The source MUST change the XML to convert & (and other specific characters used for markup) to the proper entity character. E.g. change & and &. It is not valid XML otherwise and there is nothing that you should do on your side to accomodate that invalid XML.