diff options
Diffstat (limited to 'java/openjdk6/files/icedtea/security/20130416/6657673.patch')
| -rw-r--r-- | java/openjdk6/files/icedtea/security/20130416/6657673.patch | 9381 |
1 files changed, 0 insertions, 9381 deletions
diff --git a/java/openjdk6/files/icedtea/security/20130416/6657673.patch b/java/openjdk6/files/icedtea/security/20130416/6657673.patch deleted file mode 100644 index c2a57be334bd..000000000000 --- a/java/openjdk6/files/icedtea/security/20130416/6657673.patch +++ /dev/null @@ -1,9381 +0,0 @@ ---- /dev/null 2013-04-25 14:33:00.000000000 -0400 -+++ jaxp/patches/jaxp_src/6657673.patch 2013-04-25 14:43:01.000000000 -0400 -@@ -0,0 +1,9198 @@ -+--- src/com/sun/org/apache/bcel/internal/classfile/JavaClass.java 2013-04-16 14:28:09.232148559 +0100 -++++ src/com/sun/org/apache/bcel/internal/classfile/JavaClass.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -63,6 +63,7 @@ -+ import com.sun.org.apache.bcel.internal.util.ClassVector; -+ import com.sun.org.apache.bcel.internal.util.ClassQueue; -+ import com.sun.org.apache.bcel.internal.generic.Type; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ import java.io.*; -+ import java.util.StringTokenizer; -+@@ -77,6 +78,7 @@ -+ * class file. Those interested in programatically generating classes -+ * should see the <a href="../generic/ClassGen.html">ClassGen</a> class. -+ -++ * @version $Id: JavaClass.java,v 1.4 2007-07-19 04:34:42 ofung Exp $ -+ * @see com.sun.org.apache.bcel.internal.generic.ClassGen -+ * @author <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A> -+ */ -+@@ -451,9 +453,9 @@ -+ String debug = null, sep = null; -+ -+ try { -+- debug = System.getProperty("JavaClass.debug"); -++ debug = SecuritySupport.getSystemProperty("JavaClass.debug"); -+ // Get path separator either / or \ usually -+- sep = System.getProperty("file.separator"); -++ sep = SecuritySupport.getSystemProperty("file.separator"); -+ } -+ catch (SecurityException e) { -+ // falls through -+--- src/com/sun/org/apache/bcel/internal/util/Class2HTML.java 2013-04-16 14:28:09.312149848 +0100 -++++ src/com/sun/org/apache/bcel/internal/util/Class2HTML.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -82,6 +82,7 @@ -+ * method in the Method's frame will jump to the appropiate method in -+ * the Code frame. -+ * -++ * @version $Id: Class2HTML.java,v 1.3 2007-07-19 04:34:52 ofung Exp $ -+ * @author <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A> -+ */ -+ public class Class2HTML implements Constants -+@@ -137,7 +138,7 @@ -+ ClassParser parser=null; -+ JavaClass java_class=null; -+ String zip_file = null; -+- char sep = System.getProperty("file.separator").toCharArray()[0]; -++ char sep = SecuritySupport.getSystemProperty("file.separator").toCharArray()[0]; -+ String dir = "." + sep; // Where to store HTML files -+ -+ try { -+--- src/com/sun/org/apache/bcel/internal/util/ClassPath.java 2013-04-16 14:28:09.316149912 +0100 -++++ src/com/sun/org/apache/bcel/internal/util/ClassPath.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -66,6 +66,7 @@ -+ * Responsible for loading (class) files from the CLASSPATH. Inspired by -+ * sun.tools.ClassPath. -+ * -++ * @version $Id: ClassPath.java,v 1.4 2007-07-19 04:34:52 ofung Exp $ -+ * @author <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A> -+ */ -+ public class ClassPath implements Serializable { -+@@ -83,7 +84,7 @@ -+ ArrayList vec = new ArrayList(); -+ -+ for(StringTokenizer tok=new StringTokenizer(class_path, -+- System.getProperty("path.separator")); -++ SecuritySupport.getSystemProperty("path.separator")); -+ tok.hasMoreTokens();) -+ { -+ String path = tok.nextToken(); -+@@ -92,7 +93,7 @@ -+ File file = new File(path); -+ -+ try { -+- if(file.exists()) { -++ if(SecuritySupport.getFileExists(file)) { -+ if(file.isDirectory()) -+ vec.add(new Dir(path)); -+ else -+@@ -143,8 +144,9 @@ -+ String name = tok.nextToken(); -+ File file = new File(name); -+ -+- if(file.exists()) -++ if(SecuritySupport.getFileExists(file)) { -+ list.add(name); -++ } -+ } -+ } -+ } -+@@ -159,9 +161,9 @@ -+ String class_path, boot_path, ext_path; -+ -+ try { -+- class_path = System.getProperty("java.class.path"); -+- boot_path = System.getProperty("sun.boot.class.path"); -+- ext_path = System.getProperty("java.ext.dirs"); -++ class_path = SecuritySupport.getSystemProperty("java.class.path"); -++ boot_path = SecuritySupport.getSystemProperty("sun.boot.class.path"); -++ ext_path = SecuritySupport.getSystemProperty("java.ext.dirs"); -+ } -+ catch (SecurityException e) { -+ return ""; -+@@ -176,8 +178,8 @@ -+ getPathComponents(ext_path, dirs); -+ -+ for(Iterator e = dirs.iterator(); e.hasNext(); ) { -+- File ext_dir = new File((String)e.next()); -+- String[] extensions = ext_dir.list(new FilenameFilter() { -++ File ext_dir = new File((String)e.next()); -++ String[] extensions = SecuritySupport.getFileList(ext_dir, new FilenameFilter() { -+ public boolean accept(File dir, String name) { -+ name = name.toLowerCase(); -+ return name.endsWith(".zip") || name.endsWith(".jar"); -+@@ -342,7 +344,7 @@ -+ final File file = new File(dir + File.separatorChar + -+ name.replace('.', File.separatorChar) + suffix); -+ -+- return file.exists()? new ClassFile() { -++ return SecuritySupport.getFileExists(file)? new ClassFile() { -+ public InputStream getInputStream() throws IOException { return new FileInputStream(file); } -+ -+ public String getPath() { try { -+--- src/com/sun/org/apache/bcel/internal/util/JavaWrapper.java 2013-04-16 14:28:09.316149912 +0100 -++++ src/com/sun/org/apache/bcel/internal/util/JavaWrapper.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -72,6 +72,7 @@ -+ * <pre>java com.sun.org.apache.bcel.internal.util.JavaWrapper -Dbcel.classloader=foo.MyLoader <real.class.name> [arguments]</pre> -+ * </p> -+ * -++ * @version $Id: JavaWrapper.java,v 1.3 2007-07-19 04:34:52 ofung Exp $ -+ * @author <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A> -+ * @see ClassLoader -+ */ -+@@ -79,7 +80,7 @@ -+ private java.lang.ClassLoader loader; -+ -+ private static java.lang.ClassLoader getClassLoader() { -+- String s = System.getProperty("bcel.classloader"); -++ String s = SecuritySupport.getSystemProperty("bcel.classloader"); -+ -+ if((s == null) || "".equals(s)) -+ s = "com.sun.org.apache.bcel.internal.util.ClassLoader"; -+--- src/com/sun/org/apache/bcel/internal/util/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/com/sun/org/apache/bcel/internal/util/SecuritySupport.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -0,0 +1,223 @@ -++/* -++ * reserved comment block -++ * DO NOT REMOVE OR ALTER! -++ */ -++/* -++ * Copyright 2002-2004 The Apache Software Foundation. -++ * -++ * Licensed under the Apache License, Version 2.0 (the "License"); -++ * you may not use this file except in compliance with the License. -++ * You may obtain a copy of the License at -++ * -++ * http://www.apache.org/licenses/LICENSE-2.0 -++ * -++ * Unless required by applicable law or agreed to in writing, software -++ * distributed under the License is distributed on an "AS IS" BASIS, -++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -++ * See the License for the specific language governing permissions and -++ * limitations under the License. -++ */ -++ -++package com.sun.org.apache.bcel.internal.util; -++ -++import java.io.File; -++import java.io.FileInputStream; -++import java.io.FileNotFoundException; -++import java.io.FilenameFilter; -++import java.io.InputStream; -++import java.lang.ClassLoader; -++import java.security.AccessController; -++import java.security.PrivilegedAction; -++import java.security.PrivilegedActionException; -++import java.security.PrivilegedExceptionAction; -++import java.util.ListResourceBundle; -++import java.util.Locale; -++import java.util.MissingResourceException; -++import java.util.ResourceBundle; -++ -++/** -++ * This class is duplicated for each subpackage so keep it in sync. It is -++ * package private and therefore is not exposed as part of any API. -++ * -++ * @xerces.internal -++ */ -++public final class SecuritySupport { -++ -++ private static final SecuritySupport securitySupport = new SecuritySupport(); -++ -++ /** -++ * Return an instance of this class. -++ */ -++ public static SecuritySupport getInstance() { -++ return securitySupport; -++ } -++ -++ static ClassLoader getContextClassLoader() { -++ return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader cl = null; -++ try { -++ cl = Thread.currentThread().getContextClassLoader(); -++ } catch (SecurityException ex) { -++ } -++ return cl; -++ } -++ }); -++ } -++ -++ static ClassLoader getSystemClassLoader() { -++ return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader cl = null; -++ try { -++ cl = ClassLoader.getSystemClassLoader(); -++ } catch (SecurityException ex) { -++ } -++ return cl; -++ } -++ }); -++ } -++ -++ static ClassLoader getParentClassLoader(final ClassLoader cl) { -++ return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader parent = null; -++ try { -++ parent = cl.getParent(); -++ } catch (SecurityException ex) { -++ } -++ -++ // eliminate loops in case of the boot -++ // ClassLoader returning itself as a parent -++ return (parent == cl) ? null : parent; -++ } -++ }); -++ } -++ -++ public static String getSystemProperty(final String propName) { -++ return (String) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return System.getProperty(propName); -++ } -++ }); -++ } -++ -++ static FileInputStream getFileInputStream(final File file) -++ throws FileNotFoundException { -++ try { -++ return (FileInputStream) AccessController.doPrivileged(new PrivilegedExceptionAction() { -++ public Object run() throws FileNotFoundException { -++ return new FileInputStream(file); -++ } -++ }); -++ } catch (PrivilegedActionException e) { -++ throw (FileNotFoundException) e.getException(); -++ } -++ } -++ -++ /** -++ * Return resource using the same classloader for the ObjectFactory by -++ * default or bootclassloader when Security Manager is in place -++ */ -++ public static InputStream getResourceAsStream(final String name) { -++ if (System.getSecurityManager() != null) { -++ return getResourceAsStream(null, name); -++ } else { -++ return getResourceAsStream(findClassLoader(), name); -++ } -++ } -++ -++ public static InputStream getResourceAsStream(final ClassLoader cl, -++ final String name) { -++ return (InputStream) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ InputStream ris; -++ if (cl == null) { -++ ris = Object.class.getResourceAsStream("/" + name); -++ } else { -++ ris = cl.getResourceAsStream(name); -++ } -++ return ris; -++ } -++ }); -++ } -++ -++ /** -++ * Gets a resource bundle using the specified base name, the default locale, -++ * and the caller's class loader. -++ * -++ * @param bundle the base name of the resource bundle, a fully qualified -++ * class name -++ * @return a resource bundle for the given base name and the default locale -++ */ -++ public static ListResourceBundle getResourceBundle(String bundle) { -++ return getResourceBundle(bundle, Locale.getDefault()); -++ } -++ -++ /** -++ * Gets a resource bundle using the specified base name and locale, and the -++ * caller's class loader. -++ * -++ * @param bundle the base name of the resource bundle, a fully qualified -++ * class name -++ * @param locale the locale for which a resource bundle is desired -++ * @return a resource bundle for the given base name and locale -++ */ -++ public static ListResourceBundle getResourceBundle(final String bundle, final Locale locale) { -++ return AccessController.doPrivileged(new PrivilegedAction<ListResourceBundle>() { -++ public ListResourceBundle run() { -++ try { -++ return (ListResourceBundle) ResourceBundle.getBundle(bundle, locale); -++ } catch (MissingResourceException e) { -++ try { -++ return (ListResourceBundle) ResourceBundle.getBundle(bundle, new Locale("en", "US")); -++ } catch (MissingResourceException e2) { -++ throw new MissingResourceException( -++ "Could not load any resource bundle by " + bundle, bundle, ""); -++ } -++ } -++ } -++ }); -++ } -++ -++ public static String[] getFileList(final File f, final FilenameFilter filter) { -++ return ((String[]) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return f.list(filter); -++ } -++ })); -++ } -++ -++ public static boolean getFileExists(final File f) { -++ return ((Boolean) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return f.exists() ? Boolean.TRUE : Boolean.FALSE; -++ } -++ })).booleanValue(); -++ } -++ -++ static long getLastModified(final File f) { -++ return ((Long) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return new Long(f.lastModified()); -++ } -++ })).longValue(); -++ } -++ -++ -++ /** -++ * Figure out which ClassLoader to use. -++ */ -++ public static ClassLoader findClassLoader() -++ { -++ if (System.getSecurityManager()!