--- a/jaxp/src/com/sun/org/apache/xalan/internal/XalanConstants.java Thu Jun 06 09:54:40 2013 -0700
+++ b/jaxp/src/com/sun/org/apache/xalan/internal/XalanConstants.java Mon Jun 10 16:59:58 2013 -0700
@@ -80,59 +80,6 @@
/**
* FEATURE_SECURE_PROCESSING (FSP) is false by default
*/
- public static final String EXTERNAL_ACCESS_DEFAULT = getExternalAccessDefault(false);
-
- /**
- * Determine the default value of the external access properties
- *
- * jaxp 1.5 does not require implementations to restrict by default
- *
- * For JDK8:
- * The default value is 'file' (including jar:file); The keyword "all" grants permission
- * to all protocols. When {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING} is on,
- * the default value is an empty string indicating no access is allowed.
- *
- * For JDK7:
- * The default value is 'all' granting permission to all protocols. If by default,
- * {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING} is true, it should
- * not change the default value. However, if {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING}
- * is set explicitly, the values of the properties shall be set to an empty string
- * indicating no access is allowed.
- *
- * @param isSecureProcessing indicating if Secure Processing is set
- * @return default value
- */
- public static String getExternalAccessDefault(boolean isSecureProcessing) {
- String defaultValue = "all";
- if (isJDKandAbove(RESTRICT_BY_DEFAULT_JDK_VERSION)) {
- defaultValue = "file";
- if (isSecureProcessing) {
- defaultValue = EXTERNAL_ACCESS_DEFAULT_FSP;
- }
- }
- return defaultValue;
- }
-
- /*
- * Check the version of the current JDK against that specified in the
- * parameter
- *
- * There is a proposal to change the java version string to:
- * MAJOR.MINOR.FU.CPU.PSU-BUILDNUMBER_BUGIDNUMBER_OPTIONAL
- * This method would work with both the current format and that proposed
- *
- * @param compareTo a JDK version to be compared to
- * @return true if the current version is the same or above that represented
- * by the parameter
- */
- public static boolean isJDKandAbove(int compareTo) {
- String javaVersion = SecuritySupport.getSystemProperty("java.version");
- String versions[] = javaVersion.split("\\.", 3);
- if (Integer.parseInt(versions[0]) >= compareTo ||
- Integer.parseInt(versions[1]) >= compareTo) {
- return true;
- }
- return false;
- }
+ public static final String EXTERNAL_ACCESS_DEFAULT = ACCESS_EXTERNAL_ALL;
} // class Constants
--- a/jaxp/src/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java Thu Jun 06 09:54:40 2013 -0700
+++ b/jaxp/src/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java Mon Jun 10 16:59:58 2013 -0700
@@ -253,7 +253,6 @@
if (System.getSecurityManager() != null) {
_isSecureMode = true;
_isNotSecureProcessing = false;
- defaultAccess = XalanConstants.getExternalAccessDefault(true);
}
_accessExternalStylesheet = SecuritySupport.getDefaultAccessProperty(
XalanConstants.SP_ACCESS_EXTERNAL_STYLESHEET, defaultAccess);
--- a/jaxp/src/com/sun/org/apache/xerces/internal/impl/Constants.java Thu Jun 06 09:54:40 2013 -0700
+++ b/jaxp/src/com/sun/org/apache/xerces/internal/impl/Constants.java Mon Jun 10 16:59:58 2013 -0700
@@ -202,7 +202,7 @@
/**
* FEATURE_SECURE_PROCESSING (FSP) is true by default
*/
- public static final String EXTERNAL_ACCESS_DEFAULT = getExternalAccessDefault(true);
+ public static final String EXTERNAL_ACCESS_DEFAULT = ACCESS_EXTERNAL_ALL;
//
// DOM features
@@ -697,58 +697,6 @@
? new ArrayEnumeration(fgXercesProperties) : fgEmptyEnumeration;
} // getXercesProperties():Enumeration
- /**
- * Determine the default value of the external access properties
- *
- * jaxp 1.5 does not require implementations to restrict by default
- *
- * For JDK8:
- * The default value is 'file' (including jar:file); The keyword "all" grants permission
- * to all protocols. When {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING} is on,
- * the default value is an empty string indicating no access is allowed.
- *
- * For JDK7:
- * The default value is 'all' granting permission to all protocols. If by default,
- * {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING} is true, it should
- * not change the default value. However, if {@link javax.xml.XMLConstants#FEATURE_SECURE_PROCESSING}
- * is set explicitly, the values of the properties shall be set to an empty string
- * indicating no access is allowed.
- *
- * @param isSecureProcessing indicating if Secure Processing is set
- * @return default value
- */
- public static String getExternalAccessDefault(boolean isSecureProcessing) {
- String defaultValue = "all";
- if (isJDKandAbove(RESTRICT_BY_DEFAULT_JDK_VERSION)) {
- defaultValue = "file";
- if (isSecureProcessing) {
- defaultValue = EXTERNAL_ACCESS_DEFAULT_FSP;
- }
- }
- return defaultValue;
- }
-
- /*
- * Check the version of the current JDK against that specified in the
- * parameter
- *
- * There is a proposal to change the java version string to:
- * MAJOR.MINOR.FU.CPU.PSU-BUILDNUMBER_BUGIDNUMBER_OPTIONAL
- * This method would work with both the current format and that proposed
- *
- * @param compareTo a JDK version to be compared to
- * @return true if the current version is the same or above that represented
- * by the parameter
- */
- public static boolean isJDKandAbove(int compareTo) {
- String javaVersion = SecuritySupport.getSystemProperty("java.version");
- String versions[] = javaVersion.split("\\.", 3);
- if (Integer.parseInt(versions[0]) >= compareTo ||
- Integer.parseInt(versions[1]) >= compareTo) {
- return true;
- }
- return false;
- }
//
// Classes
--- a/jaxp/src/com/sun/org/apache/xerces/internal/jaxp/validation/XMLSchemaFactory.java Thu Jun 06 09:54:40 2013 -0700
+++ b/jaxp/src/com/sun/org/apache/xerces/internal/jaxp/validation/XMLSchemaFactory.java Mon Jun 10 16:59:58 2013 -0700
@@ -364,10 +364,15 @@
SAXMessageFormatter.formatMessage(null,
"jaxp-secureprocessing-feature", null));
}
- fSecurityManager = value ? new SecurityManager() : null;
+ if (value) {
+ fSecurityManager = new SecurityManager();
+ fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_DTD, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
+ fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_SCHEMA, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
+ } else {
+ fSecurityManager = null;
+ }
+
fXMLSchemaLoader.setProperty(SECURITY_MANAGER, fSecurityManager);
- fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_DTD, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
- fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_SCHEMA, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
return;
} else if (name.equals(Constants.ORACLE_FEATURE_SERVICE_MECHANISM)) {
//in secure mode, let _useServicesMechanism be determined by the constructor