diff --git a/NEWS.md b/NEWS.md
index 72318b7f..6c290678 100644
--- a/NEWS.md
+++ b/NEWS.md
@@ -1,5 +1,75 @@
 # News
 
+## 3.3.6 - 2024-08-22 {#version-3-3-6}
+
+### Improvements
+
+  * Removed duplicated entity expansions for performance.
+    * GH-194
+    * Patch by Viktor Ivarsson.
+
+  * Improved namespace conflicted attribute check performance. It was
+    too slow for deep elements.
+    * Reported by l33thaxor.
+
+### Fixes
+
+  * Fixed a bug that default entity expansions are counted for
+    security check. Default entity expansions should not be counted
+    because they don't have a security risk.
+    * GH-198
+    * GH-199
+    * Patch Viktor Ivarsson
+
+  * Fixed a parser bug that parameter entity references in internal
+    subsets are expanded. It's not allowed in the XML specification.
+    * GH-191
+    * Patch by NAITOH Jun.
+
+  * Fixed a stream parser bug that user-defined entity references in
+    text aren't expanded.
+    * GH-200
+    * Patch by NAITOH Jun.
+
+### Thanks
+
+  * Viktor Ivarsson
+
+  * NAITOH Jun
+
+  * l33thaxor
+
+## 3.3.5 - 2024-08-12 {#version-3-3-5}
+
+### Fixes
+
+  * Fixed a bug that `REXML::Security.entity_expansion_text_limit`
+    check has wrong text size calculation in SAX and pull parsers.
+    * GH-193
+    * GH-195
+    * Reported by Viktor Ivarsson.
+    * Patch by NAITOH Jun.
+
+### Thanks
+
+  * Viktor Ivarsson
+
+  * NAITOH Jun
+
+## 3.3.4 - 2024-08-01 {#version-3-3-4}
+
+### Fixes
+
+  * Fixed a bug that `REXML::Security` isn't defined when
+    `REXML::Parsers::StreamParser` is used and
+    `rexml/parsers/streamparser` is only required.
+    * GH-189
+    * Patch by takuya kodama.
+
+### Thanks
+
+  * takuya kodama
+
 ## 3.3.3 - 2024-08-01 {#version-3-3-3}
 
 ### Improvements
diff --git a/lib/rexml/element.rb b/lib/rexml/element.rb
index a5808d7c..4e3a60b9 100644
--- a/lib/rexml/element.rb
+++ b/lib/rexml/element.rb
@@ -441,9 +441,14 @@ def root_node
     # Related: #root_node, #document.
     #
     def root
-      return elements[1] if self.kind_of? Document
-      return self if parent.kind_of? Document or parent.nil?
-      return parent.root
+      target = self
+      while target
+        return target.elements[1] if target.kind_of? Document
+        parent = target.parent
+        return target if parent.kind_of? Document or parent.nil?
+        target = parent
+      end
+      nil
     end
 
     # :call-seq:
@@ -619,8 +624,12 @@ def namespace(prefix=nil)
       else
         prefix = "xmlns:#{prefix}" unless prefix[0,5] == 'xmlns'
       end
-      ns = attributes[ prefix ]
-      ns = parent.namespace(prefix) if ns.nil? and parent
+      ns = nil
+      target = self
+      while ns.nil? and target
+        ns = target.attributes[prefix]
+        target = target.parent
+      end
       ns = '' if ns.nil? and prefix == 'xmlns'
       return ns
     end
@@ -2375,17 +2384,6 @@ def []=( name, value )
       elsif old_attr.kind_of? Hash
         old_attr[value.prefix] = value
       elsif old_attr.prefix != value.prefix
-        # Check for conflicting namespaces
-        if value.prefix != "xmlns" and old_attr.prefix != "xmlns"
-          old_namespace = old_attr.namespace
-          new_namespace = value.namespace
-          if old_namespace == new_namespace
-            raise ParseException.new(
-                    "Namespace conflict in adding attribute \"#{value.name}\": "+
-                    "Prefix \"#{old_attr.prefix}\" = \"#{old_namespace}\" and "+
-                    "prefix \"#{value.prefix}\" = \"#{new_namespace}\"")
-          end
-        end
         store value.name, {old_attr.prefix => old_attr,
                            value.prefix    => value}
       else
diff --git a/lib/rexml/entity.rb b/lib/rexml/entity.rb
index 573db691..12bbad3f 100644
--- a/lib/rexml/entity.rb
+++ b/lib/rexml/entity.rb
@@ -12,6 +12,7 @@ class Entity < Child
     EXTERNALID = "(?:(?:(SYSTEM)\\s+#{SYSTEMLITERAL})|(?:(PUBLIC)\\s+#{PUBIDLITERAL}\\s+#{SYSTEMLITERAL}))"
     NDATADECL = "\\s+NDATA\\s+#{NAME}"
     PEREFERENCE = "%#{NAME};"
+    PEREFERENCE_RE = /#{PEREFERENCE}/um
     ENTITYVALUE = %Q{((?:"(?:[^%&"]|#{PEREFERENCE}|#{REFERENCE})*")|(?:'([^%&']|#{PEREFERENCE}|#{REFERENCE})*'))}
     PEDEF = "(?:#{ENTITYVALUE}|#{EXTERNALID})"
     ENTITYDEF = "(?:#{ENTITYVALUE}|(?:#{EXTERNALID}(#{NDATADECL})?))"
@@ -19,7 +20,7 @@ class Entity < Child
     GEDECL = "<!ENTITY\\s+#{NAME}\\s+#{ENTITYDEF}\\s*>"
     ENTITYDECL = /\s*(?:#{GEDECL})|(?:#{PEDECL})/um
 
-    attr_reader :name, :external, :ref, :ndata, :pubid
+    attr_reader :name, :external, :ref, :ndata, :pubid, :value
 
     # Create a new entity.  Simple entities can be constructed by passing a
     # name, value to the constructor; this creates a generic, plain entity
@@ -68,14 +69,11 @@ def Entity::matches? string
     end
 
     # Evaluates to the unnormalized value of this entity; that is, replacing
-    # all entities -- both %ent; and &ent; entities.  This differs from
-    # +value()+ in that +value+ only replaces %ent; entities.
+    # &ent; entities.
     def unnormalized
       document.record_entity_expansion unless document.nil?
-      v = value()
-      return nil if v.nil?
-      @unnormalized = Text::unnormalize(v, parent)
-      @unnormalized
+      return nil if @value.nil?
+      @unnormalized = Text::unnormalize(@value, parent)
     end
 
     #once :unnormalized
@@ -121,46 +119,6 @@ def to_s
       write rv
       rv
     end
-
-    PEREFERENCE_RE = /#{PEREFERENCE}/um
-    # Returns the value of this entity.  At the moment, only internal entities
-    # are processed.  If the value contains internal references (IE,
-    # %blah;), those are replaced with their values.  IE, if the doctype
-    # contains:
-    #  <!ENTITY % foo "bar">
-    #  <!ENTITY yada "nanoo %foo; nanoo>
-    # then:
-    #  doctype.entity('yada').value   #-> "nanoo bar nanoo"
-    def value
-      @resolved_value ||= resolve_value
-    end
-
-    def parent=(other)
-      @resolved_value = nil
-      super
-    end
-
-    private
-    def resolve_value
-      return nil if @value.nil?
-      return @value unless @value.match?(PEREFERENCE_RE)
-
-      matches = @value.scan(PEREFERENCE_RE)
-      rv = @value.clone
-      if @parent
-        sum = 0
-        matches.each do |entity_reference|
-          entity_value = @parent.entity( entity_reference[0] )
-          if sum + entity_value.bytesize > Security.entity_expansion_text_limit
-            raise "entity expansion has grown too large"
-          else
-            sum += entity_value.bytesize
-          end
-          rv.gsub!( /%#{entity_reference.join};/um, entity_value )
-        end
-      end
-      rv
-    end
   end
 