=null) { -++ //this will ensure bootclassloader is used -++ return null; -++ } else { -++ return SecuritySupport.class.getClassLoader(); -++ } -++ } // findClassLoader():ClassLoader -++ -++ private SecuritySupport() { -++ } -++} -+--- src/com/sun/org/apache/xalan/internal/res/XSLMessages.java 2013-04-16 14:28:09.324150042 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLMessages.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -22,68 +22,72 @@ -+ */ -+ package com.sun.org.apache.xalan.internal.res; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.util.ListResourceBundle; -+ -+ import com.sun.org.apache.xpath.internal.res.XPATHMessages; -+ -+ /** -+- * Sets things up for issuing error messages. This class is misnamed, and -+- * should be called XalanMessages, or some such. -++ * Sets things up for issuing error messages. This class is misnamed, and should -++ * be called XalanMessages, or some such. -++ * -+ * @xsl.usage internal -+ */ -+-public class XSLMessages extends XPATHMessages -+-{ -++public class XSLMessages extends XPATHMessages { -+ -+- /** The language specific resource object for Xalan messages. */ -+- private static ListResourceBundle XSLTBundle = null; -+- -+- /** The class name of the Xalan error message string table. */ -+- private static final String XSLT_ERROR_RESOURCES = -+- "com.sun.org.apache.xalan.internal.res.XSLTErrorResources"; -+- -+- /** -+- * Creates a message from the specified key and replacement -+- * arguments, localized to the given locale. -+- * -+- * @param msgKey The key for the message text. -+- * @param args The arguments to be used as replacement text -+- * in the message created. -+- * -+- * @return The formatted message string. -+- */ -+- public static final String createMessage(String msgKey, Object args[]) //throws Exception -+- { -+- if (XSLTBundle == null) -+- XSLTBundle = loadResourceBundle(XSLT_ERROR_RESOURCES); -+- -+- if (XSLTBundle != null) -++ /** -++ * The language specific resource object for Xalan messages. -++ */ -++ private static ListResourceBundle XSLTBundle = null; -++ /** -++ * The class name of the Xalan error message string table. -++ */ -++ private static final String XSLT_ERROR_RESOURCES = -++ "com.sun.org.apache.xalan.internal.res.XSLTErrorResources"; -++ -++ /** -++ * Creates a message from the specified key and replacement arguments, -++ * localized to the given locale. -++ * -++ * @param msgKey The key for the message text. -++ * @param args The arguments to be used as replacement text in the message -++ * created. -++ * -++ * @return The formatted message string. -++ */ -++ public static String createMessage(String msgKey, Object args[]) //throws Exception -+ { -+- return createMsg(XSLTBundle, msgKey, args); -++ if (XSLTBundle == null) { -++ XSLTBundle = SecuritySupport.getResourceBundle(XSLT_ERROR_RESOURCES); -++ } -++ -++ if (XSLTBundle != null) { -++ return createMsg(XSLTBundle, msgKey, args); -++ } else { -++ return "Could not load any resource bundles."; -++ } -+ } -+- else -+- return "Could not load any resource bundles."; -+- } -+- -+- /** -+- * Creates a message from the specified key and replacement -+- * arguments, localized to the given locale. -+- * -+- * @param msgKey The key for the message text. -+- * @param args The arguments to be used as replacement text -+- * in the message created. -+- * -+- * @return The formatted warning string. -+- */ -+- public static final String createWarning(String msgKey, Object args[]) //throws Exception -+- { -+- if (XSLTBundle == null) -+- XSLTBundle = loadResourceBundle(XSLT_ERROR_RESOURCES); -+ -+- if (XSLTBundle != null) -++ /** -++ * Creates a message from the specified key and replacement arguments, -++ * localized to the given locale. -++ * -++ * @param msgKey The key for the message text. -++ * @param args The arguments to be used as replacement text in the message -++ * created. -++ * -++ * @return The formatted warning string. -++ */ -++ public static String createWarning(String msgKey, Object args[]) //throws Exception -+ { -+- return createMsg(XSLTBundle, msgKey, args); -++ if (XSLTBundle == null) { -++ XSLTBundle = SecuritySupport.getResourceBundle(XSLT_ERROR_RESOURCES); -++ } -++ -++ if (XSLTBundle != null) { -++ return createMsg(XSLTBundle, msgKey, args); -++ } else { -++ return "Could not load any resource bundles."; -++ } -+ } -+- else -+- return "Could not load any resource bundles."; -+- } -+ } -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_de.java 2013-04-16 14:28:09.328150105 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_de.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -2410,68 +2410,4 @@ -+ public static final String QUERY_HEADER = "MUSTER "; -+ -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+ } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+-} -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_es.java 2013-04-16 14:28:09.332150170 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_es.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -2409,69 +2409,4 @@ -+ * @deprecated */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("es", "ES")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+ } -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_fr.java 2013-04-16 14:28:09.332150170 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_fr.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -2410,68 +2410,4 @@ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+ } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+-} -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_it.java 2013-04-16 14:28:09.336150235 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_it.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -2409,69 +2409,4 @@ -+ * @deprecated */ -+ public static final String QUERY_HEADER = "MODELLO "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("it", "IT")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+ } -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ja.java 2013-04-16 14:28:09.336150235 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ja.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -2410,68 +2410,4 @@ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+ } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+-} -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources.java 2013-04-16 14:28:09.324150042 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources.java 2013-04-16 14:29:26.549394382 +0100 -+@@ -1446,68 +1446,4 @@ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+ } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+-} -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ko.java 2013-04-16 14:28:09.340150299 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ko.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -2409,69 +2409,4 @@ -+ * @deprecated */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("ko", "KR")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+ } -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_CN.java 2013-04-16 14:28:09.340150299 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_CN.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -2409,69 +2409,4 @@ -+ * @deprecated */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("zh", "CN")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "\u65e0\u6cd5\u88c5\u5165\u4efb\u4f55\u8d44\u6e90\u5305\u3002", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+ } -+--- src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_TW.java 2013-04-16 14:28:09.344150364 +0100 -++++ src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_TW.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -2409,69 +2409,4 @@ -+ * @deprecated */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XSLTErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XSLTErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XSLTErrorResources) ResourceBundle.getBundle(className, -+- new Locale("zh", "TW")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+- -+ } -+--- src/com/sun/org/apache/xalan/internal/utils/ConfigurationError.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/com/sun/org/apache/xalan/internal/utils/ConfigurationError.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -0,0 +1,61 @@ -++/* -++ * reserved comment block -++ * DO NOT REMOVE OR ALTER! -++ */ -++/* -++ * Copyright 2001-2004 The Apache Software Foundation. -++ * -++ * Licensed under the Apache License, Version 2.0 (the "License"); -++ * you may not use this file except in compliance with the License. -++ * You may obtain a copy of the License at -++ * -++ * http://www.apache.org/licenses/LICENSE-2.0 -++ * -++ * Unless required by applicable law or agreed to in writing, software -++ * distributed under the License is distributed on an "AS IS" BASIS, -++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -++ * See the License for the specific language governing permissions and -++ * limitations under the License. -++ */ -++/* -++ * $Id: ObjectFactory.java,v 1.2.4.1 2005/09/15 02:39:54 jeffsuttor Exp $ -++ */ -++ -++package com.sun.org.apache.xalan.internal.utils; -++ -++/** -++ * A configuration error. This was an internal class in ObjectFactory previously -++ */ -++public final class ConfigurationError -++ extends Error { -++ -++ // -++ // Data -++ // -++ -++ /** Exception. */ -++ private Exception exception; -++ -++ // -++ // Constructors -++ // -++ -++ /** -++ * Construct a new instance with the specified detail string and -++ * exception. -++ */ -++ ConfigurationError(String msg, Exception x) { -++ super(msg); -++ this.exception = x; -++ } // <init>(String,Exception) -++ -++ // -++ // methods -++ // -++ -++ /** Returns the exception associated to this error. */ -++ public Exception getException() { -++ return exception; -++ } // getException():Exception -++ -++} // class ConfigurationError -+--- src/com/sun/org/apache/xalan/internal/utils/ObjectFactory.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/com/sun/org/apache/xalan/internal/utils/ObjectFactory.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -0,0 +1,659 @@ -++/* -++ * reserved comment block -++ * DO NOT REMOVE OR ALTER! -++ */ -++/* -++ * Copyright 2001-2004 The Apache Software Foundation. -++ * -++ * Licensed under the Apache License, Version 2.0 (the "License"); -++ * you may not use this file except in compliance with the License. -++ * You may obtain a copy of the License at -++ * -++ * http://www.apache.org/licenses/LICENSE-2.0 -++ * -++ * Unless required by applicable law or agreed to in writing, software -++ * distributed under the License is distributed on an "AS IS" BASIS, -++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -++ * See the License for the specific language governing permissions and -++ * limitations under the License. -++ */ -++/* -++ * $Id: ObjectFactory.java,v 1.2.4.1 2005/09/15 02:39:54 jeffsuttor Exp $ -++ */ -++ -++package com.sun.org.apache.xalan.internal.utils; -++ -++import java.io.InputStream; -++import java.io.IOException; -++import java.io.File; -++import java.io.FileInputStream; -++ -++import java.util.Properties; -++import java.io.BufferedReader; -++import java.io.InputStreamReader; -++ -++/** -++ * This class is duplicated for each JAXP subpackage so keep it in sync. -++ * It is package private and therefore is not exposed as part of the JAXP -++ * API. -++ * <p> -++ * This code is designed to implement the JAXP 1.1 spec pluggability -++ * feature and is designed to run on JDK version 1.1 and -++ * later, and to compile on JDK 1.2 and onward. -++ * The code also runs both as part of an unbundled jar file and -++ * when bundled as part of the JDK. -++ * <p> -++ * This class was moved from the <code>javax.xml.parsers.ObjectFactory</code> -++ * class and modified to be used as a general utility for creating objects -++ * dynamically. -++ * -++ * @version $Id: ObjectFactory.java,v 1.11 2010-11-01 04:34:25 joehw Exp $ -++ */ -++public class ObjectFactory { -++ -++ // -++ // Constants -++ // -++ private static final String XALAN_INTERNAL = "com.sun.org.apache.xalan.internal"; -++ private static final String XERCES_INTERNAL = "com.sun.org.apache.xerces.internal"; -++ -++ // name of default properties file to look for in JDK's jre/lib directory -++ private static final String DEFAULT_PROPERTIES_FILENAME = -++ "xalan.properties"; -++ -++ private static final String SERVICES_PATH = "META-INF/services/"; -++ -++ /** Set to true for debugging */ -++ private static final boolean DEBUG = false; -++ -++ /** cache the contents of the xalan.properties file. -++ * Until an attempt has been made to read this file, this will -++ * be null; if the file does not exist or we encounter some other error -++ * during the read, this will be empty. -++ */ -++ private static Properties fXalanProperties = null; -++ -++ /*** -++ * Cache the time stamp of the xalan.properties file so -++ * that we know if it's been modified