformerFactory();
+        return factory.newTransformerHandler();
+    }
+
+    public enum ExternalResources {
+        PROHIBIT(""),
+        // technically the URIs for IGNORE will never get resolved at all.
+        // "all" pacifies some version of Java that check the property before delegating to the EntityResolver (which is
+        // going to return an empty content anyway)
+        IGNORE("all"),
+        LOCAL_ONLY("file, jar:file"),
+        ALL("all");
+
+        private final String allowedProtocols;
+
+        private ExternalResources(String allowedProtocols) {
+            this.allowedProtocols = allowedProtocols;
+        }
+
+        private String getAllowedProtocols() {
+            return allowedProtocols;
+        }
+
+        public static ExternalResources fromSystemProperty() {
+            final String val = System.getProperty(EXTERNAL_RESOURCES);
+            if (val != null) {
+                if (val.equalsIgnoreCase("ignore")) {
+                    return IGNORE;
+                }
+                if (val.equalsIgnoreCase("all")) {
+                    return ALL;
+                }
+                if (val.equalsIgnoreCase("local-only") || val.equalsIgnoreCase("local_only")) {
+                    return LOCAL_ONLY;
+                }
+            }
+            return PROHIBIT;
+        }
+    }
+
+    public static boolean isXmlDoctypeProcessingAllowed() {
+        return "true".equals(System.getProperty(ALLOW_DOCTYPE_PROCESSING));
+    }
+
     private XMLHelper() {
     }
 
+    private static SAXTransformerFactory getTransformerFactory() {
+        TransformerFactory factory = SAXTransformerFactory.newInstance();
+        configureSafeFeatures(factory);
+        return (SAXTransformerFactory) factory;
+    }
+
+    private static void configureSafeFeatures(final DocumentBuilderFactory factory,
+            final boolean allowXmlDoctypeProcessing, final ExternalResources externalResources) {
+        final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
+        trySetFeature(factory, DISALLOW_DOCTYPE_DECL, !allowXmlDoctypeProcessing);
+
+        // available since Java 6, as XMLConstants.FEATURE_SECURE_PROCESSING. We can't use Java 6
+        // at compile time, in current version, so inline the constant here
+        final String FEATURE_SECURE_PROCESSING = "http://javax.xml.XMLConstants/feature/secure-processing";
+        trySetFeature(factory, FEATURE_SECURE_PROCESSING, true);
+
+        final String ALLOW_EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
+        trySetFeature(factory, ALLOW_EXTERNAL_GENERAL_ENTITIES, false);
+
+        final String ALLOW_EXTERNAL_PARAM_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
+        trySetFeature(factory, ALLOW_EXTERNAL_PARAM_ENTITIES, false);
+
+        final String LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
+        trySetFeature(factory, LOAD_EXTERNAL_DTD, externalResources != ExternalResources.PROHIBIT);
+
+        try {
+            factory.setXIncludeAware(false);
+        } catch (Exception e) {
+            // ignore
+        }
+        try {
+            factory.setExpandEntityReferences(false);
+        } catch (Exception e) {
+            // ignore
+        }
+    }
+
+    private static void configureSafeFeatures(final SAXParserFactory factory,
+            final boolean allowXmlDoctypeProcessing, final ExternalResources externalResources) {
+        final String DISALLOW_DOCTYPE_DECL = "http://apache.org/xml/features/disallow-doctype-decl";
+        trySetFeature(factory, DISALLOW_DOCTYPE_DECL, !allowXmlDoctypeProcessing);
+
+        // available since Java 6, as XMLConstants.FEATURE_SECURE_PROCESSING. We can't use Java 6
+        // at compile time, in current version, so inline the constant here
+        final String FEATURE_SECURE_PROCESSING = "http://javax.xml.XMLConstants/feature/secure-processing";
+        trySetFeature(factory, FEATURE_SECURE_PROCESSING, true);
+
+        final boolean allowEntities = externalResources == ExternalResources.LOCAL_ONLY
+            || externalResources == ExternalResources.ALL;
+        final String ALLOW_EXTERNAL_GENERAL_ENTITIES = "http://xml.org/sax/features/external-general-entities";
+        trySetFeature(factory, ALLOW_EXTERNAL_GENERAL_ENTITIES, allowEntities);
+
+        final String ALLOW_EXTERNAL_PARAM_ENTITIES = "http://xml.org/sax/features/external-parameter-entities";
+        trySetFeature(factory, ALLOW_EXTERNAL_PARAM_ENTITIES, allowEntities);
+        final String LOAD_EXTERNAL_DTD = "http://apache.org/xml/features/nonvalidating/load-external-dtd";
+        trySetFeature(factory, LOAD_EXTERNAL_DTD, externalResources != ExternalResources.PROHIBIT);
+        try {
+            factory.setXIncludeAware(false);
+        } catch (Exception e) {
+            // ignore
+        }
+    }
+
+    private static void configureSafeFeatures(final TransformerFactory factory) {
+        // available since Java 7, as XMLConstants.ACCESS_EXTERNAL_DTD, ACCESS_EXTERNAL_SCHEMA and
+        // ACCESS_EXTERNAL_STYLESHEET respectively.