   # This is a set of entity constants -- the ones defined in the XML
diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
index 44dc6580..d11c2766 100644
--- a/lib/rexml/parsers/baseparser.rb
+++ b/lib/rexml/parsers/baseparser.rb
@@ -1,12 +1,29 @@
 # frozen_string_literal: true
 require_relative '../parseexception'
 require_relative '../undefinednamespaceexception'
+require_relative '../security'
 require_relative '../source'
 require 'set'
 require "strscan"
 
 module REXML
   module Parsers
+    unless [].respond_to?(:tally)
+      module EnumerableTally
+        refine Enumerable do
+          def tally
+            counts = {}
+            each do |item|
+              counts[item] ||= 0
+              counts[item] += 1
+            end
+            counts
+          end
+        end
+      end
+      using EnumerableTally
+    end
+
     if StringScanner::Version < "3.0.8"
       module StringScannerCaptures
         refine StringScanner do
@@ -124,6 +141,7 @@ class BaseParser
       }
 
       module Private
+        PEREFERENCE_PATTERN = /#{PEREFERENCE}/um
         TAG_PATTERN = /((?>#{QNAME_STR}))\s*/um
         CLOSE_PATTERN = /(#{QNAME_STR})\s*>/um
         ATTLISTDECL_END = /\s+#{NAME}(?:#{ATTDEF})*\s*>/um
@@ -163,7 +181,8 @@ def stream=( source )
         @tags = []
         @stack = []
         @entities = []
-        @nsstack = []
+        @namespaces = {}
+        @namespaces_restore_stack = []
       end
 
       def position
@@ -231,6 +250,10 @@ def pull_event
           if @document_status == :in_doctype
             raise ParseException.new("Malformed DOCTYPE: unclosed", @source)
           end
+          unless @tags.empty?
+            path = "/" + @tags.join("/")
+            raise ParseException.new("Missing end tag for '#{path}'", @source)
+          end
           return [ :end_document ]
         end
         return @stack.shift if @stack.size > 0
@@ -263,7 +286,6 @@ def pull_event
                 @source.position = start_position
                 raise REXML::ParseException.new(message, @source)
               end
-              @nsstack.unshift(Set.new)
               name = parse_name(base_error_message)
               if @source.match(/\s*\[/um, true)
                 id = [nil, nil, nil]
@@ -333,6 +355,8 @@ def pull_event
                 match[4] = match[4][1..-2] # HREF
                 match.delete_at(5) if match.size > 5 # Chop out NDATA decl
                 # match is [ :entity, name, PUBLIC, pubid, href(, ndata)? ]
+              elsif Private::PEREFERENCE_PATTERN.match?(match[2])
+                raise REXML::ParseException.new("Parameter entity references forbidden in internal subset: #{match[2]}", @source)
               else
                 match[2] = match[2][1..-2]
                 match.pop if match.size == 4
@@ -355,7 +379,7 @@ def pull_event
                   val = attdef[4] if val == "#FIXED "
                   pairs[attdef[0]] = val
                   if attdef[0] =~ /^xmlns:(.*)/
-                    @nsstack[0] << $1
+                    @namespaces[$1] = val
                   end
                 end
               end
@@ -408,7 +432,7 @@ def pull_event
             # here explicitly.
             @source.ensure_buffer
             if @source.match("/", true)
-              @nsstack.shift
+              @namespaces_restore_stack.pop
               last_tag = @tags.pop
               md = @source.match(Private::CLOSE_PATTERN, true)
               if md and !last_tag
@@ -453,18 +477,18 @@ def pull_event
               @document_status = :in_element
               @prefixes.clear
               @prefixes << md[2] if md[2]
-              @nsstack.unshift(curr_ns=Set.new)
-              attributes, closed = parse_attributes(@prefixes, curr_ns)
+              push_namespaces_restore
+              attributes, closed = parse_attributes(@prefixes)
               # Verify that all of the prefixes have been defined
               for prefix in @prefixes
-                unless @nsstack.find{|k| k.member?(prefix)}
+                unless @namespaces.key?(prefix)
                   raise UndefinedNamespaceException.new(prefix,@source,self)
                 end
               end
 
               if closed
                 @closed = tag
-                @nsstack.shift
+                pop_namespaces_restore
               else
                 if @tags.empty? and @have_root
                   raise ParseException.new("Malformed XML: Extra tag at the end of the document (got '<#{tag}')", @source)
@@ -504,15 +528,13 @@ def pull_event
       private :pull_event
 
       def entity( reference, entities )
-        value = nil
-        value = entities[ reference ] if entities
-        if value
-          record_entity_expansion
-        else
-          value = DEFAULT_ENTITIES[ reference ]
-          value = value[2] if value
-        end
-        unnormalize( value, entities ) if value
+        return unless entities
+
+        value = entities[ reference ]
+        return if value.nil?
+
+        record_entity_expansion
+        unnormalize( value, entities )
       end
 
       # Escapes all possible entities
@@ -546,22 +568,29 @@ def unnormalize( string, entities=nil, filter=nil )
           [Integer(m)].pack('U*')
         }
         matches.collect!{|x|x[0]}.compact!
+        if filter
+          matches.reject! do |entity_reference|
+            filter.include?(entity_reference)
+          end
+        end
         if matches.size > 0
-          sum = 0
-          matches.each do |entity_reference|
-            unless filter and filter.include?(entity_reference)
-              entity_value = entity( entity_reference, entities )
-              if entity_value
-                re = Private::DEFAULT_ENTITIES_PATTERNS[entity_reference] || /&#{entity_reference};/
-                rv.gsub!( re, entity_value )
-                sum += rv.bytesize
-                if sum > Security.entity_expansion_text_limit
-                  raise "entity expansion has grown too large"
-                end
-              else
-                er = DEFAULT_ENTITIES[entity_reference]
-                rv.gsub!( er[0], er[2] ) if er
+          matches.tally.each do |entity_reference, n|
+            entity_expansion_count_before = @entity_expansion_count
+            entity_value = entity( entity_reference, entities )
+            if entity_value
+              if n > 1
+                entity_expansion_count_delta =
+                  @entity_expansion_count - entity_expansion_count_before
+                record_entity_expansion(entity_expansion_count_delta * (n - 1))
               end
+              re = Private::DEFAULT_ENTITIES_PATTERNS[entity_reference] || /&#{entity_reference};/
+              rv.gsub!( re, entity_value )
+              if rv.bytesize > Security.entity_expansion_text_limit
+                raise "entity expansion has grown too large"
+              end
+            else
+              er = DEFAULT_ENTITIES[entity_reference]
+              rv.gsub!( er[0], er[2] ) if er
             end
           end
           rv.gsub!( Private::DEFAULT_ENTITIES_PATTERNS['amp'], '&' )
@@ -570,9 +599,34 @@ def unnormalize( string, entities=nil, filter=nil )
       end
 
       private
+      def add_namespace(prefix, uri)
+        @namespaces_restore_stack.last[prefix] = @namespaces[prefix]
+        if uri.nil?
+          @namespaces.delete(prefix)
+        else
+          @namespaces[prefix] = uri
+        end
+      end
+
+      def push_namespaces_restore
+        namespaces_restore = {}
+        @namespaces_restore_stack.push(namespaces_restore)
+        namespaces_restore
+      end
 