and can invalidate -++ * the cache when necessary. -++ */ -++ private static long fLastModified = -1; -++ -++ // -++ // Public static methods -++ // -++ -++ /** -++ * Finds the implementation Class object in the specified order. The -++ * specified order is the following: -++ * <ol> -++ * <li>query the system property using <code>System.getProperty</code> -++ * <li>read <code>META-INF/services/<i>factoryId</i></code> file -++ * <li>use fallback classname -++ * </ol> -++ * -++ * @return instance of factory, never null -++ * -++ * @param factoryId Name of the factory to find, same as -++ * a property name -++ * @param fallbackClassName Implementation class name, if nothing else -++ * is found. Use null to mean no fallback. -++ * -++ * @exception ObjectFactory.ConfigurationError -++ */ -++ public static Object createObject(String factoryId, String fallbackClassName) -++ throws ConfigurationError { -++ return createObject(factoryId, null, fallbackClassName); -++ } // createObject(String,String):Object -++ -++ /** -++ * Finds the implementation Class object in the specified order. The -++ * specified order is the following: -++ * <ol> -++ * <li>query the system property using <code>System.getProperty</code> -++ * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -++ * <li>read <code>META-INF/services/<i>factoryId</i></code> file -++ * <li>use fallback classname -++ * </ol> -++ * -++ * @return instance of factory, never null -++ * -++ * @param factoryId Name of the factory to find, same as -++ * a property name -++ * @param propertiesFilename The filename in the $java.home/lib directory -++ * of the properties file. If none specified, -++ * ${java.home}/lib/xalan.properties will be used. -++ * @param fallbackClassName Implementation class name, if nothing else -++ * is found. Use null to mean no fallback. -++ * -++ * @exception ObjectFactory.ConfigurationError -++ */ -++ static Object createObject(String factoryId, -++ String propertiesFilename, -++ String fallbackClassName) -++ throws ConfigurationError -++ { -++ Class factoryClass = lookUpFactoryClass(factoryId, -++ propertiesFilename, -++ fallbackClassName); -++ -++ if (factoryClass == null) { -++ throw new ConfigurationError( -++ "Provider for " + factoryId + " cannot be found", null); -++ } -++ -++ try{ -++ Object instance = factoryClass.newInstance(); -++ if (DEBUG) debugPrintln("created new instance of factory " + factoryId); -++ return instance; -++ } catch (Exception x) { -++ throw new ConfigurationError( -++ "Provider for factory " + factoryId -++ + " could not be instantiated: " + x, x); -++ } -++ } // createObject(String,String,String):Object -++ -++ /** -++ * Finds the implementation Class object in the specified order. The -++ * specified order is the following: -++ * <ol> -++ * <li>query the system property using <code>System.getProperty</code> -++ * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -++ * <li>read <code>META-INF/services/<i>factoryId</i></code> file -++ * <li>use fallback classname -++ * </ol> -++ * -++ * @return Class object of factory, never null -++ * -++ * @param factoryId Name of the factory to find, same as -++ * a property name -++ * @param propertiesFilename The filename in the $java.home/lib directory -++ * of the properties file. If none specified, -++ * ${java.home}/lib/xalan.properties will be used. -++ * @param fallbackClassName Implementation class name, if nothing else -++ * is found. Use null to mean no fallback. -++ * -++ * @exception ObjectFactory.ConfigurationError -++ */ -++ public static Class lookUpFactoryClass(String factoryId) -++ throws ConfigurationError -++ { -++ return lookUpFactoryClass(factoryId, null, null); -++ } // lookUpFactoryClass(String):Class -++ -++ /** -++ * Finds the implementation Class object in the specified order. The -++ * specified order is the following: -++ * <ol> -++ * <li>query the system property using <code>System.getProperty</code> -++ * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -++ * <li>read <code>META-INF/services/<i>factoryId</i></code> file -++ * <li>use fallback classname -++ * </ol> -++ * -++ * @return Class object that provides factory service, never null -++ * -++ * @param factoryId Name of the factory to find, same as -++ * a property name -++ * @param propertiesFilename The filename in the $java.home/lib directory -++ * of the properties file. If none specified, -++ * ${java.home}/lib/xalan.properties will be used. -++ * @param fallbackClassName Implementation class name, if nothing else -++ * is found. Use null to mean no fallback. -++ * -++ * @exception ObjectFactory.ConfigurationError -++ */ -++ public static Class lookUpFactoryClass(String factoryId, -++ String propertiesFilename, -++ String fallbackClassName) -++ throws ConfigurationError -++ { -++ String factoryClassName = lookUpFactoryClassName(factoryId, -++ propertiesFilename, -++ fallbackClassName); -++ ClassLoader cl = findClassLoader(); -++ -++ if (factoryClassName == null) { -++ factoryClassName = fallbackClassName; -++ } -++ -++ // assert(className != null); -++ try{ -++ Class providerClass = findProviderClass(factoryClassName, -++ cl, -++ true); -++ if (DEBUG) debugPrintln("created new instance of " + providerClass + -++ " using ClassLoader: " + cl); -++ return providerClass; -++ } catch (ClassNotFoundException x) { -++ throw new ConfigurationError( -++ "Provider " + factoryClassName + " not found", x); -++ } catch (Exception x) { -++ throw new ConfigurationError( -++ "Provider "+factoryClassName+" could not be instantiated: "+x, -++ x); -++ } -++ } // lookUpFactoryClass(String,String,String):Class -++ -++ /** -++ * Finds the name of the required implementation class in the specified -++ * order. The specified order is the following: -++ * <ol> -++ * <li>query the system property using <code>System.getProperty</code> -++ * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -++ * <li>read <code>META-INF/services/<i>factoryId</i></code> file -++ * <li>use fallback classname -++ * </ol> -++ * -++ * @return name of class that provides factory service, never null -++ * -++ * @param factoryId Name of the factory to find, same as -++ * a property name -++ * @param propertiesFilename The filename in the $java.home/lib directory -++ * of the properties file. If none specified, -++ * ${java.home}/lib/xalan.properties will be used. -++ * @param fallbackClassName Implementation class name, if nothing else -++ * is found. Use null to mean no fallback. -++ * -++ * @exception ObjectFactory.ConfigurationError -++ */ -++ static String lookUpFactoryClassName(String factoryId, -++ String propertiesFilename, -++ String fallbackClassName) -++ { -++ // Use the system property first -++ try { -++ String systemProp = SecuritySupport.getSystemProperty(factoryId); -++ if (systemProp != null) { -++ if (DEBUG) debugPrintln("found system property, value=" + systemProp); -++ return systemProp; -++ } -++ } catch (SecurityException se) { -++ // Ignore and continue w/ next location -++ } -++ -++ // Try to read from propertiesFilename, or -++ // $java.home/lib/xalan.properties -++ String factoryClassName = null; -++ // no properties file name specified; use -++ // $JAVA_HOME/lib/xalan.properties: -++ if (propertiesFilename == null) { -++ File propertiesFile = null; -++ boolean propertiesFileExists = false; -++ try { -++ String javah = SecuritySupport.getSystemProperty("java.home"); -++ propertiesFilename = javah + File.separator + -++ "lib" + File.separator + DEFAULT_PROPERTIES_FILENAME; -++ propertiesFile = new File(propertiesFilename); -++ propertiesFileExists = SecuritySupport.getFileExists(propertiesFile); -++ } catch (SecurityException e) { -++ // try again... -++ fLastModified = -1; -++ fXalanProperties = null; -++ } -++ -++ synchronized (ObjectFactory.class) { -++ boolean loadProperties = false; -++ FileInputStream fis = null; -++ try { -++ // file existed last time -++ if(fLastModified >= 0) { -++ if(propertiesFileExists && -++ (fLastModified < (fLastModified = SecuritySupport.getLastModified(propertiesFile)))) { -++ loadProperties = true; -++ } else { -++ // file has stopped existing... -++ if(!propertiesFileExists) { -++ fLastModified = -1; -++ fXalanProperties = null; -++ } // else, file wasn't modified! -++ } -++ } else { -++ // file has started to exist: -++ if(propertiesFileExists) { -++ loadProperties = true; -++ fLastModified = SecuritySupport.getLastModified(propertiesFile); -++ } // else, nothing's changed -++ } -++ if(loadProperties) { -++ // must never have attempted to read xalan.properties -++ // before (or it's outdeated) -++ fXalanProperties = new Properties(); -++ fis = SecuritySupport.getFileInputStream(propertiesFile); -++ fXalanProperties.load(fis); -++ } -++ } catch (Exception x) { -++ fXalanProperties = null; -++ fLastModified = -1; -++ // assert(x instanceof FileNotFoundException -++ // || x instanceof SecurityException) -++ // In both cases, ignore and continue w/ next location -++ } -++ finally { -++ // try to close the input stream if one was opened. -++ if (fis != null) { -++ try { -++ fis.close(); -++ } -++ // Ignore the exception. -++ catch (IOException exc) {} -++ } -++ } -++ } -++ if(fXalanProperties != null) { -++ factoryClassName = fXalanProperties.getProperty(factoryId); -++ } -++ } else { -++ FileInputStream fis = null; -++ try { -++ fis = SecuritySupport.getFileInputStream(new File(propertiesFilename)); -++ Properties props = new Properties(); -++ props.load(fis); -++ factoryClassName = props.getProperty(factoryId); -++ } catch (Exception x) { -++ // assert(x instanceof FileNotFoundException -++ // || x instanceof SecurityException) -++ // In both cases, ignore and continue w/ next location -++ } -++ finally { -++ // try to close the input stream if one was opened. -++ if (fis != null) { -++ try { -++ fis.close(); -++ } -++ // Ignore the exception. -++ catch (IOException exc) {} -++ } -++ } -++ } -++ if (factoryClassName != null) { -++ if (DEBUG) debugPrintln("found in " + propertiesFilename + ", value=" -++ + factoryClassName); -++ return factoryClassName; -++ } -++ -++ // Try Jar Service Provider Mechanism -++ return findJarServiceProviderName(factoryId); -++ } // lookUpFactoryClass(String,String):String -++ -++ // -++ // Private static methods -++ // -++ -++ /** Prints a message to standard error if debugging is enabled. */ -++ private static void debugPrintln(String msg) { -++ if (DEBUG) { -++ System.err.println("JAXP: " + msg); -++ } -++ } // debugPrintln(String) -++ -++ /** -++ * Figure out which ClassLoader to use. For JDK 1.2 and later use -++ * the context ClassLoader. -++ */ -++ public static ClassLoader findClassLoader() -++ throws ConfigurationError -++ { -++ if (System.getSecurityManager()!=null) { -++ //this will ensure bootclassloader is used -++ return null; -++ } -++ -++ // Figure out which ClassLoader to use for loading the provider -++ // class. If there is a Context ClassLoader then use it. -++ ClassLoader context = SecuritySupport.getContextClassLoader(); -++ ClassLoader system = SecuritySupport.getSystemClassLoader(); -++ -++ ClassLoader chain = system; -++ while (true) { -++ if (context == chain) { -++ // Assert: we are on JDK 1.1 or we have no Context ClassLoader -++ // or any Context ClassLoader in chain of system classloader -++ // (including extension ClassLoader) so extend to widest -++ // ClassLoader (always look in system ClassLoader if Xalan -++ // is in boot/extension/system classpath and in current -++ // ClassLoader otherwise); normal classloaders delegate -++ // back to system ClassLoader first so this widening doesn't -++ // change the fact that context ClassLoader will be consulted -++ ClassLoader current = ObjectFactory.class.getClassLoader(); -++ -++ chain = system; -++ while (true) { -++ if (current == chain) { -++ // Assert: Current ClassLoader in chain of -++ // boot/extension/system ClassLoaders -++ return system; -++ } -++ if (chain == null) { -++ break; -++ } -++ chain = SecuritySupport.getParentClassLoader(chain); -++ } -++ -++ // Assert: Current ClassLoader not in chain of -++ // boot/extension/system ClassLoaders -++ return current; -++ } -++ -++ if (chain == null) { -++ // boot ClassLoader reached -++ break; -++ } -++ -++ // Check for any extension ClassLoaders in chain up to -++ // boot ClassLoader -++ chain = SecuritySupport.getParentClassLoader(chain); -++ } -++ -++ // Assert: Context ClassLoader not in chain of -++ // boot/extension/system ClassLoaders -++ return context; -++ } // findClassLoader():ClassLoader -++ -++ /** -++ * Create an instance of a class using the same classloader for the ObjectFactory by default -++ * or bootclassloader when Security Manager is in place -++ */ -++ public static Object newInstance(String className, boolean doFallback) -++ throws ConfigurationError -++ { -++ if (System.getSecurityManager()!