Thanks for the provided XML file, your file contains some illegal ISO control chars, no illegal XML entities. I presume that these control chars are some chars that are coded in your classes and PMD simple recopy them and creates a bogus XML report. There's unfortunatly no clean solution, the Stax parser we're using simply does not handles it and generates an error during parsing. The solution is to replace found control chars by simple spaces during file reading to avoid to make the parser crash. This solution will be available in sonar 1.9.1
Regards.
Fixed with the new StaxParser, which supports undeclared XML entities