-      def record_entity_expansion
-        @entity_expansion_count += 1
+      def pop_namespaces_restore
+        namespaces_restore = @namespaces_restore_stack.pop
+        namespaces_restore.each do |prefix, uri|
+          if uri.nil?
+            @namespaces.delete(prefix)
+          else
+            @namespaces[prefix] = uri
+          end
+        end
+      end
+
+      def record_entity_expansion(delta=1)
+        @entity_expansion_count += delta
         if @entity_expansion_count > Security.entity_expansion_limit
           raise "number of entity expansions exceeded, processing aborted."
         end
@@ -698,8 +752,9 @@ def process_instruction
         [:processing_instruction, name, content]
       end
 
-      def parse_attributes(prefixes, curr_ns)
+      def parse_attributes(prefixes)
         attributes = {}
+        expanded_names = {}
         closed = false
         while true
           if @source.match(">", true)
@@ -741,7 +796,7 @@ def parse_attributes(prefixes, curr_ns)
                   "(http://www.w3.org/TR/REC-xml-names/#ns-decl)"
                 raise REXML::ParseException.new( msg, @source, self)
               end
-              curr_ns << local_part
+              add_namespace(local_part, value)
             elsif prefix
               prefixes << prefix unless prefix == "xml"
             end
@@ -751,6 +806,20 @@ def parse_attributes(prefixes, curr_ns)
               raise REXML::ParseException.new(msg, @source, self)
             end
 
+            unless prefix == "xmlns"
+              uri = @namespaces[prefix]
+              expanded_name = [uri, local_part]
+              existing_prefix = expanded_names[expanded_name]
+              if existing_prefix
+                message = "Namespace conflict in adding attribute " +
+                          "\"#{local_part}\": " +
+                          "Prefix \"#{existing_prefix}\" = \"#{uri}\" and " +
+                          "prefix \"#{prefix}\" = \"#{uri}\""
+                raise REXML::ParseException.new(message, @source, self)
+              end
+              expanded_names[expanded_name] = prefix
+            end
+
             attributes[name] = value
           else
             message = "Invalid attribute name: <#{@source.buffer.split(%r{[/>\s]}).first}>"
diff --git a/lib/rexml/parsers/streamparser.rb b/lib/rexml/parsers/streamparser.rb
index fa3ac496..7781fe44 100644
--- a/lib/rexml/parsers/streamparser.rb
+++ b/lib/rexml/parsers/streamparser.rb
@@ -7,36 +7,33 @@ class StreamParser
       def initialize source, listener
         @listener = listener
         @parser = BaseParser.new( source )
-        @tag_stack = []
+        @entities = {}
       end
 
       def add_listener( listener )
         @parser.add_listener( listener )
       end
 
+      def entity_expansion_count
+        @parser.entity_expansion_count
+      end
+
       def parse
         # entity string
         while true
           event = @parser.pull
           case event[0]
           when :end_document
-            unless @tag_stack.empty?
-              tag_path = "/" + @tag_stack.join("/")
-              raise ParseException.new("Missing end tag for '#{tag_path}'",
-                                       @parser.source)
-            end
             return
           when :start_element
-            @tag_stack << event[1]
             attrs = event[2].each do |n, v|
               event[2][n] = @parser.unnormalize( v )
             end
             @listener.tag_start( event[1], attrs )
           when :end_element
             @listener.tag_end( event[1] )
-            @tag_stack.pop
           when :text
-            unnormalized = @parser.unnormalize( event[1] )
+            unnormalized = @parser.unnormalize( event[1], @entities )
             @listener.text( unnormalized )
           when :processing_instruction
             @listener.instruction( *event[1,2] )
@@ -48,6 +45,7 @@ def parse
           when :comment, :attlistdecl, :cdata, :xmldecl, :elementdecl
             @listener.send( event[0].to_s, *event[1..-1] )
           when :entitydecl, :notationdecl
+            @entities[ event[1] ] = event[2] if event.size == 3
             @listener.send( event[0].to_s, event[1..-1] )
           when :externalentity
             entity_reference = event[1]
diff --git a/lib/rexml/parsers/treeparser.rb b/lib/rexml/parsers/treeparser.rb
index 0cb6f7cc..4565a406 100644
--- a/lib/rexml/parsers/treeparser.rb
+++ b/lib/rexml/parsers/treeparser.rb
@@ -15,7 +15,6 @@ def add_listener( listener )
       end
 
       def parse
-        tag_stack = []
         entities = nil
         begin
           while true
@@ -23,19 +22,13 @@ def parse
             #STDERR.puts "TREEPARSER GOT #{event.inspect}"
             case event[0]
             when :end_document
-              unless tag_stack.empty?
-                raise ParseException.new("No close tag for #{@build_context.xpath}",
-                                         @parser.source, @parser)
-              end
               return
             when :start_element
-              tag_stack.push(event[1])
               el = @build_context = @build_context.add_element( event[1] )
               event[2].each do |key, value|
                 el.attributes[key]=Attribute.new(key,value,self)
               end
             when :end_element
-              tag_stack.pop
               @build_context = @build_context.parent
             when :text
               if @build_context[-1].instance_of? Text
diff --git a/lib/rexml/rexml.rb b/lib/rexml/rexml.rb
index 39e92a57..99d574b3 100644
--- a/lib/rexml/rexml.rb
+++ b/lib/rexml/rexml.rb
@@ -31,7 +31,7 @@
 module REXML
   COPYRIGHT = "Copyright © 2001-2008 Sean Russell <ser@germane-software.com>"
   DATE = "2008/019"
-  VERSION = "3.3.3"
+  VERSION = "3.3.6"
   REVISION = ""
 
   Copyright = COPYRIGHT
diff --git a/test/parse/test_element.rb b/test/parse/test_element.rb
index 2b0746ea..ab4818da 100644
--- a/test/parse/test_element.rb
+++ b/test/parse/test_element.rb
@@ -131,5 +131,19 @@ def test_linear_performance_attribute_value_gt
         REXML::Document.new('<test testing="' + ">" * n + '"></test>')
       end
     end
+
+    def test_linear_performance_deep_same_name_attributes
+      seq = [100, 500, 1000, 1500, 2000]
+      assert_linear_performance(seq, rehearsal: 10) do |n|
+        xml = <<-XML
+<?xml version="1.0"?>
+<root xmlns:ns="ns-uri">
+#{"<x ns:name='ns-value' name='value'>\n" * n}
+#{"</x>\n" * n}
+</root>
+        XML
+        REXML::Document.new(xml)
+      end
+    end
   end
 end
diff --git a/test/parser/test_sax2.rb b/test/parser/test_sax2.rb
index 91d135f5..c2548907 100644
--- a/test/parser/test_sax2.rb
+++ b/test/parser/test_sax2.rb
@@ -4,200 +4,200 @@
 require "rexml/sax2listener"
 
 module REXMLTests
-class TestSAX2Parser < Test::Unit::TestCase
-  class TestDocumentTypeDeclaration < self
-    private
-    def xml(internal_subset)
-      <<-XML
+  class TestSAX2Parser < Test::Unit::TestCase
+    class TestDocumentTypeDeclaration < self
+      private
+      def xml(internal_subset)
+        <<-XML
 <!DOCTYPE r SYSTEM "urn:x-henrikmartensson:test" [
 #{internal_subset}
 ]>
 <r/>
-      XML
-    end
+        XML
+      end
 