=null) { -++ return newInstance(className, null, doFallback); -++ } else { -++ return newInstance(className, -++ findClassLoader (), doFallback); -++ } -++ } -++ -++ /** -++ * Create an instance of a class using the specified ClassLoader -++ */ -++ static Object newInstance(String className, ClassLoader cl, -++ boolean doFallback) -++ throws ConfigurationError -++ { -++ // assert(className != null); -++ try{ -++ Class providerClass = findProviderClass(className, cl, doFallback); -++ Object instance = providerClass.newInstance(); -++ if (DEBUG) debugPrintln("created new instance of " + providerClass + -++ " using ClassLoader: " + cl); -++ return instance; -++ } catch (ClassNotFoundException x) { -++ throw new ConfigurationError( -++ "Provider " + className + " not found", x); -++ } catch (Exception x) { -++ throw new ConfigurationError( -++ "Provider " + className + " could not be instantiated: " + x, -++ x); -++ } -++ } -++ -++ /** -++ * Find a Class using the same classloader for the ObjectFactory by default -++ * or bootclassloader when Security Manager is in place -++ */ -++ public static Class findProviderClass(String className, boolean doFallback) -++ throws ClassNotFoundException, ConfigurationError -++ { -++ if (System.getSecurityManager()!=null) { -++ return Class.forName(className); -++ } else { -++ return findProviderClass (className, -++ findClassLoader (), doFallback); -++ } -++ } -++ -++ /** -++ * Find a Class using the specified ClassLoader -++ */ -++ static Class findProviderClass(String className, ClassLoader cl, -++ boolean doFallback) -++ throws ClassNotFoundException, ConfigurationError -++ { -++ //throw security exception if the calling thread is not allowed to access the -++ //class. Restrict the access to the package classes as specified in java.security policy. -++ SecurityManager security = System.getSecurityManager(); -++ try{ -++ if (security != null){ -++ if (className.startsWith(XALAN_INTERNAL) || -++ className.startsWith(XERCES_INTERNAL)) { -++ cl = null; -++ } else { -++ final int lastDot = className.lastIndexOf("."); -++ String packageName = className; -++ if (lastDot != -1) packageName = className.substring(0, lastDot); -++ security.checkPackageAccess(packageName); -++ } -++ } -++ }catch(SecurityException e){ -++ throw e; -++ } -++ -++ Class providerClass; -++ if (cl == null) { -++ // XXX Use the bootstrap ClassLoader. There is no way to -++ // load a class using the bootstrap ClassLoader that works -++ // in both JDK 1.1 and Java 2. However, this should still -++ // work b/c the following should be true: -++ // -++ // (cl == null) iff current ClassLoader == null -++ // -++ // Thus Class.forName(String) will use the current -++ // ClassLoader which will be the bootstrap ClassLoader. -++ providerClass = Class.forName(className); -++ } else { -++ try { -++ providerClass = cl.loadClass(className); -++ } catch (ClassNotFoundException x) { -++ if (doFallback) { -++ // Fall back to current classloader -++ ClassLoader current = ObjectFactory.class.getClassLoader(); -++ if (current == null) { -++ providerClass = Class.forName(className); -++ } else if (cl != current) { -++ cl = current; -++ providerClass = cl.loadClass(className); -++ } else { -++ throw x; -++ } -++ } else { -++ throw x; -++ } -++ } -++ } -++ -++ return providerClass; -++ } -++ -++ /** -++ * Find the name of service provider using Jar Service Provider Mechanism -++ * -++ * @return instance of provider class if found or null -++ */ -++ private static String findJarServiceProviderName(String factoryId) -++ { -++ String serviceId = SERVICES_PATH + factoryId; -++ InputStream is = null; -++ -++ // First try the Context ClassLoader -++ ClassLoader cl = findClassLoader(); -++ -++ is = SecuritySupport.getResourceAsStream(cl, serviceId); -++ -++ // If no provider found then try the current ClassLoader -++ if (is == null) { -++ ClassLoader current = ObjectFactory.class.getClassLoader(); -++ if (cl != current) { -++ cl = current; -++ is = SecuritySupport.getResourceAsStream(cl, serviceId); -++ } -++ } -++ -++ if (is == null) { -++ // No provider found -++ return null; -++ } -++ -++ if (DEBUG) debugPrintln("found jar resource=" + serviceId + -++ " using ClassLoader: " + cl); -++ -++ // Read the service provider name in UTF-8 as specified in -++ // the jar spec. Unfortunately this fails in Microsoft -++ // VJ++, which does not implement the UTF-8 -++ // encoding. Theoretically, we should simply let it fail in -++ // that case, since the JVM is obviously broken if it -++ // doesn't support such a basic standard. But since there -++ // are still some users attempting to use VJ++ for -++ // development, we have dropped in a fallback which makes a -++ // second attempt using the platform's default encoding. In -++ // VJ++ this is apparently ASCII, which is a subset of -++ // UTF-8... and since the strings we'll be reading here are -++ // also primarily limited to the 7-bit ASCII range (at -++ // least, in English versions), this should work well -++ // enough to keep us on the air until we're ready to -++ // officially decommit from VJ++. [Edited comment from -++ // jkesselm] -++ BufferedReader rd; -++ try { -++ rd = new BufferedReader(new InputStreamReader(is, "UTF-8")); -++ } catch (java.io.UnsupportedEncodingException e) { -++ rd = new BufferedReader(new InputStreamReader(is)); -++ } -++ -++ String factoryClassName = null; -++ try { -++ // XXX Does not handle all possible input as specified by the -++ // Jar Service Provider specification -++ factoryClassName = rd.readLine(); -++ } catch (IOException x) { -++ // No provider found -++ return null; -++ } -++ finally { -++ try { -++ // try to close the reader. -++ rd.close(); -++ } -++ // Ignore the exception. -++ catch (IOException exc) {} -++ } -++ -++ if (factoryClassName != null && -++ ! "".equals(factoryClassName)) { -++ if (DEBUG) debugPrintln("found in resource, value=" -++ + factoryClassName); -++ -++ // Note: here we do not want to fall back to the current -++ // ClassLoader because we want to avoid the case where the -++ // resource file was found using one ClassLoader and the -++ // provider class was instantiated using a different one. -++ return factoryClassName; -++ } -++ -++ // No provider found -++ return null; -++ } -++ -++} // class ObjectFactory -+--- src/com/sun/org/apache/xalan/internal/utils/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/com/sun/org/apache/xalan/internal/utils/SecuritySupport.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -0,0 +1,206 @@ -++/* -++ * reserved comment block -++ * DO NOT REMOVE OR ALTER! -++ */ -++/* -++ * Copyright 2002-2004 The Apache Software Foundation. -++ * -++ * Licensed under the Apache License, Version 2.0 (the "License"); -++ * you may not use this file except in compliance with the License. -++ * You may obtain a copy of the License at -++ * -++ * http://www.apache.org/licenses/LICENSE-2.0 -++ * -++ * Unless required by applicable law or agreed to in writing, software -++ * distributed under the License is distributed on an "AS IS" BASIS, -++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -++ * See the License for the specific language governing permissions and -++ * limitations under the License. -++ */ -++/* -++ * $Id: SecuritySupport.java,v 1.1.2.1 2005/08/01 02:08:48 jeffsuttor Exp $ -++ */ -++ -++package com.sun.org.apache.xalan.internal.utils; -++ -++import java.io.File; -++import java.io.FileInputStream; -++import java.io.FileNotFoundException; -++import java.io.InputStream; -++ -++import java.security.AccessController; -++import java.security.PrivilegedAction; -++import java.security.PrivilegedActionException; -++import java.security.PrivilegedExceptionAction; -++import java.util.ListResourceBundle; -++import java.util.Locale; -++import java.util.MissingResourceException; -++import java.util.ResourceBundle; -++ -++/** -++ * This class is duplicated for each subpackage so keep it in sync. It is -++ * package private and therefore is not exposed as part of any API. -++ * -++ * @xerces.internal -++ */ -++public final class SecuritySupport { -++ -++ private static final SecuritySupport securitySupport = new SecuritySupport(); -++ -++ /** -++ * Return an instance of this class. -++ */ -++ public static SecuritySupport getInstance() { -++ return securitySupport; -++ } -++ -++ static ClassLoader getContextClassLoader() { -++ return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader cl = null; -++ try { -++ cl = Thread.currentThread().getContextClassLoader(); -++ } catch (SecurityException ex) { -++ } -++ return cl; -++ } -++ }); -++ } -++ -++ static ClassLoader getSystemClassLoader() { -++ return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader cl = null; -++ try { -++ cl = ClassLoader.getSystemClassLoader(); -++ } catch (SecurityException ex) { -++ } -++ return cl; -++ } -++ }); -++ } -++ -++ static ClassLoader getParentClassLoader(final ClassLoader cl) { -++ return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader parent = null; -++ try { -++ parent = cl.getParent(); -++ } catch (SecurityException ex) { -++ } -++ -++ // eliminate loops in case of the boot -++ // ClassLoader returning itself as a parent -++ return (parent == cl) ? null : parent; -++ } -++ }); -++ } -++ -++ public static String getSystemProperty(final String propName) { -++ return (String) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return System.getProperty(propName); -++ } -++ }); -++ } -++ -++ public static String getSystemProperty(final String propName, final String def) { -++ return (String) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return System.getProperty(propName, def); -++ } -++ }); -++ } -++ -++ static FileInputStream getFileInputStream(final File file) -++ throws FileNotFoundException { -++ try { -++ return (FileInputStream) AccessController.doPrivileged(new PrivilegedExceptionAction() { -++ public Object run() throws FileNotFoundException { -++ return new FileInputStream(file); -++ } -++ }); -++ } catch (PrivilegedActionException e) { -++ throw (FileNotFoundException)e.getException(); -++ } -++ } -++ -++ /** -++ * Return resource using the same classloader for the ObjectFactory by -++ * default or bootclassloader when Security Manager is in place -++ */ -++ public static InputStream getResourceAsStream(final String name) { -++ if (System.getSecurityManager()!=null) { -++ return getResourceAsStream(null, name); -++ } else { -++ return getResourceAsStream(ObjectFactory.findClassLoader(), name); -++ } -++ } -++ -++ public static InputStream getResourceAsStream(final ClassLoader cl, -++ final String name) { -++ return (InputStream) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ InputStream ris; -++ if (cl == null) { -++ ris = Object.class.getResourceAsStream("/"+name); -++ } else { -++ ris = cl.getResourceAsStream(name); -++ } -++ return ris; -++ } -++ }); -++ } -++ -++ /** -++ * Gets a resource bundle using the specified base name, the default locale, and the caller's class loader. -++ * @param bundle the base name of the resource bundle, a fully qualified class name -++ * @return a resource bundle for the given base name and the default locale -++ */ -++ public static ListResourceBundle getResourceBundle(String bundle) { -++ return getResourceBundle(bundle, Locale.getDefault()); -++ } -++ -++ /** -++ * Gets a resource bundle using the specified base name and locale, and the caller's class loader. -++ * @param bundle the base name of the resource bundle, a fully qualified class name -++ * @param locale the locale for which a resource bundle is desired -++ * @return a resource bundle for the given base name and locale -++ */ -++ public static ListResourceBundle getResourceBundle(final String bundle, final Locale locale) { -++ return AccessController.doPrivileged(new PrivilegedAction<ListResourceBundle>() { -++ public ListResourceBundle run() { -++ try { -++ return (ListResourceBundle)ResourceBundle.getBundle(bundle, locale); -++ } catch (MissingResourceException e) { -++ try { -++ return (ListResourceBundle)ResourceBundle.getBundle(bundle, new Locale("en", "US")); -++ } catch (MissingResourceException e2) { -++ throw new MissingResourceException( -++ "Could not load any resource bundle by " + bundle, bundle, ""); -++ } -++ } -++ } -++ }); -++ } -++ -++ public static boolean getFileExists(final File f) { -++ return ((Boolean) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return f.exists() ? Boolean.TRUE : Boolean.FALSE; -++ } -++ })).booleanValue(); -++ } -++ -++ static long getLastModified(final File f) { -++ return ((Long) AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return new Long(f.lastModified()); -++ } -++ })).longValue(); -++ } -++ -++ -++ private SecuritySupport() { -++ } -++} -+--- src/com/sun/org/apache/xalan/internal/xslt/EnvironmentCheck.java 2013-04-16 14:28:09.344150364 +0100 -++++ src/com/sun/org/apache/xalan/internal/xslt/EnvironmentCheck.