Hi Maarten, thanks for taking the time to test my patch--I apologize for not finding this out before asking you take time to look at it.
I have been running a patched version of Ivy with my proposed fix in my local Eclipse, and thanks so far work, so I was lulled into thinking the semantics where the same. Obviously it does not, so I'll look some more in to this.
What do you think of adding another arg to XMLHelper.parse, called loadExternalDtds, which defaults=true, but can be set false?
The reason is that IvyDE's IvySettingsContentDescriptor, AFAICT, does not need external DTDs to work, because it uses a custom default handler to just look for the root element of "ivysettings" and then stops.
Given how often Eclipse asks IvyDE this question (once per XML file in the project, on a regular basis, AFAICT), it seems useful to allow IvySettingsContentDescriptor to opt out of DTD loading.
I can work up a patch that does this, if you approve. Of if you have other suggestions, let me know and I can try those out too.