--- a/jaxp/src/javax/xml/transform/FactoryFinder.java	Wed Jul 05 18:46:58 2017 +0200
+++ b/jaxp/src/javax/xml/transform/FactoryFinder.java	Mon Feb 18 11:33:35 2013 -0800
@@ -43,6 +43,7 @@
  * @author Huizhe.Wang@oracle.com
  */
 class FactoryFinder {
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xalan.internal.";
 
     /**
      * Internal debug flag.
@@ -169,6 +170,14 @@
     static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader, boolean useServicesMechanism)
         throws ConfigurationError
     {
+        // make sure we have access to restricted packages
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                cl = null;
+                useBSClsLoader = true;
+            }
+        }
+
         try {
             Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
             Object instance = null;