i ran into a similar issue with a URL, i do something like:

xmlTmplFile.getContents().replace(/\&/, '$amp;')

(it's not a great idea, but it worked.)