-    class TestEntityDeclaration < self
-      class Listener
-        include REXML::SAX2Listener
-        attr_reader :entity_declarations
-        def initialize
-          @entity_declarations = []
-        end
+      class TestEntityDeclaration < self
+        class Listener
+          include REXML::SAX2Listener
+          attr_reader :entity_declarations
+          def initialize
+            @entity_declarations = []
+          end
 
-        def entitydecl(declaration)
-          super
-          @entity_declarations << declaration
+          def entitydecl(declaration)
+            super
+            @entity_declarations << declaration
+          end
         end
-      end
 
-      private
-      def parse(internal_subset)
-        listener = Listener.new
-        parser = REXML::Parsers::SAX2Parser.new(xml(internal_subset))
-        parser.listen(listener)
-        parser.parse
-        listener.entity_declarations
-      end
+        private
+        def parse(internal_subset)
+          listener = Listener.new
+          parser = REXML::Parsers::SAX2Parser.new(xml(internal_subset))
+          parser.listen(listener)
+          parser.parse
+          listener.entity_declarations
+        end
 
-      class TestGeneralEntity < self
-        class TestValue < self
-          def test_double_quote
-            assert_equal([["name", "value"]], parse(<<-INTERNAL_SUBSET))
+        class TestGeneralEntity < self
+          class TestValue < self
+            def test_double_quote
+              assert_equal([["name", "value"]], parse(<<-INTERNAL_SUBSET))
 <!ENTITY name "value">
-            INTERNAL_SUBSET
-          end
+              INTERNAL_SUBSET
+            end
 
-          def test_single_quote
-            assert_equal([["name", "value"]], parse(<<-INTERNAL_SUBSET))
+            def test_single_quote
+              assert_equal([["name", "value"]], parse(<<-INTERNAL_SUBSET))
 <!ENTITY name 'value'>
-            INTERNAL_SUBSET
+              INTERNAL_SUBSET
+            end
           end
-        end
 
-        class TestExternlID < self
-          class TestSystem < self
-            def test_with_ndata
-              declaration = [
-                "name",
-                "SYSTEM", "system-literal",
-                "NDATA", "ndata-name",
-              ]
-              assert_equal([declaration],
-                           parse(<<-INTERNAL_SUBSET))
+          class TestExternlID < self
+            class TestSystem < self
+              def test_with_ndata
+                declaration = [
+                  "name",
+                  "SYSTEM", "system-literal",
+                  "NDATA", "ndata-name",
+                ]
+                assert_equal([declaration],
+                             parse(<<-INTERNAL_SUBSET))
 <!ENTITY name SYSTEM "system-literal" NDATA ndata-name>
+                INTERNAL_SUBSET
+              end
+
+              def test_without_ndata
+                declaration = [
+                  "name",
+                  "SYSTEM", "system-literal",
+                ]
+                assert_equal([declaration],
+                             parse(<<-INTERNAL_SUBSET))
+<!ENTITY name SYSTEM "system-literal">
+                INTERNAL_SUBSET
+              end
+            end
+
+            class TestPublic < self
+              def test_with_ndata
+                declaration = [
+                  "name",
+                  "PUBLIC", "public-literal", "system-literal",
+                  "NDATA", "ndata-name",
+                ]
+                assert_equal([declaration],
+                             parse(<<-INTERNAL_SUBSET))
+<!ENTITY name PUBLIC "public-literal" "system-literal" NDATA ndata-name>
+                INTERNAL_SUBSET
+              end
+
+              def test_without_ndata
+                declaration = [
+                  "name",
+                  "PUBLIC", "public-literal", "system-literal",
+                ]
+                assert_equal([declaration], parse(<<-INTERNAL_SUBSET))
+<!ENTITY name PUBLIC "public-literal" "system-literal">
+                INTERNAL_SUBSET
+              end
+            end
+          end
+        end
+
+        class TestParameterEntity < self
+          class TestValue < self
+            def test_double_quote
+              assert_equal([["%", "name", "value"]], parse(<<-INTERNAL_SUBSET))
+<!ENTITY % name "value">
               INTERNAL_SUBSET
             end
 
-            def test_without_ndata
-              declaration = [
-                "name",
-                "SYSTEM", "system-literal",
-              ]
-              assert_equal([declaration],
-                           parse(<<-INTERNAL_SUBSET))
-<!ENTITY name SYSTEM "system-literal">
+            def test_single_quote
+              assert_equal([["%", "name", "value"]], parse(<<-INTERNAL_SUBSET))
+<!ENTITY % name 'value'>
               INTERNAL_SUBSET
             end
           end
 
-          class TestPublic < self
-            def test_with_ndata
+          class TestExternlID < self
+            def test_system
               declaration = [
+                "%",
                 "name",
-                "PUBLIC", "public-literal", "system-literal",
-                "NDATA", "ndata-name",
+                "SYSTEM", "system-literal",
               ]
               assert_equal([declaration],
-                           parse(<<-INTERNAL_SUBSET))
-<!ENTITY name PUBLIC "public-literal" "system-literal" NDATA ndata-name>
+                             parse(<<-INTERNAL_SUBSET))
+<!ENTITY % name SYSTEM "system-literal">
               INTERNAL_SUBSET
             end
 
-            def test_without_ndata
+            def test_public
               declaration = [
+                "%",
                 "name",
                 "PUBLIC", "public-literal", "system-literal",
               ]
               assert_equal([declaration], parse(<<-INTERNAL_SUBSET))
-<!ENTITY name PUBLIC "public-literal" "system-literal">
+<!ENTITY % name PUBLIC "public-literal" "system-literal">
               INTERNAL_SUBSET
             end
           end
         end
       end
 
-      class TestParameterEntity < self
-        class TestValue < self
-          def test_double_quote
-            assert_equal([["%", "name", "value"]], parse(<<-INTERNAL_SUBSET))
-<!ENTITY % name "value">
-            INTERNAL_SUBSET
+      class TestNotationDeclaration < self
+        class Listener
+          include REXML::SAX2Listener
+          attr_reader :notation_declarations
+          def initialize
+            @notation_declarations = []
           end
 
-          def test_single_quote
-            assert_equal([["%", "name", "value"]], parse(<<-INTERNAL_SUBSET))
-<!ENTITY % name 'value'>
-            INTERNAL_SUBSET
+          def notationdecl(*declaration)
+            super
+            @notation_declarations << declaration
           end
         end
 
+        private
+        def parse(internal_subset)
+          listener = Listener.new
+          parser = REXML::Parsers::SAX2Parser.new(xml(internal_subset))
+          parser.listen(listener)
+          parser.parse
+          listener.notation_declarations
+        end
+
         class TestExternlID < self
           def test_system
-            declaration = [
-              "%",
-              "name",
-              "SYSTEM", "system-literal",
-            ]
+            declaration = ["name", "SYSTEM", nil, "system-literal"]
             assert_equal([declaration],
-                           parse(<<-INTERNAL_SUBSET))
-<!ENTITY % name SYSTEM "system-literal">
+                         parse(<<-INTERNAL_SUBSET))
+<!NOTATION name SYSTEM "system-literal">
             INTERNAL_SUBSET
           end
 
           def test_public
-            declaration = [
-              "%",
-              "name",
-              "PUBLIC", "public-literal", "system-literal",
-            ]
+            declaration = ["name", "PUBLIC", "public-literal", "system-literal"]
             assert_equal([declaration], parse(<<-INTERNAL_SUBSET))
-<!ENTITY % name PUBLIC "public-literal" "system-literal">
+<!NOTATION name PUBLIC "public-literal" "system-literal">
             INTERNAL_SUBSET
           end
         end
-      end
-    end
 
