--- a/jaxp/src/javax/xml/validation/SchemaFactoryFinder.java	Wed Jul 05 18:46:58 2017 +0200
+++ b/jaxp/src/javax/xml/validation/SchemaFactoryFinder.java	Mon Feb 18 11:33:35 2013 -0800
@@ -54,6 +54,7 @@
      *<p> Take care of restrictions imposed by java security model </p>
      */
     private static SecuritySupport ss = new SecuritySupport();
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
     /**
      * <p>Cache properties for performance.</p>
      */
@@ -213,28 +214,6 @@
             }
         }
 
-        /**
-        // try to read from $java.home/lib/jaxp.properties
-        try {
-            String javah = ss.getSystemProperty( "java.home" );
-            String configFile = javah + File.separator +
-            "lib" + File.separator + "jaxp.properties";
-            File f = new File( configFile );
-            if( ss.doesFileExist(f)) {
-                sf = loadFromProperty(
-                        propertyName,f.getAbsolutePath(), new FileInputStream(f));
-                if(sf!=null)    return sf;
-            } else {
-                debugPrintln("Tried to read "+ f.getAbsolutePath()+", but it doesn't exist.");
-            }
-        } catch(Throwable e) {
-            if( debug ) {
-                debugPrintln("failed to read $java.home/lib/jaxp.properties");
-                e.printStackTrace();
-            }
-        }
-         */
-
         // try META-INF/services files
         Iterator sitr = createServiceFileIterator();
         while(sitr.hasNext()) {
@@ -269,14 +248,20 @@
      */
     private Class createClass(String className) {
             Class clazz;
+        // make sure we have access to restricted packages
+        boolean internal = false;
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                internal = true;
+            }
+        }
 
-            // use approprite ClassLoader
             try {
-                    if (classLoader != null) {
-                            clazz = classLoader.loadClass(className);
-                    } else {
-                            clazz = Class.forName(className);
-                    }
+                if (classLoader != null && !internal) {
+                        clazz = classLoader.loadClass(className);
+                } else {
+                        clazz = Class.forName(className);
+                }
             } catch (Throwable t) {
                 if(debug)   t.printStackTrace();
                     return null;