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -22,6 +22,8 @@ -+ */ -+ package com.sun.org.apache.xalan.internal.xslt; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -++ -+ import java.io.File; -+ import java.io.FileWriter; -+ import java.io.PrintWriter; -+@@ -569,7 +571,7 @@ -+ // Grab java version for later use -+ try -+ { -+- String javaVersion = System.getProperty("java.version"); -++ String javaVersion = SecuritySupport.getSystemProperty("java.version"); -+ -+ h.put("java.version", javaVersion); -+ } -+@@ -588,7 +590,7 @@ -+ { -+ -+ // This is present in all JVM's -+- String cp = System.getProperty("java.class.path"); -++ String cp = SecuritySupport.getSystemProperty("java.class.path"); -+ -+ h.put("java.class.path", cp); -+ -+@@ -598,7 +600,7 @@ -+ h.put(FOUNDCLASSES + "java.class.path", classpathJars); -+ -+ // Also check for JDK 1.2+ type classpaths -+- String othercp = System.getProperty("sun.boot.class.path"); -++ String othercp = SecuritySupport.getSystemProperty("sun.boot.class.path"); -+ -+ if (null != othercp) -+ { -+@@ -612,7 +614,7 @@ -+ -+ //@todo NOTE: We don't actually search java.ext.dirs for -+ // *.jar files therein! This should be updated -+- othercp = System.getProperty("java.ext.dirs"); -++ othercp = SecuritySupport.getSystemProperty("java.ext.dirs"); -+ -+ if (null != othercp) -+ { -+--- src/com/sun/org/apache/xalan/internal/xslt/Process.java 2013-04-16 14:28:09.348150428 +0100 -++++ src/com/sun/org/apache/xalan/internal/xslt/Process.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -55,6 +55,7 @@ -+ import com.sun.org.apache.xalan.internal.Version; -+ import com.sun.org.apache.xalan.internal.res.XSLMessages; -+ import com.sun.org.apache.xalan.internal.res.XSLTErrorResources; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ //J2SE does not support Xalan interpretive -+ /* -+@@ -178,7 +179,7 @@ -+ java.io.PrintWriter diagnosticsWriter = new PrintWriter(System.err, true); -+ java.io.PrintWriter dumpWriter = diagnosticsWriter; -+ ResourceBundle resbundle = -+- (XSLMessages.loadResourceBundle( -++ (SecuritySupport.getResourceBundle( -+ com.sun.org.apache.xml.internal.utils.res.XResourceBundle.ERROR_RESOURCES)); -+ String flavor = "s2s"; -+ -+--- src/com/sun/org/apache/xalan/internal/xsltc/compiler/Parser.java 2013-04-16 14:28:09.380150944 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/compiler/Parser.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -400,7 +400,7 @@ -+ } -+ } -+ catch (TypeCheckError e) { -+- reportError(ERROR, new ErrorMsg(e)); -++ reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ } -+ } -+ -+@@ -420,7 +420,7 @@ -+ } -+ catch (IOException e) { -+ if (_xsltc.debug()) e.printStackTrace(); -+- reportError(ERROR,new ErrorMsg(e)); -++ reportError(ERROR,new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ } -+ catch (SAXException e) { -+ Throwable ex = e.getException(); -+@@ -428,15 +428,15 @@ -+ e.printStackTrace(); -+ if (ex != null) ex.printStackTrace(); -+ } -+- reportError(ERROR, new ErrorMsg(e)); -++ reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ } -+ catch (CompilerException e) { -+ if (_xsltc.debug()) e.printStackTrace(); -+- reportError(ERROR, new ErrorMsg(e)); -++ reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ } -+ catch (Exception e) { -+ if (_xsltc.debug()) e.printStackTrace(); -+- reportError(ERROR, new ErrorMsg(e)); -++ reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ } -+ return null; -+ } -+--- src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMessages.java 2013-04-16 14:28:09.400151266 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMessages.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -947,7 +947,12 @@ -+ "Cannot set the feature ''{0}'' on this TransformerFactory."}, -+ -+ {ErrorMsg.JAXP_SECUREPROCESSING_FEATURE, -+- "FEATURE_SECURE_PROCESSING: Cannot set the feature to false when security manager is present."} -++ "FEATURE_SECURE_PROCESSING: Cannot set the feature to false when security manager is present."}, -++ -++ {ErrorMsg.DESERIALIZE_TRANSLET_ERR, "When Java security is enabled, " + -++ "support for deserializing TemplatesImpl is disabled." + -++ "This can be overridden by setting the jdk.xml.enableTemplatesImplDeserialization" + -++ " system property to true."} -+ }; -+ } -+ } -+--- src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMsg.java 2013-04-16 14:28:09.420151588 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMsg.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -23,6 +23,7 @@ -+ -+ package com.sun.org.apache.xalan.internal.xsltc.compiler.util; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.text.MessageFormat; -+ import java.util.Locale; -+ import java.util.ResourceBundle; -+@@ -46,6 +47,8 @@ -+ Object[] _params = null; -+ private boolean _isWarningError; -+ -++ Throwable _cause; -++ -+ // Compiler error messages -+ public static final String MULTIPLE_STYLESHEET_ERR = "MULTIPLE_STYLESHEET_ERR"; -+ public static final String TEMPLATE_REDEF_ERR = "TEMPLATE_REDEF_ERR"; -+@@ -157,6 +160,8 @@ -+ public static final String INVALID_NCNAME_ERR = "INVALID_NCNAME_ERR"; -+ public static final String INVALID_METHOD_IN_OUTPUT = "INVALID_METHOD_IN_OUTPUT"; -+ -++ public static final String DESERIALIZE_TRANSLET_ERR = "DESERIALIZE_TEMPLATES_ERR"; -++ -+ // All error messages are localized and are stored in resource bundles. -+ // This array and the following 4 strings are read from that bundle. -+ private static ResourceBundle _bundle; -+@@ -167,7 +172,7 @@ -+ public final static String RUNTIME_ERROR_KEY = "RUNTIME_ERROR_KEY"; -+ -+ static { -+- _bundle = ResourceBundle.getBundle( -++ _bundle = SecuritySupport.getResourceBundle( -+ "com.sun.org.apache.xalan.internal.xsltc.compiler.util.ErrorMessages", -+ Locale.getDefault()); -+ } -+@@ -177,10 +182,11 @@ -+ _line = 0; -+ } -+ -+- public ErrorMsg(Throwable e) { -+- _code = null; -++ public ErrorMsg(String code, Throwable e) { -++ _code = code; -+ _message = e.getMessage(); -+ _line = 0; -++ _cause = e; -+ } -+ -+ public ErrorMsg(String message, int line) { -+@@ -232,6 +238,10 @@ -+ _params[1] = param2; -+ } -+ -++ public Throwable getCause() { -++ return _cause; -++ } -++ -+ private String getFileName(SyntaxTreeNode node) { -+ Stylesheet stylesheet = node.getStylesheet(); -+ if (stylesheet != null) -+--- src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/Util.java 2013-04-16 14:28:09.428151717 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/Util.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -26,6 +26,7 @@ -+ import java.util.StringTokenizer; -+ -+ import com.sun.org.apache.bcel.internal.generic.Type; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import com.sun.org.apache.xalan.internal.xsltc.compiler.Constants; -+ import com.sun.org.apache.xml.internal.utils.XML11Char; -+ -+@@ -37,7 +38,7 @@ -+ private static char filesep; -+ -+ static { -+- String temp = System.getProperty("file.separator", "/"); -++ String temp = SecuritySupport.getSystemProperty("file.separator", "/"); -+ filesep = temp.charAt(0); -+ } -+ -+--- src/com/sun/org/apache/xalan/internal/xsltc/compiler/XSLTC.java 2013-04-16 14:28:09.396151201 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/compiler/XSLTC.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -41,10 +41,12 @@ -+ import java.util.jar.Manifest; -+ -+ import com.sun.org.apache.bcel.internal.classfile.JavaClass; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import com.sun.org.apache.xalan.internal.xsltc.compiler.util.ErrorMsg; -+ import com.sun.org.apache.xalan.internal.xsltc.compiler.util.Util; -+ import com.sun.org.apache.xml.internal.dtm.DTM; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import org.xml.sax.InputSource; -+ import org.xml.sax.XMLReader; -+ -+@@ -257,7 +259,7 @@ -+ return compile(input, _className); -+ } -+ catch (IOException e) { -+- _parser.reportError(Constants.FATAL, new ErrorMsg(e)); -++ _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ return false; -+ } -+ } -+@@ -276,7 +278,7 @@ -+ return compile(input, name); -+ } -+ catch (IOException e) { -+- _parser.reportError(Constants.FATAL, new ErrorMsg(e)); -++ _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ return false; -+ } -+ } -+@@ -361,11 +363,11 @@ -+ } -+ catch (Exception e) { -+ /*if (_debug)*/ e.printStackTrace(); -+- _parser.reportError(Constants.FATAL, new ErrorMsg(e)); -++ _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ } -+ catch (Error e) { -+ if (_debug) e.printStackTrace(); -+- _parser.reportError(Constants.FATAL, new ErrorMsg(e)); -++ _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e)); -+ } -+ finally { -+ _reader = null; // reset this here to be sure it is not re-used -+@@ -573,7 +575,7 @@ -+ */ -+ public boolean setDestDirectory(String dstDirName) { -+ final File dir = new File(dstDirName); -+- if (dir.exists() || dir.mkdirs()) { -++ if (SecuritySupport.getFileExists(dir) || dir.mkdirs()) { -+ _destDir = dir; -+ return true; -+ } -+@@ -746,7 +748,7 @@ -+ String parentDir = outFile.getParent(); -+ if (parentDir != null) { -+ File parentFile = new File(parentDir); -+- if (!parentFile.exists()) -++ if (!SecuritySupport.getFileExists(parentFile)) -+ parentFile.mkdirs(); -+ } -+ } -+--- src/com/sun/org/apache/xalan/internal/xsltc/dom/NodeSortRecord.java 2013-04-16 14:28:09.444151975 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/dom/NodeSortRecord.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -32,6 +32,7 @@ -+ import com.sun.org.apache.xalan.internal.xsltc.TransletException; -+ import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; -+ import com.sun.org.apache.xml.internal.utils.StringComparable; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ /** -+ * Base class for sort records containing application specific sort keys -+@@ -111,7 +112,7 @@ -+ try { -+ // -- W. Eliot Kimber (eliot@isogen.com) -+ colFactClassname = -+- System.getProperty("com.sun.org.apache.xalan.internal.xsltc.COLLATOR_FACTORY"); -++ SecuritySupport.getSystemProperty("com.sun.org.apache.xalan.internal.xsltc.COLLATOR_FACTORY"); -+ } -+ catch (SecurityException e) { -+ // If we can't read the propery, just use default collator -+--- src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java 2013-04-16 14:28:09.448152039 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java 2013-04-16 14:29:26.553394447 +0100 -+@@ -23,6 +23,7 @@ -+ -+ package com.sun.org.apache.xalan.internal.xsltc.runtime; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.text.DecimalFormat; -+ import java.text.DecimalFormatSymbols; -+ import java.text.FieldPosition; -+@@ -1518,7 +1519,7 @@ -+ -+ static { -+ String resource = "com.sun.org.apache.xalan.internal.xsltc.runtime.ErrorMessages"; -+- m_bundle = ResourceBundle.getBundle(resource); -++ m_bundle = SecuritySupport.getResourceBundle(resource); -+ } -+ -+ /** -+--- src/com/sun/org/apache/xalan/internal/xsltc/runtime/output/WriterOutputBuffer.java 2013-04-16 14:28:09.456152168 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/runtime/output/WriterOutputBuffer.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -23,6 +23,7 @@ -+ -+ package com.sun.org.apache.xalan.internal.xsltc.runtime.output; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.io.BufferedWriter; -+ import java.io.IOException; -+ import java.io.Writer; -+@@ -36,7 +37,7 @@ -+ -+ static { -+ // Set a larger buffer size for Solaris -+- final String osName = System.getProperty("os.name"); -++ final String osName = SecuritySupport.getSystemProperty("os.name"); -+ if (osName.equalsIgnoreCase("solaris")) { -+ BUFFER_SIZE = 32 * KB; -+ } -+--- src/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java 2013-04-16 14:28:09.460152233 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -42,6 +42,7 @@ -+ import com.sun.org.apache.xalan.internal.xsltc.compiler.util.ErrorMsg; -+ import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; -+ import com.sun.org.apache.xalan.internal.xsltc.runtime.Hashtable; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ /** -+ * @author Morten Jorgensen -+@@ -51,6 +52,8 @@ -+ */ -+ public final class TemplatesImpl implements Templates, Serializable { -+ static final long serialVersionUID = 673094361519270707L; -++ public final static String DESERIALIZE_TRANSLET = "jdk.xml.enableTemplatesImplDeserialization"; -++ -+ /** -+ * Name of the superclass of all translets. This is needed to -+ * determine which, among all classes comprising a translet, -+@@ -181,6 +184,15 @@ -+ private void readObject(ObjectInputStream is) -+ throws IOException, ClassNotFoundException -+ { -++ SecurityManager security = System.getSecurityManager(); -++ if (security != null){ -++ String temp = SecuritySupport.getSystemProperty(DESERIALIZE_TRANSLET); -++ if (temp == null || !