-    class TestNotationDeclaration < self
-      class Listener
-        include REXML::SAX2Listener
-        attr_reader :notation_declarations
-        def initialize
-          @notation_declarations = []
-        end
-
-        def notationdecl(*declaration)
-          super
-          @notation_declarations << declaration
-        end
-      end
-
-      private
-      def parse(internal_subset)
-        listener = Listener.new
-        parser = REXML::Parsers::SAX2Parser.new(xml(internal_subset))
-        parser.listen(listener)
-        parser.parse
-        listener.notation_declarations
-      end
-
-      class TestExternlID < self
-        def test_system
-          declaration = ["name", "SYSTEM", nil, "system-literal"]
-          assert_equal([declaration],
-                       parse(<<-INTERNAL_SUBSET))
-<!NOTATION name SYSTEM "system-literal">
-          INTERNAL_SUBSET
-        end
-
-        def test_public
-          declaration = ["name", "PUBLIC", "public-literal", "system-literal"]
-          assert_equal([declaration], parse(<<-INTERNAL_SUBSET))
-<!NOTATION name PUBLIC "public-literal" "system-literal">
-          INTERNAL_SUBSET
-        end
-      end
-
-      class TestPublicID < self
-        def test_literal
-          declaration = ["name", "PUBLIC", "public-literal", nil]
-          assert_equal([declaration],
-                       parse(<<-INTERNAL_SUBSET))
+        class TestPublicID < self
+          def test_literal
+            declaration = ["name", "PUBLIC", "public-literal", nil]
+            assert_equal([declaration],
+                         parse(<<-INTERNAL_SUBSET))
 <!NOTATION name PUBLIC "public-literal">
-          INTERNAL_SUBSET
+            INTERNAL_SUBSET
+          end
         end
       end
     end
   end
 end
-end
diff --git a/test/parser/test_tree.rb b/test/parser/test_tree.rb
index 8a5d9d12..315be9c2 100644
--- a/test/parser/test_tree.rb
+++ b/test/parser/test_tree.rb
@@ -4,40 +4,39 @@
 require "rexml/parsers/treeparser"
 
 module REXMLTests
-class TestTreeParser < Test::Unit::TestCase
-  class TestInvalid < self
-    def test_unmatched_close_tag
-      xml = "<root></not-root>"
-      exception = assert_raise(REXML::ParseException) do
-        parse(xml)
-      end
-      assert_equal(<<-MESSAGE, exception.to_s)
+  class TestTreeParser < Test::Unit::TestCase
+    private def parse(xml)
+      document = REXML::Document.new
+      parser = REXML::Parsers::TreeParser.new(xml, document)
+      parser.parse
+    end
+
+    class TestInvalid < self
+      def test_unmatched_close_tag
+        xml = "<root></not-root>"
+        exception = assert_raise(REXML::ParseException) do
+          parse(xml)
+        end
+        assert_equal(<<-MESSAGE, exception.to_s)
 Missing end tag for 'root' (got 'not-root')
 Line: 1
 Position: #{xml.bytesize}
 Last 80 unconsumed characters:
-      MESSAGE
-    end
-
-    def test_no_close_tag
-      xml = "<root>"
-      exception = assert_raise(REXML::ParseException) do
-        parse(xml)
+        MESSAGE
       end
-      assert_equal(<<-MESSAGE, exception.to_s)
-No close tag for /root
+
+      def test_no_close_tag
+        xml = "<root>"
+        exception = assert_raise(REXML::ParseException) do
+          parse(xml)
+        end
+        assert_equal(<<-MESSAGE, exception.to_s)
+Missing end tag for '/root'
 Line: 1
 Position: #{xml.bytesize}
 Last 80 unconsumed characters:
-      MESSAGE
-    end
-
-    private
-    def parse(xml)
-      document = REXML::Document.new
-      parser = REXML::Parsers::TreeParser.new(xml, document)
-      parser.parse
+        MESSAGE
+      end
     end
   end
 end
-end
diff --git a/test/parser/test_ultra_light.rb b/test/parser/test_ultra_light.rb
index b3f576ff..d1364d6a 100644
--- a/test/parser/test_ultra_light.rb
+++ b/test/parser/test_ultra_light.rb
@@ -3,66 +3,66 @@
 require "rexml/parsers/ultralightparser"
 
 module REXMLTests
-class TestUltraLightParser < Test::Unit::TestCase
-  class TestDocumentTypeDeclaration < self
-    def test_entity_declaration
-      assert_equal([
-                     [
-                       :start_doctype,
-                       :parent,
-                       "root",
-                       "SYSTEM",
-                       "urn:x-test",
-                       nil,
-                       [:entitydecl, "name", "value"]
+  class TestUltraLightParser < Test::Unit::TestCase
+    class TestDocumentTypeDeclaration < self
+      def test_entity_declaration
+        assert_equal([
+                       [
+                         :start_doctype,
+                         :parent,
+                         "root",
+                         "SYSTEM",
+                         "urn:x-test",
+                         nil,
+                         [:entitydecl, "name", "value"]
+                       ],
+                       [:start_element, :parent, "root", {}],
                      ],
-                     [:start_element, :parent, "root", {}],
-                   ],
-                   parse(<<-INTERNAL_SUBSET))
+                     parse(<<-INTERNAL_SUBSET))
 <!ENTITY name "value">
-      INTERNAL_SUBSET
-    end
+        INTERNAL_SUBSET
+      end
 
-    private
-    def xml(internal_subset)
-      <<-XML
+      private
+      def xml(internal_subset)
+        <<-XML
 <!DOCTYPE root SYSTEM "urn:x-test" [
 #{internal_subset}
 ]>
 <root/>
-      XML
-    end
+        XML
+      end
 
-    def parse(internal_subset)
-      parser = REXML::Parsers::UltraLightParser.new(xml(internal_subset))
-      normalize(parser.parse)
-    end
+      def parse(internal_subset)
+        parser = REXML::Parsers::UltraLightParser.new(xml(internal_subset))
+        normalize(parser.parse)
+      end
 
-    def normalize(root)
-      root.collect do |child|
-        normalize_child(child)
+      def normalize(root)
+        root.collect do |child|
+          normalize_child(child)
+        end
       end
-    end
 
-    def normalize_child(child)
-      tag = child.first
-      case tag
-      when :start_doctype
-        normalized_parent = :parent
-        normalized_doctype = child.dup
-        normalized_doctype[1] = normalized_parent
-        normalized_doctype
-      when :start_element
-        tag, _parent, name, attributes, *children = child
-        normalized_parent = :parent
-        normalized_children = children.collect do |sub_child|
-          normalize_child(sub_child)
+      def normalize_child(child)
+        tag = child.first
+        case tag
+        when :start_doctype
+          normalized_parent = :parent
+          normalized_doctype = child.dup
+          normalized_doctype[1] = normalized_parent
+          normalized_doctype
+        when :start_element
+          tag, _parent, name, attributes, *children = child
+          normalized_parent = :parent
+          normalized_children = children.collect do |sub_child|
+            normalize_child(sub_child)
+          end
+          [tag, normalized_parent, name, attributes, *normalized_children]
+        else
+          child
         end
-        [tag, normalized_parent, name, attributes, *normalized_children]
-      else
-        child
       end
     end
   end
 end
-end
diff --git a/test/test_core.rb b/test/test_core.rb
index e1fba8a7..48666c86 100644
--- a/test/test_core.rb
+++ b/test/test_core.rb
@@ -114,10 +114,28 @@ def test_attribute
         name4='test4'/>).join(' '), e.to_s
     end
 