+        // We can't use Java 7 at compile time, in current version, so inline the constants here
+        trySetAttribute(factory, XML_ACCESS_EXTERNAL_DTD, "");
+        trySetAttribute(factory, XML_ACCESS_EXTERNAL_SCHEMA, "");
+        trySetAttribute(factory, "http://javax.xml.XMLConstants/property/accessExternalStylesheet", "");
+    }
+
+    private static boolean isFeatureSupported(final SAXParserFactory factory, final String feature) {
+        try {
+            factory.getFeature(feature);
+            return true;
+        } catch (ParserConfigurationException e) {
+            return false;
+        } catch (SAXNotRecognizedException e) {
+            return false;
+        } catch (SAXNotSupportedException e) {
+            return false;
+        }
+    }
+
+    private static boolean isFeatureSupported(final DocumentBuilderFactory factory, final String feature) {
+        try {
+            factory.getFeature(feature);
+            return true;
+        } catch (ParserConfigurationException e) {
+            return false;
+        }
+    }
+
+    private static boolean isAttributeSupported(final TransformerFactory factory, final String attribute) {
+        try {
+            factory.getAttribute(attribute);
+            return true;
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+    }
+
+    private static boolean trySetFeature(final DocumentBuilderFactory factory,
+                                               final String feature, final boolean val) {
+        if (!isFeatureSupported(factory, feature)) {
+            return false;
+        }
+        try {
+            factory.setFeature(feature, val);
+            return true;
+        } catch (ParserConfigurationException e) {
+            // log and continue
+            Message.warn("Failed to set feature " + feature + " on DocumentBuilderFactory", e);
+            return false;
+        }
+    }
+
+    private static boolean trySetFeature(final SAXParserFactory factory,
+                                         final String feature, final boolean val) {
+        if (!isFeatureSupported(factory, feature)) {
+            return false;
+        }
+        try {
+            factory.setFeature(feature, val);
+            return true;
+        } catch (ParserConfigurationException e) {
+            // log and continue
+            Message.warn("Failed to set feature " + feature + " on SAXParserFactory", e);
+            return false;
+        } catch (SAXNotRecognizedException e) {
+            // log and continue
+            Message.warn("Failed to set feature " + feature + " on SAXParserFactory", e);
+            return false;
+        } catch (SAXNotSupportedException e) {
+            // log and continue
+            Message.warn("Failed to set feature " + feature + " on SAXParserFactory", e);
+            return false;
+        }
+    }
+
+    private static boolean trySetAttribute(final TransformerFactory factory,
+                                         final String attribute, final String val) {
+        if (!isAttributeSupported(factory, attribute)) {
+            return false;
+        }
+        try {
+            factory.setAttribute(attribute, val);
+            return true;
+        } catch (IllegalArgumentException e) {
+            // log and continue
+            Message.warn("Failed to set attribute " + attribute + " on TransformerFactory", e);
+            return false;
+        }
+    }
+
+    private static final InputSource EMPTY_INPUT_SOURCE = new InputSource(new StringReader(""));
+
+    private static class NoopEntityResolver implements EntityResolver {
+        private EntityResolver wrapped;
+
+        private NoopEntityResolver(EntityResolver wrapped) {
+            this.wrapped = wrapped;
+        }
+
+        @Override
+        public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
+            if (wrapped != null) {
+                InputSource s = wrapped.resolveEntity(publicId, systemId);
+                if (s != null) {
+                    return s;
+                }
+            }
+            return EMPTY_INPUT_SOURCE;
+        }
+    }
+
+    private static class NoopEntityResolverDefaultHandler extends DefaultHandler {
+
+        private DefaultHandler wrapped;
+
+        private NoopEntityResolverDefaultHandler(DefaultHandler wrapped) {
+            this.wrapped = wrapped;
+        }
+
+        @Override
+        public InputSource resolveEntity(String publicId, String systemId) throws SAXException, IOException {
+            if (wrapped != null) {
+                InputSource s = wrapped.resolveEntity(publicId, systemId);
+                if (s != null) {
+                    return s;
+                }
+            }
+            return EMPTY_INPUT_SOURCE;
+        }
+
+        @Override
+        public void notationDecl(String name, String publicId, String systemId) throws SAXException {
+            wrapped.notationDecl(name, publicId, systemId);
+        }
+
+        @Override
+        public void unparsedEntityDecl(String name, String publicId, String systemId, String notationName)