(temp.length()==0 || temp.equalsIgnoreCase("true"))) { -++ ErrorMsg err = new ErrorMsg(ErrorMsg.DESERIALIZE_TRANSLET_ERR); -++ throw new UnsupportedOperationException(err.toString()); -++ } -++ } -++ -+ is.defaultReadObject(); -+ if (is.readBoolean()) { -+ _uriResolver = (URIResolver) is.readObject(); -+--- src/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java 2013-04-16 14:28:09.460152233 +0100 -++++ src/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -69,7 +69,7 @@ -+ import com.sun.org.apache.xalan.internal.xsltc.compiler.XSLTC; -+ import com.sun.org.apache.xalan.internal.xsltc.compiler.util.ErrorMsg; -+ import com.sun.org.apache.xalan.internal.xsltc.dom.XSLTCDTMManager; -+- -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ import org.xml.sax.InputSource; -+ import org.xml.sax.XMLFilter; -+@@ -839,8 +839,14 @@ -+ // Check that the transformation went well before returning -+ if (bytecodes == null) { -+ -+- ErrorMsg err = new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR); -+- TransformerConfigurationException exc = new TransformerConfigurationException(err.toString()); -++ Vector errs = xsltc.getErrors(); -++ ErrorMsg err = null; -++ if (errs != null) { -++ err = (ErrorMsg)errs.get(errs.size()-1); -++ } else { -++ err = new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR); -++ } -++ TransformerConfigurationException exc = new TransformerConfigurationException(err.toString(), err.getCause()); -+ -+ // Pass compiler errors to the error listener -+ if (_errorListener != null) { -+@@ -1187,7 +1193,7 @@ -+ // Find the parent directory of the translet. -+ String transletParentDir = transletFile.getParent(); -+ if (transletParentDir == null) -+- transletParentDir = System.getProperty("user.dir"); -++ transletParentDir = SecuritySupport.getSystemProperty("user.dir"); -+ -+ File transletParentFile = new File(transletParentDir); -+ -+--- src/com/sun/org/apache/xerces/internal/dom/DOMMessageFormatter.java 2013-04-16 14:28:09.472152426 +0100 -++++ src/com/sun/org/apache/xerces/internal/dom/DOMMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,10 +20,10 @@ -+ -+ -+ package com.sun.org.apache.xerces.internal.dom; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+ import java.util.ResourceBundle; -+-import java.util.PropertyResourceBundle; -+ -+ /** -+ * Used to format DOM error messages, using the system locale. -+@@ -31,6 +31,7 @@ -+ * @xerces.internal -+ * -+ * @author Sandy Gao, IBM -++ * @version $Id: DOMMessageFormatter.java,v 1.6 2010-11-01 04:39:38 joehw Exp $ -+ */ -+ public class DOMMessageFormatter { -+ public static final String DOM_DOMAIN = "http://www.w3.org/dom/DOMTR"; -+@@ -122,13 +123,13 @@ -+ */ -+ public static void init(){ -+ if (locale != null) { -+- domResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages", locale); -+- serResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages", locale); -+- xmlResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale); -++ domResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages", locale); -++ serResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages", locale); -++ xmlResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale); -+ }else{ -+- domResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages"); -+- serResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages"); -+- xmlResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages"); -++ domResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages"); -++ serResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages"); -++ xmlResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages"); -+ } -+ } -+ -+--- src/com/sun/org/apache/xerces/internal/impl/dv/DatatypeException.java 2013-04-16 14:28:09.532153393 +0100 -++++ src/com/sun/org/apache/xerces/internal/impl/dv/DatatypeException.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,6 +20,7 @@ -+ -+ package com.sun.org.apache.xerces.internal.impl.dv; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.ResourceBundle; -+ import java.util.PropertyResourceBundle; -+ import java.util.MissingResourceException; -+@@ -34,6 +35,7 @@ -+ * -+ * @author Sandy Gao, IBM -+ * -++ * @version $Id: DatatypeException.java,v 1.6 2010-11-01 04:39:43 joehw Exp $ -+ */ -+ public class DatatypeException extends Exception { -+ -+@@ -84,7 +86,7 @@ -+ */ -+ public String getMessage() { -+ ResourceBundle resourceBundle = null; -+- resourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages"); -++ resourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages"); -+ if (resourceBundle == null) -+ throw new MissingResourceException("Property file not found!", "com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages", key); -+ -+--- src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter.java 2013-04-16 14:28:09.552153715 +0100 -++++ src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,12 +20,11 @@ -+ -+ package com.sun.org.apache.xerces.internal.impl.msg; -+ -++import com.sun.org.apache.xerces.internal.util.MessageFormatter; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+ import java.util.ResourceBundle; -+-import java.util.PropertyResourceBundle; -+- -+-import com.sun.org.apache.xerces.internal.util.MessageFormatter; -+ -+ /** -+ * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for -+@@ -71,12 +70,12 @@ -+ -+ if (fResourceBundle == null || locale != fLocale) { -+ if (locale != null) { -+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale); -++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale); -+ // memorize the most-recent locale -+ fLocale = locale; -+ } -+ if (fResourceBundle == null) -+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages"); -++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages"); -+ } -+ -+ // format message -+--- src/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java 2013-04-16 14:28:09.504152942 +0100 -++++ src/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -52,6 +52,7 @@ -+ import com.sun.org.apache.xerces.internal.xni.XNIException; -+ import com.sun.org.apache.xerces.internal.xni.parser.*; -+ import com.sun.org.apache.xerces.internal.impl.Constants; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import com.sun.xml.internal.stream.Entity; -+ import com.sun.org.apache.xerces.internal.xni.Augmentations; -+ -+@@ -1811,7 +1812,7 @@ -+ // get the user.dir property -+ String userDir = ""; -+ try { -+- userDir = System.getProperty("user.dir"); -++ userDir = SecuritySupport.getSystemProperty("user.dir"); -+ } -+ catch (SecurityException se) { -+ } -+@@ -2155,9 +2156,6 @@ -+ private static String expandSystemIdStrictOff(String systemId, String baseSystemId) -+ throws URI.MalformedURIException { -+ -+- systemId = escapeNonUSAscii(systemId); -+- baseSystemId = escapeNonUSAscii(baseSystemId); -+- -+ URI systemURI = new URI(systemId, true); -+ // If it's already an absolute one, return it -+ if (systemURI.isAbsoluteURI()) { -+@@ -2623,64 +2621,6 @@ -+ -+ } // fixURI(String):String -+ -+- /** -+- * Escape invalid URI characters. -+- * -+- * Passed a URI that contains invalid characters (like spaces, non-ASCII Unicode characters, and the like), -+- * this function percent encodes the invalid characters per the URI specification (i.e., as a sequence of -+- * %-encoded UTF-8 octets). -+- * -+- * N.B. There are two problems. If the URI contains a '%' character, that might be an indication that -+- * the URI has already been escaped by the author, or it might be an invalid '%'. In the former case, -+- * it's important not to escape it, or we'll wind up with invalid, doubly-escaped '%'s. In the latter, -+- * the URI is broken if we don't encode it. Similarly, a '#' character might be the start of a fragment -+- * identifier or it might be an invalid '#'. -+- * -+- * Given that the former is vastly more likely than the latter in each case (most users are familiar with -+- * the magic status of '%' and '#' and they occur relatively infrequently in filenames, and if the user parses -+- * a proper Java File, we will already have %-escaped the URI), we simply assume that %'s and #'s are legit. -+- * -+- * Very rarely, we may be wrong. If so, tell the user to fix the clearly broken URI. -+- */ -+- protected static String escapeNonUSAscii(String str) { -+- if (str == null) { -+- return str; -+- } -+- -+- // get UTF-8 bytes for the string -+- StringBuffer buffer = new StringBuffer(); -+- byte[] bytes = null; -+- byte b; -+- try { -+- bytes = str.getBytes("UTF-8"); -+- } catch (java.io.UnsupportedEncodingException e) { -+- // should never happen -+- return str; -+- } -+- int len = bytes.length; -+- int ch; -+- -+- // for each byte -+- for (int i = 0; i < len; i++) { -+- b = bytes[i]; -+- // for non-ascii character: make it positive, then escape -+- if (b < 0) { -+- ch = b + 256; -+- buffer.append('%'); -+- buffer.append(gHexChs[ch >> 4]); -+- buffer.append(gHexChs[ch & 0xf]); -+- } -+- else if (b != '%' && b != '#' && gNeedEscaping[b]) { -+- buffer.append('%'); -+- buffer.append(gAfterEscaping1[b]); -+- buffer.append(gAfterEscaping2[b]); -+- } -+- else { -+- buffer.append((char)b); -+- } -+- } -+- return buffer.toString(); -+- } -+ -+ // -+ // Package visible methods -+--- src/com/sun/org/apache/xerces/internal/impl/xpath/regex/RegexParser.java 2013-04-16 14:28:09.560153844 +0100 -++++ src/com/sun/org/apache/xerces/internal/impl/xpath/regex/RegexParser.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,6 +20,7 @@ -+ -+ package com.sun.org.apache.xerces.internal.impl.xpath.regex; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+ import java.util.ResourceBundle; -+@@ -94,10 +95,10 @@ -+ public void setLocale(Locale locale) { -+ try { -+ if (locale != null) { -+- this.resources = ResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message", locale); -++ this.resources = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message", locale); -+ } -+ else { -+- this.resources = ResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message"); -++ this.resources = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message"); -+ } -+ } -+ catch (MissingResourceException mre) { -+--- src/com/sun/org/apache/xerces/internal/impl/xs/XSMessageFormatter.java 2013-04-16 14:28:09.572154037 +0100 -++++ src/com/sun/org/apache/xerces/internal/impl/xs/XSMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,11 +20,11 @@ -+ -+ package com.sun.org.apache.xerces.internal.impl.xs; -+ -++import com.sun.org.apache.xerces.internal.util.MessageFormatter; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+ import java.util.ResourceBundle; -+-import java.util.PropertyResourceBundle; -+-import com.sun.org.apache.xerces.internal.util.MessageFormatter; -+ -+ -+ /** -+@@ -34,6 +34,7 @@ -+ * @xerces.internal -+ * -+ * @author Elena Litani, IBM -++ * @version $Id: XSMessageFormatter.java,v 1.6 2010-11-01 04:39:55 joehw Exp $ -+ */ -+ public class XSMessageFormatter implements MessageFormatter { -+ /** -+@@ -66,12 +67,12 @@ -+ -+ if (fResourceBundle == null || locale != fLocale) { -+ if (locale != null) { -+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages", locale); -++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages", locale); -+ // memorize the most-recent locale -+ fLocale = locale; -+ } -+ if (fResourceBundle == null) -+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages"); -++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages"); -+ } -+ -+ String msg = fResourceBundle.getString(key); -+--- src/com/sun/org/apache/xerces/internal/jaxp/validation/JAXPValidationMessageFormatter.java 2013-04-16 14:28:09.600154489 +0100 -++++ src/com/sun/org/apache/xerces/internal/jaxp/validation/JAXPValidationMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,15 +20,16 @@ -+ -+ package com.sun.org.apache.xerces.internal.jaxp.validation; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+ import java.util.ResourceBundle; -+-import java.util.PropertyResourceBundle; -+ -+ /** -+ * <p>Used to format JAXP Validation API error messages using a specified locale.</p> -+ * -+ * @author Michael Glavassevich, IBM -++ * @version $Id: JAXPValidationMessageFormatter.java,v 1.5 2010-11-01 04:40:08 joehw Exp $ -+ */ -+ final class JAXPValidationMessageFormatter { -+ -+@@ -54,11 +55,11 @@ -+ ResourceBundle resourceBundle = null; -+ if (locale != null) { -+ resourceBundle = -+- PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages", locale); -++ SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages", locale); -+ } -+ else { -+ resourceBundle = -+- PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages"); -++ SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages"); -+ } -+ -+ // format message -+--- src/com/sun/org/apache/xerces/internal/util/DatatypeMessageFormatter.java 2013-04-16 14:28:09.616154746 +0100 -++++ src/com/sun/org/apache/xerces/internal/util/DatatypeMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,15 +20,16 @@ -+ -+ package com.sun.org.apache.xerces.internal.util; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+-import java.util.PropertyResourceBundle; -+ import java.util.ResourceBundle; -+ -+ /** -+ * <p>Used to format JAXP 1.3 Datatype API error messages using a specified locale.