diff --git a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriManifestParser.java b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriManifestParser.java
index 411e5b4..1080bf4 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriManifestParser.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriManifestParser.java
@@ -16,7 +16,6 @@
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.net.URI;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -24,11 +23,14 @@
 import java.util.Queue;
 import javax.xml.bind.JAXBContext;
 import javax.xml.bind.JAXBException;
-import javax.xml.bind.Unmarshaller;
+import javax.xml.stream.XMLInputFactory;
+import javax.xml.stream.XMLStreamException;
+import javax.xml.stream.XMLStreamReader;
+import javax.xml.transform.stream.StreamSource;
 import org.eclipse.jgit.lib.Repository;
 
 class JiriManifestParser {
-  public static JiriProjects GetProjects(Repository repo, String ref, String manifest)
+  public static JiriProjects getProjects(Repository repo, String ref, String manifest)
       throws Exception {
     Queue<String> q = new LinkedList<>();
     q.add(manifest);
@@ -72,12 +74,15 @@
   }
 
   private static JiriManifest parseManifest(Repository repo, String ref, String file)
-      throws JAXBException, IOException {
-    byte b[] = Utils.readBlob(repo, ref + ":" + file);
+      throws JAXBException, IOException, XMLStreamException {
+    byte[] b = Utils.readBlob(repo, ref + ":" + file);
     JAXBContext jc = JAXBContext.newInstance(JiriManifest.class);
-    Unmarshaller unmarshaller = jc.createUnmarshaller();
-    InputStream is = new ByteArrayInputStream(b);
-    JiriManifest manifest = (JiriManifest) unmarshaller.unmarshal(is);
-    return manifest;
+
+    XMLInputFactory inf = XMLInputFactory.newFactory();
+    inf.setProperty(XMLInputFactory.IS_SUPPORTING_EXTERNAL_ENTITIES, false);
+    inf.setProperty(XMLInputFactory.SUPPORT_DTD, false);
+    XMLStreamReader sr = inf.createXMLStreamReader(new StreamSource(new ByteArrayInputStream(b)));
+
+    return (JiriManifest) jc.createUnmarshaller().unmarshal(sr);
   }
 }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriProjects.java b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriProjects.java
index 663a6af..271e52e 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriProjects.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriProjects.java
@@ -179,8 +179,8 @@
   static class SortbyPath implements Comparator<Project> {
     @Override
     public int compare(Project a, Project b) {
-      String p1 = StringUtil.stripAndaddCharsAtEnd(a.getPath(), "/");
-      String p2 = StringUtil.stripAndaddCharsAtEnd(b.getPath(), "/");
+      String p1 = StringUtil.stripAndAddCharsAtEnd(a.getPath(), "/");
+      String p2 = StringUtil.stripAndAddCharsAtEnd(b.getPath(), "/");
       return p1.compareTo(p2);
     }
   }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriUpdater.java b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriUpdater.java
index 21fcbef..981e867 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriUpdater.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/JiriUpdater.java
@@ -1,13 +1,10 @@
 package com.googlesource.gerrit.plugins.supermanifest;
 
 import static com.google.gerrit.reviewdb.client.RefNames.REFS_HEADS;
-import static com.google.gerrit.reviewdb.client.RefNames.REFS_TAGS;
 
 import com.googlesource.gerrit.plugins.supermanifest.SuperManifestRefUpdatedListener.GerritRemoteReader;
 import java.net.URI;
 import java.text.MessageFormat;
-import java.util.Map;
-import org.eclipse.jgit.api.LsRemoteCommand;
 import org.eclipse.jgit.api.errors.ConcurrentRefUpdateException;
 import org.eclipse.jgit.api.errors.JGitInternalException;
 import org.eclipse.jgit.dircache.DirCache;
@@ -22,7 +19,6 @@
 import org.eclipse.jgit.lib.ObjectId;
 import org.eclipse.jgit.lib.ObjectInserter;
 import org.eclipse.jgit.lib.PersonIdent;
-import org.eclipse.jgit.lib.Ref;
 import org.eclipse.jgit.lib.RefUpdate;
 import org.eclipse.jgit.lib.RefUpdate.Result;
 import org.eclipse.jgit.lib.Repository;
@@ -62,8 +58,8 @@
         String path = proj.getPath();
         String nameUri = proj.getRemote();
         if (parent != null) {
-          String p1 = StringUtil.stripAndaddCharsAtEnd(path, "/");
-          String p2 = StringUtil.stripAndaddCharsAtEnd(parent, "/");
+          String p1 = StringUtil.stripAndAddCharsAtEnd(path, "/");
+          String p2 = StringUtil.stripAndAddCharsAtEnd(parent, "/");
           if (p1.startsWith(p2)) {
             warn(
                 "Skipping project %s(%s) as git doesn't support nested submodules",
@@ -161,7 +157,7 @@
   public void update(GerritRemoteReader reader, ConfigEntry c, String srcRef) throws Exception {
     Repository srcRepo = reader.openRepository(c.getSrcRepoKey().toString());
     Repository destRepo = reader.openRepository(c.getDestRepoKey().toString());
-    JiriProjects projects = JiriManifestParser.GetProjects(srcRepo, srcRef, c.getXmlPath());
+    JiriProjects projects = JiriManifestParser.getProjects(srcRepo, srcRef, c.getXmlPath());
     String targetRef = c.getDestBranch().equals("*") ? srcRef : REFS_HEADS + c.getDestBranch();
     updateSubmodules(destRepo, targetRef, projects, reader);
   }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/StringUtil.java b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/StringUtil.java
index 278a2b1..3472942 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/supermanifest/StringUtil.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/supermanifest/StringUtil.java
@@ -19,8 +19,7 @@
 class StringUtil {
   public static String addTab(String str) {
     StringBuffer buf = new StringBuffer("");
-    String arr[] = str.split("\n");
-    for (String s : arr) {
+    for (String s : str.split("\n")) {
       if (!s.trim().isEmpty()) {
         buf.append("\t" + s + " \n");
       }
@@ -28,8 +27,9 @@
     return buf.toString();
   }
 
-  public static String stripAndaddCharsAtEnd(String str, String chs) {
-    StringUtils.stripEnd(str, chs);
-    return str + chs;
+  public static String stripAndAddCharsAtEnd(String str, String chs) {
+    return StringUtils.stripEnd(str, chs) + chs;
   }
+
+  private StringUtil() {}
 }