Correct solution is to let SAX handle the encoding, see: https://github.com/firewalld/firewalld/issues/303