</p> -+ * -+ * @author Neeraj Bajaj, Sun Microsystems -++ * @version $Id: DatatypeMessageFormatter.java,v 1.6 2010-11-01 04:40:14 joehw Exp $ -+ */ -+ public class DatatypeMessageFormatter { -+ -+@@ -56,11 +57,11 @@ -+ ResourceBundle resourceBundle = null; -+ if (locale != null) { -+ resourceBundle = -+- PropertyResourceBundle.getBundle(BASE_NAME, locale); -++ SecuritySupport.getResourceBundle(BASE_NAME, locale); -+ } -+ else { -+ resourceBundle = -+- PropertyResourceBundle.getBundle(BASE_NAME); -++ SecuritySupport.getResourceBundle(BASE_NAME); -+ } -+ -+ // format message -+--- src/com/sun/org/apache/xerces/internal/util/SAXMessageFormatter.java 2013-04-16 14:28:09.620154811 +0100 -++++ src/com/sun/org/apache/xerces/internal/util/SAXMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -19,16 +19,17 @@ -+ */ -+ package com.sun.org.apache.xerces.internal.util; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+ import java.util.ResourceBundle; -+-import java.util.PropertyResourceBundle; -+ -+ /** -+ * Used to format SAX error messages using a specified locale. -+ * -+ * @author Michael Glavassevich, IBM -+ * -++ * @version $Id: SAXMessageFormatter.java,v 1.6 2010-11-01 04:40:14 joehw Exp $ -+ */ -+ public class SAXMessageFormatter { -+ -+@@ -54,11 +55,11 @@ -+ ResourceBundle resourceBundle = null; -+ if (locale != null) { -+ resourceBundle = -+- PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages", locale); -++ SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages", locale); -+ } -+ else { -+ resourceBundle = -+- PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages"); -++ SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages"); -+ } -+ -+ // format message -+--- src/com/sun/org/apache/xerces/internal/util/SecurityManager.java 2013-04-16 14:28:09.620154811 +0100 -++++ src/com/sun/org/apache/xerces/internal/util/SecurityManager.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -61,6 +61,8 @@ -+ -+ package com.sun.org.apache.xerces.internal.util; -+ import com.sun.org.apache.xerces.internal.impl.Constants; -++import java.security.AccessController; -++import java.security.PrivilegedAction; -+ /** -+ * This class is a container for parser settings that relate to -+ * security, or more specifically, it is intended to be used to prevent denial-of-service -+@@ -77,6 +79,7 @@ -+ * -+ * @author Neil Graham, IBM -+ * -++ * @version $Id: SecurityManager.java,v 1.5 2010-11-01 04:40:14 joehw Exp $ -+ */ -+ public final class SecurityManager { -+ -+@@ -176,41 +179,48 @@ -+ -+ private void readSystemProperties(){ -+ -+- //TODO: also read SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT -+- try { -+- String value = System.getProperty(Constants.ENTITY_EXPANSION_LIMIT); -+- if(value != null && !value.equals("")){ -+- entityExpansionLimit = Integer.parseInt(value); -+- if (entityExpansionLimit < 0) -+- entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; -+- } -+- else -+- entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; -+- }catch(Exception ex){} -+- -+- try { -+- String value = System.getProperty(Constants.MAX_OCCUR_LIMIT); -+- if(value != null && !value.equals("")){ -+- maxOccurLimit = Integer.parseInt(value); -+- if (maxOccurLimit < 0) -+- maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; -+- } -+- else -+- maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; -+- }catch(Exception ex){} -+- -+- try { -+- String value = System.getProperty(Constants.SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT); -+- if(value != null && !value.equals("")){ -+- fElementAttributeLimit = Integer.parseInt(value); -+- if ( fElementAttributeLimit < 0) -+- fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; -+- } -+- else -+- fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; -++ //TODO: also read SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT -++ try { -++ String value = getSystemProperty(Constants.ENTITY_EXPANSION_LIMIT); -++ if(value != null && !value.equals("")){ -++ entityExpansionLimit = Integer.parseInt(value); -++ if (entityExpansionLimit < 0) -++ entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; -++ } -++ else -++ entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT; -++ }catch(Exception ex){} -++ -++ try { -++ String value = getSystemProperty(Constants.MAX_OCCUR_LIMIT); -++ if(value != null && !value.equals("")){ -++ maxOccurLimit = Integer.parseInt(value); -++ if (maxOccurLimit < 0) -++ maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; -++ } -++ else -++ maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT; -++ }catch(Exception ex){} -++ -++ try { -++ String value = getSystemProperty(Constants.SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT); -++ if(value != null && !value.equals("")){ -++ fElementAttributeLimit = Integer.parseInt(value); -++ if ( fElementAttributeLimit < 0) -++ fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; -++ } -++ else -++ fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT; -+ -+ }catch(Exception ex){} -+ -+ } -+ -++ private String getSystemProperty(final String propName) { -++ return AccessController.doPrivileged(new PrivilegedAction<String>() { -++ public String run() { -++ return System.getProperty(propName); -++ } -++ }); -++ } -+ } // class SecurityManager -+--- src/com/sun/org/apache/xerces/internal/utils/ConfigurationError.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/com/sun/org/apache/xerces/internal/utils/ConfigurationError.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -0,0 +1,58 @@ -++/* -++ * reserved comment block -++ * DO NOT REMOVE OR ALTER! -++ */ -++/* -++ * Copyright 2001-2005 The Apache Software Foundation. -++ * -++ * Licensed under the Apache License, Version 2.0 (the "License"); -++ * you may not use this file except in compliance with the License. -++ * You may obtain a copy of the License at -++ * -++ * http://www.apache.org/licenses/LICENSE-2.0 -++ * -++ * Unless required by applicable law or agreed to in writing, software -++ * distributed under the License is distributed on an "AS IS" BASIS, -++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -++ * See the License for the specific language governing permissions and -++ * limitations under the License. -++ */ -++ -++package com.sun.org.apache.xerces.internal.utils; -++ -++/** -++ * A configuration error. This was an internal class in ObjectFactory previously -++ */ -++public final class ConfigurationError -++ extends Error { -++ -++ // -++ // Data -++ // -++ -++ /** Exception. */ -++ private Exception exception; -++ -++ // -++ // Constructors -++ // -++ -++ /** -++ * Construct a new instance with the specified detail string and -++ * exception. -++ */ -++ ConfigurationError(String msg, Exception x) { -++ super(msg); -++ this.exception = x; -++ } // <init>(String,Exception) -++ -++ // -++ // methods -++ // -++ -++ /** Returns the exception associated to this error. */ -++ public Exception getException() { -++ return exception; -++ } // getException():Exception -++ -++} // class ConfigurationError -+--- src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -0,0 +1,436 @@ -++/* -++ * reserved comment block -++ * DO NOT REMOVE OR ALTER! -++ */ -++/* -++ * Copyright 2001-2005 The Apache Software Foundation. -++ * -++ * Licensed under the Apache License, Version 2.0 (the "License"); -++ * you may not use this file except in compliance with the License. -++ * You may obtain a copy of the License at -++ * -++ * http://www.apache.org/licenses/LICENSE-2.0 -++ * -++ * Unless required by applicable law or agreed to in writing, software -++ * distributed under the License is distributed on an "AS IS" BASIS, -++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -++ * See the License for the specific language governing permissions and -++ * limitations under the License. -++ */ -++ -++package com.sun.org.apache.xerces.internal.utils; -++ -++import java.io.InputStream; -++import java.io.IOException; -++import java.io.File; -++import java.io.FileInputStream; -++ -++import java.util.Properties; -++import java.io.BufferedReader; -++import java.io.InputStreamReader; -++ -++/** -++ * This class is duplicated for each JAXP subpackage so keep it in sync. -++ * It is package private and therefore is not exposed as part of the JAXP -++ * API. -++ * <p> -++ * This code is designed to implement the JAXP 1.1 spec pluggability -++ * feature and is designed to run on JDK version 1.1 and -++ * later, and to compile on JDK 1.2 and onward. -++ * The code also runs both as part of an unbundled jar file and -++ * when bundled as part of the JDK. -++ * <p> -++ * -++ * @version $Id: ObjectFactory.java,v 1.6 2010/04/23 01:44:34 joehw Exp $ -++ */ -++public final class ObjectFactory { -++ -++ // -++ // Constants -++ // -++ private static final String DEFAULT_INTERNAL_CLASSES = "com.sun.org.apache."; -++ -++ // name of default properties file to look for in JDK's jre/lib directory -++ private static final String DEFAULT_PROPERTIES_FILENAME = "xerces.properties"; -++ -++ /** Set to true for debugging */ -++ private static final boolean DEBUG = isDebugEnabled(); -++ -++ /** -++ * Default columns per line. -++ */ -++ private static final int DEFAULT_LINE_LENGTH = 80; -++ -++ /** cache the contents of the xerces.properties file. -++ * Until an attempt has been made to read this file, this will -++ * be null; if the file does not exist or we encounter some other error -++ * during the read, this will be empty. -++ */ -++ private static Properties fXercesProperties = null; -++ -++ /*** -++ * Cache the time stamp of the xerces.properties file so -++ * that we know if it's been modified and can invalidate -++ * the cache when necessary. -++ */ -++ private static long fLastModified = -1; -++ -++ // -++ // static methods -++ // -++ -++ /** -++ * Finds the implementation Class object in the specified order. The -++ * specified order is the following: -++ * <ol> -++ * <li>query the system property using <code>System.getProperty</code> -++ * <li>read <code>META-INF/services/<i>factoryId</i></code> file -++ * <li>use fallback classname -++ * </ol> -++ * -++ * @return Class object of factory, never null -++ * -++ * @param factoryId Name of the factory to find, same as -++ * a property name -++ * @param fallbackClassName Implementation class name, if nothing else -++ * is found. Use null to mean no fallback. -++ * -++ * @exception ObjectFactory.ConfigurationError -++ */ -++ public static Object createObject(String factoryId, String fallbackClassName) -++ throws ConfigurationError { -++ return createObject(factoryId, null, fallbackClassName); -++ } // createObject(String,String):Object -++ -++ /** -++ * Finds the implementation Class object in the specified order. The -++ * specified order is the following: -++ * <ol> -++ * <li>query the system property using <code>System.getProperty</code> -++ * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -++ * <li>read <code>META-INF/services/<i>factoryId</i></code> file -++ * <li>use fallback classname -++ * </ol> -++ * -++ * @return Class object of factory, never null -++ * -++ * @param factoryId Name of the factory to find, same as -++ * a property name -++ * @param propertiesFilename The filename in the $java.home/lib directory -++ * of the properties file. If none specified, -++ * ${java.home}/lib/xerces.properties will be used. -++ * @param fallbackClassName Implementation class name, if nothing else -++ * is found. Use null to mean no fallback. -++ * -++ * @exception ObjectFactory.ConfigurationError -++ */ -++ public static Object createObject(String factoryId, -++ String propertiesFilename, -++ String fallbackClassName) -++ throws ConfigurationError -++ { -++ if (DEBUG) debugPrintln("debug is on"); -++ -++ ClassLoader cl = findClassLoader(); -++ -++ // Use the system property first -++ try { -++ String systemProp = SecuritySupport.getSystemProperty(factoryId); -++ if (systemProp != null && systemProp.length() > 0) { -++ if (DEBUG) debugPrintln("found system property, value=" + systemProp); -++ return newInstance(systemProp, cl, true); -++ } -++ } catch (SecurityException se) { -++ // Ignore and continue w/ next location -++ } -++ -++ // JAXP specific change -++ // always use fallback class to avoid the expense of constantly -++ // "stat"ing a non-existent "xerces.properties" and jar SPI entry -++ // see CR 6400863: Expensive creating of SAX parser in Mustang -++ if (fallbackClassName == null) { -++ throw new ConfigurationError( -++ "Provider for " + factoryId + " cannot be found", null); -++ } -++ -++ if (DEBUG) debugPrintln("using fallback, value=" + fallbackClassName); -++ return newInstance(fallbackClassName, cl, true); -++ -++ } // createObject(String,String,String):Object -++ -++ // -++ // Private static methods -++ // -++ -++ /** Returns true if debug has been enabled. */ -++ private static boolean isDebugEnabled() { -++ try { -++ String val = SecuritySupport.getSystemProperty("xerces.debug"); -++ // Allow simply setting the prop to turn on debug -++ return (val != null && (!"false".equals(val))); -++ } -++ catch (SecurityException se) {} -++ return false; -++ } // isDebugEnabled() -++ -++ /** Prints a message to standard error if debugging is enabled. */ -++ private static void debugPrintln(String msg) { -++ if (DEBUG) { -++ System.err.println("XERCES: " + msg); -++ } -++ } // debugPrintln(String) -++ -++ /** -++ * Figure out which ClassLoader to use. For JDK 1.2 and later use -++ * the context ClassLoader. -++ */ -++ public static ClassLoader findClassLoader() -++ throws ConfigurationError -++ { -++ if (System.getSecurityManager()!