+            throws SAXException {
+            wrapped.unparsedEntityDecl(name, publicId, systemId, notationName);
+        }
+
+        @Override
+        public void setDocumentLocator(Locator locator) {
+            wrapped.setDocumentLocator(locator);
+        }
+
+        @Override
+        public void startDocument() throws SAXException {
+            wrapped.startDocument();
+        }
+
+        @Override
+        public void endDocument() throws SAXException {
+            wrapped.endDocument();
+        }
+
+        @Override
+        public void startPrefixMapping(String prefix, String uri) throws SAXException {
+            wrapped.startPrefixMapping(prefix, uri);
+        }
+
+        @Override
+        public void endPrefixMapping(String prefix) throws SAXException {
+            wrapped.endPrefixMapping(prefix);
+        }
+
+        @Override
+        public void startElement(String uri, String localName, String qName, Attributes attributes)
+            throws SAXException {
+            wrapped.startElement(uri, localName, qName, attributes);
+        }
+
+        @Override
+        public void endElement(String uri, String localName, String qName) throws SAXException {
+            wrapped.endElement(uri, localName, qName);
+        }
+
+        @Override
+        public void characters(char[] ch, int start, int length) throws SAXException {
+            wrapped.characters(ch, start, length);
+        }
+
+        @Override
+        public void ignorableWhitespace(char[] ch, int start, int length) throws SAXException {
+            wrapped.ignorableWhitespace(ch, start, length);
+        }
+
+        @Override
+        public void processingInstruction(String target, String data) throws SAXException {
+            wrapped.processingInstruction(target, data);
+        }
+
+        @Override
+        public void skippedEntity(String name) throws SAXException {
+            wrapped.skippedEntity(name);
+        }
+
+        @Override
+        public void warning(SAXParseException e) throws SAXException {
+            wrapped.warning(e);
+        }
+
+        @Override
+        public void error(SAXParseException e) throws SAXException {
+            wrapped.error(e);
+        }
+
+        @Override
+        public void fatalError(SAXParseException e) throws SAXException {
+            wrapped.fatalError(e);
+        }
+    }
 }
diff --git a/test/java/org/apache/ivy/core/resolve/ResolveTest.java b/test/java/org/apache/ivy/core/resolve/ResolveTest.java
index 633ca64..5c61142 100644
--- a/test/java/org/apache/ivy/core/resolve/ResolveTest.java
+++ b/test/java/org/apache/ivy/core/resolve/ResolveTest.java
@@ -51,6 +51,7 @@
 import org.apache.ivy.util.CacheCleaner;
 import org.apache.ivy.util.FileUtil;
 import org.apache.ivy.util.MockMessageLogger;
+import org.apache.ivy.util.XMLHelper;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -74,6 +75,7 @@
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Properties;
 import java.util.Set;
 import java.util.jar.JarEntry;
 import java.util.jar.JarFile;
@@ -309,6 +311,43 @@
 
     @Test
     public void testResolveWithXmlEntities() {
+        testResolveWithXmlEntities(null, 0);
+        testResolveWithXmlEntities("prohibit", 0);
+        testResolveWithXmlEntities("ignore", 0);
+        testResolveWithXmlEntities("local-only", 2);
+        testResolveWithXmlEntities("LOCAL_ONLY", 2);
+        testResolveWithXmlEntities("all", 2);
+    }
+
+    private void testResolveWithXmlEntities(String externalResourcesSystemProperty,
+            int expectedNumberOfDependencies) {
+        Ivy ivy = new Ivy();
+        Throwable th = null;
+        Properties p = System.getProperties();
+        try {
+            System.setProperties(new Properties());
+            System.setProperty(XMLHelper.ALLOW_DOCTYPE_PROCESSING, "true");
+            if (externalResourcesSystemProperty != null) {
+                System.setProperty(XMLHelper.EXTERNAL_RESOURCES, externalResourcesSystemProperty);
+            }
+            ivy.configure(new File("test/repositories/xml-entities/ivysettings.xml"));
+            ResolveReport report = ivy.resolve(new File("test/repositories/xml-entities/ivy.xml"),
+                getResolveOptions(new String[] {"*"}));
+            assertNotNull(report);
+            assertFalse(report.hasError());
+            assertNotNull(report.getDependencies());
+            assertEquals("number of dependencies while setting " + externalResourcesSystemProperty,
+                expectedNumberOfDependencies, report.getDependencies().size());
+        } catch (Throwable e) {
+            th = e;
+        } finally {
+            System.setProperties(p);
+        }
+        assertNull(th);
+    }
+
+    @Test
+    public void testResolveWithXmlEntitiesButNoSystemProperty() {
         Ivy ivy = new Ivy();
         Throwable th = null;
         try {
@@ -320,7 +359,7 @@
         } catch (Throwable e) {
             th = e;
         }
-        assertNull(th);
+        assertNotNull(th);
     }
 
     @Test