jdk-sandbox: comparison jaxp/src/javax/xml/stream/FactoryFinder.java

equal deleted inserted replaced

-:bcebd3fdefc9
+:a44e04deb948
 * questions.
 */
 package javax.xml.stream;
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
 import java.io.InputStream;
-import java.io.IOException;
+import java.io.InputStreamReader;
-import java.io.File;
-import java.io.FileInputStream;
 import java.util.Properties;
-import java.io.BufferedReader;
-import java.io.InputStreamReader;
 /**
 * <p>Implements pluggable Datatypes.</p>
 *
 * <p>This class is duplicated for each JAXP subpackage so keep it in
 * sync.  It is package private for secure class loading.</p>
 *
 * @author Santiago.PericasGeertsen@sun.com
 */
 class FactoryFinder {
+// Check we have access to package.
+private static final String DEFAULT_PACKAGE = "com.sun.xml.internal.";
 /**
 * Internal debug flag.
 */
 private static boolean debug = false;
 * tried.
 *
 * If the class loader supplied is <code>null</code>, first try using the
 * context class loader followed by the current (i.e. bootstrap) class
 * loader.
+*
+* Use bootstrap classLoader if cl = null and useBSClsLoader is true
 */
 static private Class getProviderClass(String className, ClassLoader cl,
-boolean doFallback) throws ClassNotFoundException
+boolean doFallback, boolean useBSClsLoader) throws ClassNotFoundException
 {
 try {
 if (cl == null) {
-cl = ss.getContextClassLoader();
+if (useBSClsLoader) {
-if (cl == null) {
+return Class.forName(className, true, FactoryFinder.class.getClassLoader());
-throw new ClassNotFoundException();
+} else {
-}
+cl = ss.getContextClassLoader();
-else {
+if (cl == null) {
-return cl.loadClass(className);
+throw new ClassNotFoundException();
+}
+else {
+return cl.loadClass(className);
+}
 }
 }
 else {
 return cl.loadClass(className);
 }
 * <code>getProviderClass()</code> in order to load the class.
 *
 * @param className Name of the concrete class corresponding to the
 * service provider
 *
-* @param cl ClassLoader to use to load the class, null means to use
+* @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code>
-* the bootstrap ClassLoader
+* current <code>Thread</code>'s context classLoader is used to load the factory class.
 *
 * @param doFallback True if the current ClassLoader should be tried as
 * a fallback if the class is not found using cl
 */
 static Object newInstance(String className, ClassLoader cl, boolean doFallback)
 throws ConfigurationError
 {
-try {
+return newInstance(className, cl, doFallback, false);
-Class providerClass = getProviderClass(className, cl, doFallback);
+}
+/**
+* Create an instance of a class. Delegates to method
+* <code>getProviderClass()</code> in order to load the class.
+*
+* @param className Name of the concrete class corresponding to the
+* service provider
+*
+* @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code>
+* current <code>Thread</code>'s context classLoader is used to load the factory class.
+*
+* @param doFallback True if the current ClassLoader should be tried as
+* a fallback if the class is not found using cl
+*
+* @param useBSClsLoader True if cl=null actually meant bootstrap classLoader. This parameter
+* is needed since DocumentBuilderFactory/SAXParserFactory defined null as context classLoader.
+*/
+static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader)
+throws ConfigurationError
+{
+// make sure we have access to restricted packages
+if (System.getSecurityManager() != null) {
+if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+cl = null;
+useBSClsLoader = true;
+}
+}
+try {
+Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
 Object instance = providerClass.newInstance();
 if (debug) {    // Extra check to avoid computing cl strings
 dPrint("created new instance of " + providerClass +
 " using ClassLoader: " + cl);
 }
 "lib" + File.separator + "jaxp.properties";
 f = new File(configFile);
 if (ss.doesFileExist(f)) {
 dPrint("Read properties file "+f);
 cacheProps.load(ss.getFileInputStream(f));
-}
-}
 }
+}
+}
 }
 }
 factoryClassName = cacheProps.getProperty(factoryId);
 if (factoryClassName != null) {
 String serviceId = "META-INF/services/" + factoryId;
 InputStream is = null;
 // First try the Context ClassLoader
 ClassLoader cl = ss.getContextClassLoader();
+boolean useBSClsLoader = false;
 if (cl != null) {
 is = ss.getResourceAsStream(cl, serviceId);
 // If no provider found then try the current ClassLoader
 if (is == null) {
 cl = FactoryFinder.class.getClassLoader();
 is = ss.getResourceAsStream(cl, serviceId);
+useBSClsLoader = true;
 }
 } else {
 // No Context ClassLoader, try the current ClassLoader
 cl = FactoryFinder.class.getClassLoader();
 is = ss.getResourceAsStream(cl, serviceId);
+useBSClsLoader = true;
 }
 if (is == null) {
 // No provider found
 return null;
 // Note: here we do not want to fall back to the current
 // ClassLoader because we want to avoid the case where the
 // resource file was found using one ClassLoader and the
 // provider class was instantiated using a different one.
-return newInstance(factoryClassName, cl, false);
+return newInstance(factoryClassName, cl, false, useBSClsLoader);
 }
 // No provider found
 return null;
 }

changeset 16953	a44e04deb948
parent 12458	d601e4bba306
child 17264	3aff554ad461