-    def test_attribute_namespace_conflict
+    def test_attribute_duplicated
       # https://www.w3.org/TR/xml-names/#uniqAttrs
       message = <<-MESSAGE.chomp
 Duplicate attribute "a"
+Line: 2
+Position: 24
+Last 80 unconsumed characters:
+/>
+      MESSAGE
+      assert_raise(REXML::ParseException.new(message)) do
+        Document.new(<<-XML)
+<x>
+  <bad a="1" a="2"/>
+</x>
+        XML
+      end
+    end
+
+    def test_attribute_namespace_conflict
+      # https://www.w3.org/TR/xml-names/#uniqAttrs
+      message = <<-MESSAGE.chomp
+Namespace conflict in adding attribute "a": Prefix "n1" = "http://www.w3.org" and prefix "n2" = "http://www.w3.org"
 Line: 4
 Position: 140
 Last 80 unconsumed characters:
@@ -127,9 +145,8 @@ def test_attribute_namespace_conflict
         Document.new(<<-XML)
 <!-- http://www.w3.org is bound to n1 and n2 -->
 <x xmlns:n1="http://www.w3.org"
-   xmlns:n2="http://www.w3.org" >
-  <bad a="1"     a="2" />
-  <bad n1:a="1"  n2:a="2" />
+   xmlns:n2="http://www.w3.org">
+  <bad n1:a="1" n2:a="2"/>
 </x>
         XML
       end
diff --git a/test/test_document.rb b/test/test_document.rb
index 0764631d..25a8828f 100644
--- a/test/test_document.rb
+++ b/test/test_document.rb
@@ -33,10 +33,12 @@ def test_new
     class EntityExpansionLimitTest < Test::Unit::TestCase
       def setup
         @default_entity_expansion_limit = REXML::Security.entity_expansion_limit
+        @default_entity_expansion_text_limit = REXML::Security.entity_expansion_text_limit
       end
 
       def teardown
         REXML::Security.entity_expansion_limit = @default_entity_expansion_limit
+        REXML::Security.entity_expansion_text_limit = @default_entity_expansion_text_limit
       end
 
       class GeneralEntityTest < self
@@ -126,55 +128,23 @@ def test_with_default_entity
             doc.root.children.first.value
           end
         end
-      end
-
-      class ParameterEntityTest < self
-        def test_have_value
-          xml = <<EOF
-<!DOCTYPE root [
-  <!ENTITY % a "BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.BOOM.">
-  <!ENTITY % b "%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;">
-  <!ENTITY % c "%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;">
-  <!ENTITY % d "%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;">
-  <!ENTITY % e "%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;">
-  <!ENTITY % f "%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;">
-  <!ENTITY % g "%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;">
-  <!ENTITY test "test %g;">
-]>
-<cd></cd>
-EOF
 
-          assert_raise(REXML::ParseException) do
-            REXML::Document.new(xml)
-          end
-          REXML::Security.entity_expansion_limit = 100
-          assert_equal(100, REXML::Security.entity_expansion_limit)
-          assert_raise(REXML::ParseException) do
-            REXML::Document.new(xml)
-          end
-        end
-
-        def test_empty_value
-          xml = <<EOF
-<!DOCTYPE root [
-  <!ENTITY % a "">
-  <!ENTITY % b "%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;%a;">
-  <!ENTITY % c "%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;%b;">
-  <!ENTITY % d "%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;%c;">
-  <!ENTITY % e "%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;%d;">
-  <!ENTITY % f "%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;%e;">
-  <!ENTITY % g "%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;%f;">
-  <!ENTITY test "test %g;">
+        def test_entity_expansion_text_limit
+          xml = <<-XML
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE member [
+  <!ENTITY a "&b;&b;&b;">
+  <!ENTITY b "&c;&d;&e;">
+  <!ENTITY c "xxxxxxxxxx">
+  <!ENTITY d "yyyyyyyyyy">
+  <!ENTITY e "zzzzzzzzzz">
 ]>
-<cd></cd>
-EOF
+<member>&a;</member>
+          XML
 
-          REXML::Document.new(xml)
-          REXML::Security.entity_expansion_limit = 90
-          assert_equal(90, REXML::Security.entity_expansion_limit)
-          assert_raise(REXML::ParseException) do
-            REXML::Document.new(xml)
-          end
+          REXML::Security.entity_expansion_text_limit = 90
+          doc = REXML::Document.new(xml)
+          assert_equal(90, doc.root.children.first.value.bytesize)
         end
       end
     end
diff --git a/test/test_entity.rb b/test/test_entity.rb
index a2b262f7..89f83894 100644
--- a/test/test_entity.rb
+++ b/test/test_entity.rb
@@ -59,8 +59,7 @@ def test_parse_entity
 
     def test_constructor
       one = [ %q{<!ENTITY % YN '"Yes"'>},
-        %q{<!ENTITY % YN2 "Yes">},
-        %q{<!ENTITY WhatHeSaid "He said %YN;">},
+        %q{<!ENTITY WhatHeSaid 'He said "Yes"'>},
         '<!ENTITY open-hatch
                 SYSTEM "http://www.textuality.com/boilerplate/OpenHatch.xml">',
         '<!ENTITY open-hatch2
@@ -71,8 +70,7 @@ def test_constructor
                 NDATA gif>' ]
       source = %q{<!DOCTYPE foo [
         <!ENTITY % YN '"Yes"'>
-        <!ENTITY % YN2 "Yes">
-        <!ENTITY WhatHeSaid "He said %YN;">
+        <!ENTITY WhatHeSaid 'He said "Yes"'>
         <!ENTITY open-hatch
                 SYSTEM "http://www.textuality.com/boilerplate/OpenHatch.xml">
         <!ENTITY open-hatch2
@@ -104,6 +102,84 @@ def test_replace_entities
       assert_equal source, out
     end
 
+    def test_readers_with_reference
+      entity = REXML::Entity.new([:entitydecl, "a", "B", "%"])
+      assert_equal([
+                     '<!ENTITY % a "B">',
+                     "a",
+                     "B",
+                     "B",
+                     "B",
+                   ],
+                   [
+                     entity.to_s,
+                     entity.name,
+                     entity.value,
+                     entity.normalized,
+                     entity.unnormalized,
+                   ])
+    end
+
+    def test_readers_without_reference
+      entity = REXML::Entity.new([:entitydecl, "a", "&b;"])
+      assert_equal([
+                     '<!ENTITY a "&b;">',
+                     "a",
+                     "&b;",
+                     "&b;",
+                     "&b;",
+                   ],
+                   [
+                     entity.to_s,
+                     entity.name,
+                     entity.value,
+                     entity.normalized,
+                     entity.unnormalized,
+                   ])
+    end
+
+    def test_readers_with_nested_references
+      doctype = REXML::DocType.new('root')
+      doctype.add(REXML::Entity.new([:entitydecl, "a", "&b;"]))
+      doctype.add(REXML::Entity.new([:entitydecl, "b", "X"]))
+      assert_equal([
+                     "a",
+                     "&b;",
+                     "&b;",
+                     "X",
+                     "b",
+                     "X",
+                     "X",
+                     "X",
+                  ],
+                   [
+                     doctype.entities["a"].name,
+                     doctype.entities["a"].value,
+                     doctype.entities["a"].normalized,
+                     doctype.entities["a"].unnormalized,
+                     doctype.entities["b"].name,
+                     doctype.entities["b"].value,
+                     doctype.entities["b"].normalized,
+                     doctype.entities["b"].unnormalized,
+                   ])
+    end
+
+    def test_parameter_entity_reference_forbidden_by_internal_subset_in_parser
+      source = '<!DOCTYPE root [ <!ENTITY % a "B" > <!ENTITY c "%a;" > ]><root/>'
+      parser = REXML::Parsers::BaseParser.new(source)
+      exception = assert_raise(REXML::ParseException) do
+        while parser.has_next?
+          parser.pull
+        end
+      end
+      assert_equal(<<-DETAIL, exception.to_s)
+Parameter entity references forbidden in internal subset: "%a;"
+Line: 1
+Position: 54
+Last 80 unconsumed characters:
+      DETAIL
+    end
+
     def test_entity_string_limit
       template = '<!DOCTYPE bomb [ <!ENTITY a "^" > ]> <bomb>$</bomb>'
       len      = 5120 # 5k per entity
@@ -122,22 +198,6 @@ def test_entity_string_limit
       end
     end
 
-    def test_entity_string_limit_for_parameter_entity
-      template = '<!DOCTYPE bomb [ <!ENTITY % a "^" > <!ENTITY bomb "$" > ]><root/>'
-      len      = 5120 # 5k per entity
-      template.sub!(/\^/, "B" * len)
-
-      # 10k is OK
-      entities = '%a;' * 2 # 5k entity * 2 = 10k
-      REXML::Document.new(template.sub(/\$/, entities))
-
-      # above 10k explodes
-      entities = '%a;' * 3 # 5k entity * 2 = 15k
-      assert_raise(REXML::ParseException) do
-        REXML::Document.new(template.sub(/\$/, entities))
-      end
-    end
-
     def test_raw
       source = '<!DOCTYPE foo [
 <!ENTITY ent "replace">
@@ -161,7 +221,7 @@ def test_lazy_evaluation
     def test_entity_replacement
       source = %q{<!DOCTYPE foo [
       <!ENTITY % YN '"Yes"'>
-      <!ENTITY WhatHeSaid "He said %YN;">]>
+      <!ENTITY WhatHeSaid 'He said "Yes"'>]>
       <a>&WhatHeSaid;</a>}
 
       d = REXML::Document.new( source )
diff --git a/test/test_pullparser.rb b/test/test_pullparser.rb
index 55205af8..005a106a 100644
--- a/test/test_pullparser.rb
+++ b/test/test_pullparser.rb
@@ -159,10 +159,12 @@ def test_peek
     class EntityExpansionLimitTest < Test::Unit::TestCase
       def setup
         @default_entity_expansion_limit = REXML::Security.entity_expansion_limit
+        @default_entity_expansion_text_limit = REXML::Security.entity_expansion_text_limit
       end
 
       def teardown
         REXML::Security.entity_expansion_limit = @default_entity_expansion_limit
+        REXML::Security.entity_expansion_text_limit = @default_entity_expansion_text_limit
       end
 
       class GeneralEntityTest < self
@@ -204,21 +206,23 @@ def test_empty_value
 </member>
           XML
 
+          REXML::Security.entity_expansion_limit = 100000
           parser = REXML::Parsers::PullParser.new(source)
-          assert_raise(RuntimeError.new("number of entity expansions exceeded, processing aborted.")) do
-            while parser.has_next?
-              parser.pull
-            end
+          while parser.has_next?
+            parser.pull
           end
+          assert_equal(11111, parser.entity_expansion_count)
 
-          REXML::Security.entity_expansion_limit = 100
+          REXML::Security.entity_expansion_limit = @default_entity_expansion_limit
           parser = REXML::Parsers::PullParser.new(source)
           assert_raise(RuntimeError.new("number of entity expansions exceeded, processing aborted.")) do
             while parser.has_next?
               parser.pull
             end
           end
-          assert_equal(101, parser.entity_expansion_count)
+          assert do
+            parser.entity_expansion_count > @default_entity_expansion_limit
+          end
         end
 
         def test_with_default_entity
@@ -249,6 +253,64 @@ def test_with_default_entity
             end
           end
         end
+
+        def test_with_only_default_entities
+          member_value = "&lt;p&gt;#{'A' * @default_entity_expansion_text_limit}&lt;/p&gt;"
+          source = <<-XML
+<?xml version="1.0" encoding="UTF-8"?>
+<member>
+#{member_value}
+</member>
+          XML
+
+          parser = REXML::Parsers::PullParser.new(source)
+          events = {}
+          element_name = ''
+          while parser.has_next?
+            event = parser.pull
+            case event.event_type
+            when :start_element
+              element_name = event[0]
+            when :text
+              events[element_name] = event[1]
+            end
+          end
+
+          expected_value = "<p>#{'A' * @default_entity_expansion_text_limit}</p>"
+          assert_equal(expected_value, events['member'].strip)
+          assert_equal(0, parser.entity_expansion_count)
+          assert do
+            events['member'].bytesize > @default_entity_expansion_text_limit
+          end
+        end
+
+        def test_entity_expansion_text_limit
+          source = <<-XML
+<!DOCTYPE member [
+  <!ENTITY a "&b;&b;&b;">
+  <!ENTITY b "&c;&d;&e;">
+  <!ENTITY c "xxxxxxxxxx">
+  <!ENTITY d "yyyyyyyyyy">
+  <!ENTITY e "zzzzzzzzzz">
+]>
+<member>&a;</member>
+          XML
+
+          REXML::Security.entity_expansion_text_limit = 90
+          parser = REXML::Parsers::PullParser.new(source)
+          events = {}
+          element_name = ''
+          while parser.has_next?
+            event = parser.pull
+            case event.event_type
+            when :start_element
+              element_name = event[0]
+            when :text
+              events[element_name] = event[1]
+            end
+          end
+          assert_equal(90, events['member'].size)
+        end
       end
     end
   end
diff --git a/test/test_sax.rb b/test/test_sax.rb
index 5e3ad75b..ae17e364 100644
--- a/test/test_sax.rb
+++ b/test/test_sax.rb
@@ -102,10 +102,12 @@ def test_sax2
     class EntityExpansionLimitTest < Test::Unit::TestCase
       def setup
         @default_entity_expansion_limit = REXML::Security.entity_expansion_limit
+        @default_entity_expansion_text_limit = REXML::Security.entity_expansion_text_limit
       end
 
       def teardown
         REXML::Security.entity_expansion_limit = @default_entity_expansion_limit
+        REXML::Security.entity_expansion_text_limit = @default_entity_expansion_text_limit
       end
 
       class GeneralEntityTest < self
@@ -145,17 +147,19 @@ def test_empty_value
 </member>
           XML
 
+          REXML::Security.entity_expansion_limit = 100000
           sax = REXML::Parsers::SAX2Parser.new(source)
-          assert_raise(RuntimeError.new("number of entity expansions exceeded, processing aborted.")) do
-            sax.parse
-          end
+          sax.parse
+          assert_equal(11111, sax.entity_expansion_count)
 
-          REXML::Security.entity_expansion_limit = 100
+          REXML::Security.entity_expansion_limit = @default_entity_expansion_limit
           sax = REXML::Parsers::SAX2Parser.new(source)
           assert_raise(RuntimeError.new("number of entity expansions exceeded, processing aborted.")) do
             sax.parse
           end
-          assert_equal(101, sax.entity_expansion_count)
+          assert do
+            sax.entity_expansion_count > @default_entity_expansion_limit
+          end
         end
 
         def test_with_default_entity
@@ -182,6 +186,52 @@ def test_with_default_entity
             sax.parse
           end
         end
+
+        def test_with_only_default_entities
+          member_value = "&lt;p&gt;#{'A' * @default_entity_expansion_text_limit}&lt;/p&gt;"
+          source = <<-XML
+<?xml version="1.0" encoding="UTF-8"?>
+<member>
+#{member_value}
+</member>
+          XML
+
+          sax = REXML::Parsers::SAX2Parser.new(source)
+          text_value = nil
+          sax.listen(:characters, ["member"]) do |text|
+            text_value = text
+          end
+          sax.parse
+
+          expected_value = "<p>#{'A' * @default_entity_expansion_text_limit}</p>"
+          assert_equal(expected_value, text_value.strip)
+          assert_equal(0, sax.entity_expansion_count)
+          assert do
+            text_value.bytesize > @default_entity_expansion_text_limit
+          end
+        end
+
+        def test_entity_expansion_text_limit
+          source = <<-XML
+<!DOCTYPE member [
+  <!ENTITY a "&b;&b;&b;">
+  <!ENTITY b "&c;&d;&e;">
+  <!ENTITY c "xxxxxxxxxx">
+  <!ENTITY d "yyyyyyyyyy">
+  <!ENTITY e "zzzzzzzzzz">
+]>
+<member>&a;</member>
+          XML
+
+          REXML::Security.entity_expansion_text_limit = 90
+          sax = REXML::Parsers::SAX2Parser.new(source)
+          text_size = nil
+          sax.listen(:characters, ["member"]) do |text|
+            text_size = text.size
+          end
+          sax.parse
+          assert_equal(90, text_size)
+        end
       end
     end
 
diff --git a/test/test_stream.rb b/test/test_stream.rb
index 545d5349..782066c2 100644
--- a/test/test_stream.rb
+++ b/test/test_stream.rb
@@ -87,8 +87,184 @@ def entity(content)
 
       assert_equal(["ISOLat2"], listener.entities)
     end
+
+    def test_entity_replacement
+      source = <<-XML
+<!DOCTYPE foo [
+  <!ENTITY la "1234">
+  <!ENTITY lala "--&la;--">
+  <!ENTITY lalal "&la;&la;">
+]><a><la>&la;</la><lala>&lala;</lala></a>
+      XML
+
+      listener = MyListener.new
+      class << listener
+        attr_accessor :text_values
+        def text(text)
+          @text_values << text
+        end
+      end
+      listener.text_values = []
+      REXML::Document.parse_stream(source, listener)
+      assert_equal(["1234", "--1234--"], listener.text_values)
+    end
+
+    def test_characters_predefined_entities
+      source = '<root><a>&lt;P&gt; &lt;I&gt; &lt;B&gt; Text &lt;/B&gt;  &lt;/I&gt;</a></root>'
+
+      listener = MyListener.new
+      class << listener
+        attr_accessor :text_value
+        def text(text)
+          @text_value << text
+        end
+      end
+      listener.text_value = ""
+      REXML::Document.parse_stream(source, listener)
+      assert_equal("<P> <I> <B> Text </B>  </I>", listener.text_value)
+    end
   end
 
+  class EntityExpansionLimitTest < Test::Unit::TestCase
+    def setup
+      @default_entity_expansion_limit = REXML::Security.entity_expansion_limit
+      @default_entity_expansion_text_limit = REXML::Security.entity_expansion_text_limit
+    end
+
+    def teardown
+      REXML::Security.entity_expansion_limit = @default_entity_expansion_limit
+      REXML::Security.entity_expansion_text_limit = @default_entity_expansion_text_limit
+    end
+
+    def test_have_value
+      source = <<-XML
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE member [
+  <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
+  <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
+  <!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
+  <!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
+  <!ENTITY e "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
+]>
+<member>
+&a;
+</member>
+      XML
+
+      assert_raise(RuntimeError.new("entity expansion has grown too large")) do
+        REXML::Document.parse_stream(source, MyListener.new)
+      end
+    end
+
+    def test_empty_value
+      source = <<-XML
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE member [
+  <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
+  <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
+  <!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
+  <!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
+  <!ENTITY e "">
+]>
+<member>
+&a;
+</member>
+      XML
+
+      listener = MyListener.new
+      REXML::Security.entity_expansion_limit = 100000
+      parser = REXML::Parsers::StreamParser.new( source, listener )
+      parser.parse
+      assert_equal(11111, parser.entity_expansion_count)
+
+      REXML::Security.entity_expansion_limit = @default_entity_expansion_limit
+      parser = REXML::Parsers::StreamParser.new( source, listener )
+      assert_raise(RuntimeError.new("number of entity expansions exceeded, processing aborted.")) do
+        parser.parse
+      end
+      assert do
+        parser.entity_expansion_count > @default_entity_expansion_limit
+      end
+    end
+
+    def test_with_default_entity
+      source = <<-XML
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE member [
+  <!ENTITY a "a">
+  <!ENTITY a2 "&a; &a;">
+]>
+<member>
+&a;
+&a2;
+&lt;
+</member>
+      XML
+
+      listener = MyListener.new
+      REXML::Security.entity_expansion_limit = 4
+      REXML::Document.parse_stream(source, listener)
+
+      REXML::Security.entity_expansion_limit = 3
+      assert_raise(RuntimeError.new("number of entity expansions exceeded, processing aborted.")) do
+        REXML::Document.parse_stream(source, listener)
+      end
+    end
+
+    def test_with_only_default_entities
+      member_value = "&lt;p&gt;#{'A' * @default_entity_expansion_text_limit}&lt;/p&gt;"
+      source = <<-XML
+<?xml version="1.0" encoding="UTF-8"?>
+<member>
+#{member_value}
+</member>
+      XML
+
+      listener = MyListener.new
+      class << listener
+        attr_accessor :text_value
+        def text(text)
+          @text_value << text
+        end
+      end
+      listener.text_value = ""
+      parser = REXML::Parsers::StreamParser.new( source, listener )
+      parser.parse
+
+      expected_value = "<p>#{'A' * @default_entity_expansion_text_limit}</p>"
+      assert_equal(expected_value, listener.text_value.strip)
+      assert_equal(0, parser.entity_expansion_count)
+      assert do
+        listener.text_value.bytesize > @default_entity_expansion_text_limit
+      end
+    end
+
+    def test_entity_expansion_text_limit
+      source = <<-XML
+<!DOCTYPE member [
+  <!ENTITY a "&b;&b;&b;">
+  <!ENTITY b "&c;&d;&e;">
+  <!ENTITY c "xxxxxxxxxx">
+  <!ENTITY d "yyyyyyyyyy">
+  <!ENTITY e "zzzzzzzzzz">
+]>
+<member>&a;</member>
+      XML
+
+      listener = MyListener.new
+      class << listener
+        attr_accessor :text_value
+        def text(text)
+          @text_value << text
+        end
+      end
+      listener.text_value = ""
+      REXML::Security.entity_expansion_text_limit = 90
+      REXML::Document.parse_stream(source, listener)
+
+      assert_equal(90, listener.text_value.size)
+    end
+  end
 
   # For test_listener
   class RequestReader