=null) { -++ //this will ensure bootclassloader is used -++ return null; -++ } -++ // Figure out which ClassLoader to use for loading the provider -++ // class. If there is a Context ClassLoader then use it. -++ ClassLoader context = SecuritySupport.getContextClassLoader(); -++ ClassLoader system = SecuritySupport.getSystemClassLoader(); -++ -++ ClassLoader chain = system; -++ while (true) { -++ if (context == chain) { -++ // Assert: we are on JDK 1.1 or we have no Context ClassLoader -++ // or any Context ClassLoader in chain of system classloader -++ // (including extension ClassLoader) so extend to widest -++ // ClassLoader (always look in system ClassLoader if Xerces -++ // is in boot/extension/system classpath and in current -++ // ClassLoader otherwise); normal classloaders delegate -++ // back to system ClassLoader first so this widening doesn't -++ // change the fact that context ClassLoader will be consulted -++ ClassLoader current = ObjectFactory.class.getClassLoader(); -++ -++ chain = system; -++ while (true) { -++ if (current == chain) { -++ // Assert: Current ClassLoader in chain of -++ // boot/extension/system ClassLoaders -++ return system; -++ } -++ if (chain == null) { -++ break; -++ } -++ chain = SecuritySupport.getParentClassLoader(chain); -++ } -++ -++ // Assert: Current ClassLoader not in chain of -++ // boot/extension/system ClassLoaders -++ return current; -++ } -++ -++ if (chain == null) { -++ // boot ClassLoader reached -++ break; -++ } -++ -++ // Check for any extension ClassLoaders in chain up to -++ // boot ClassLoader -++ chain = SecuritySupport.getParentClassLoader(chain); -++ }; -++ -++ // Assert: Context ClassLoader not in chain of -++ // boot/extension/system ClassLoaders -++ return context; -++ } // findClassLoader():ClassLoader -++ -++ /** -++ * Create an instance of a class using the same classloader for the ObjectFactory by default -++ * or bootclassloader when Security Manager is in place -++ */ -++ public static Object newInstance(String className, boolean doFallback) -++ throws ConfigurationError -++ { -++ if (System.getSecurityManager()!=null) { -++ return newInstance(className, null, doFallback); -++ } else { -++ return newInstance(className, -++ findClassLoader (), doFallback); -++ } -++ } -++ -++ /** -++ * Create an instance of a class using the specified ClassLoader -++ */ -++ public static Object newInstance(String className, ClassLoader cl, -++ boolean doFallback) -++ throws ConfigurationError -++ { -++ // assert(className != null); -++ try{ -++ Class providerClass = findProviderClass(className, cl, doFallback); -++ Object instance = providerClass.newInstance(); -++ if (DEBUG) debugPrintln("created new instance of " + providerClass + -++ " using ClassLoader: " + cl); -++ return instance; -++ } catch (ClassNotFoundException x) { -++ throw new ConfigurationError( -++ "Provider " + className + " not found", x); -++ } catch (Exception x) { -++ throw new ConfigurationError( -++ "Provider " + className + " could not be instantiated: " + x, -++ x); -++ } -++ } -++ -++ /** -++ * Find a Class using the same classloader for the ObjectFactory by default -++ * or bootclassloader when Security Manager is in place -++ */ -++ public static Class findProviderClass(String className, boolean doFallback) -++ throws ClassNotFoundException, ConfigurationError -++ { -++ if (System.getSecurityManager()!=null) { -++ return Class.forName(className); -++ } else { -++ return findProviderClass (className, -++ findClassLoader (), doFallback); -++ } -++ } -++ /** -++ * Find a Class using the specified ClassLoader -++ */ -++ public static Class findProviderClass(String className, ClassLoader cl, -++ boolean doFallback) -++ throws ClassNotFoundException, ConfigurationError -++ { -++ //throw security exception if the calling thread is not allowed to access the package -++ //restrict the access to package as speicified in java.security policy -++ SecurityManager security = System.getSecurityManager(); -++ if (security != null) { -++ if (className.startsWith(DEFAULT_INTERNAL_CLASSES)) { -++ cl = null; -++ } else { -++ final int lastDot = className.lastIndexOf("."); -++ String packageName = className; -++ if (lastDot != -1) packageName = className.substring(0, lastDot); -++ security.checkPackageAccess(packageName); -++ } -++ } -++ Class providerClass; -++ if (cl == null) { -++ //use the bootstrap ClassLoader. -++ providerClass = Class.forName(className); -++ } else { -++ try { -++ providerClass = cl.loadClass(className); -++ } catch (ClassNotFoundException x) { -++ if (doFallback) { -++ // Fall back to current classloader -++ ClassLoader current = ObjectFactory.class.getClassLoader(); -++ if (current == null) { -++ providerClass = Class.forName(className); -++ } else if (cl != current) { -++ cl = current; -++ providerClass = cl.loadClass(className); -++ } else { -++ throw x; -++ } -++ } else { -++ throw x; -++ } -++ } -++ } -++ -++ return providerClass; -++ } -++ -++ /* -++ * Try to find provider using Jar Service Provider Mechanism -++ * -++ * @return instance of provider class if found or null -++ */ -++ private static Object findJarServiceProvider(String factoryId) -++ throws ConfigurationError -++ { -++ String serviceId = "META-INF/services/" + factoryId; -++ InputStream is = null; -++ -++ // First try the Context ClassLoader -++ ClassLoader cl = findClassLoader(); -++ -++ is = SecuritySupport.getResourceAsStream(cl, serviceId); -++ -++ // If no provider found then try the current ClassLoader -++ if (is == null) { -++ ClassLoader current = ObjectFactory.class.getClassLoader(); -++ if (cl != current) { -++ cl = current; -++ is = SecuritySupport.getResourceAsStream(cl, serviceId); -++ } -++ } -++ -++ if (is == null) { -++ // No provider found -++ return null; -++ } -++ -++ if (DEBUG) debugPrintln("found jar resource=" + serviceId + -++ " using ClassLoader: " + cl); -++ -++ // Read the service provider name in UTF-8 as specified in -++ // the jar spec. Unfortunately this fails in Microsoft -++ // VJ++, which does not implement the UTF-8 -++ // encoding. Theoretically, we should simply let it fail in -++ // that case, since the JVM is obviously broken if it -++ // doesn't support such a basic standard. But since there -++ // are still some users attempting to use VJ++ for -++ // development, we have dropped in a fallback which makes a -++ // second attempt using the platform's default encoding. In -++ // VJ++ this is apparently ASCII, which is a subset of -++ // UTF-8... and since the strings we'll be reading here are -++ // also primarily limited to the 7-bit ASCII range (at -++ // least, in English versions), this should work well -++ // enough to keep us on the air until we're ready to -++ // officially decommit from VJ++. [Edited comment from -++ // jkesselm] -++ BufferedReader rd; -++ try { -++ rd = new BufferedReader(new InputStreamReader(is, "UTF-8"), DEFAULT_LINE_LENGTH); -++ } catch (java.io.UnsupportedEncodingException e) { -++ rd = new BufferedReader(new InputStreamReader(is), DEFAULT_LINE_LENGTH); -++ } -++ -++ String factoryClassName = null; -++ try { -++ // XXX Does not handle all possible input as specified by the -++ // Jar Service Provider specification -++ factoryClassName = rd.readLine(); -++ } catch (IOException x) { -++ // No provider found -++ return null; -++ } -++ finally { -++ try { -++ // try to close the reader. -++ rd.close(); -++ } -++ // Ignore the exception. -++ catch (IOException exc) {} -++ } -++ -++ if (factoryClassName != null && -++ ! "".equals(factoryClassName)) { -++ if (DEBUG) debugPrintln("found in resource, value=" -++ + factoryClassName); -++ -++ // Note: here we do not want to fall back to the current -++ // ClassLoader because we want to avoid the case where the -++ // resource file was found using one ClassLoader and the -++ // provider class was instantiated using a different one. -++ return newInstance(factoryClassName, cl, false); -++ } -++ -++ // No provider found -++ return null; -++ } -++ -++} // class ObjectFactory -+--- src/com/sun/org/apache/xerces/internal/utils/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/com/sun/org/apache/xerces/internal/utils/SecuritySupport.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -0,0 +1,199 @@ -++/* -++ * reserved comment block -++ * DO NOT REMOVE OR ALTER! -++ */ -++/* -++ * Copyright 2002,2004 The Apache Software Foundation. -++ * -++ * Licensed under the Apache License, Version 2.0 (the "License"); -++ * you may not use this file except in compliance with the License. -++ * You may obtain a copy of the License at -++ * -++ * http://www.apache.org/licenses/LICENSE-2.0 -++ * -++ * Unless required by applicable law or agreed to in writing, software -++ * distributed under the License is distributed on an "AS IS" BASIS, -++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -++ * See the License for the specific language governing permissions and -++ * limitations under the License. -++ */ -++ -++package com.sun.org.apache.xerces.internal.utils; -++ -++import java.io.File; -++import java.io.FileInputStream; -++import java.io.FileNotFoundException; -++import java.io.InputStream; -++ -++import java.security.AccessController; -++import java.security.PrivilegedAction; -++import java.security.PrivilegedActionException; -++import java.security.PrivilegedExceptionAction; -++import java.util.Locale; -++import java.util.MissingResourceException; -++import java.util.PropertyResourceBundle; -++import java.util.ResourceBundle; -++ -++/** -++ * This class is duplicated for each subpackage so keep it in sync. -++ * It is package private and therefore is not exposed as part of any API. -++ * -++ * @xerces.internal -++ */ -++public final class SecuritySupport { -++ -++ private static final SecuritySupport securitySupport = new SecuritySupport(); -++ -++ /** -++ * Return an instance of this class. -++ */ -++ public static SecuritySupport getInstance() { -++ return securitySupport; -++ } -++ -++ static ClassLoader getContextClassLoader() { -++ return (ClassLoader) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader cl = null; -++ try { -++ cl = Thread.currentThread().getContextClassLoader(); -++ } catch (SecurityException ex) { } -++ return cl; -++ } -++ }); -++ } -++ -++ static ClassLoader getSystemClassLoader() { -++ return (ClassLoader) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader cl = null; -++ try { -++ cl = ClassLoader.getSystemClassLoader(); -++ } catch (SecurityException ex) {} -++ return cl; -++ } -++ }); -++ } -++ -++ static ClassLoader getParentClassLoader(final ClassLoader cl) { -++ return (ClassLoader) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader parent = null; -++ try { -++ parent = cl.getParent(); -++ } catch (SecurityException ex) {} -++ -++ // eliminate loops in case of the boot -++ // ClassLoader returning itself as a parent -++ return (parent == cl) ? null : parent; -++ } -++ }); -++ } -++ -++ public static String getSystemProperty(final String propName) { -++ return (String) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return System.getProperty(propName); -++ } -++ }); -++ } -++ -++ static FileInputStream getFileInputStream(final File file) -++ throws FileNotFoundException -++ { -++ try { -++ return (FileInputStream) -++ AccessController.doPrivileged(new PrivilegedExceptionAction() { -++ public Object run() throws FileNotFoundException { -++ return new FileInputStream(file); -++ } -++ }); -++ } catch (PrivilegedActionException e) { -++ throw (FileNotFoundException)e.getException(); -++ } -++ } -++ /** -++ * Return resource using the same classloader for the ObjectFactory by default -++ * or bootclassloader when Security Manager is in place -++ */ -++ public static InputStream getResourceAsStream(final String name) { -++ if (System.getSecurityManager()!=null) { -++ return getResourceAsStream(null, name); -++ } else { -++ return getResourceAsStream(ObjectFactory.findClassLoader(), name); -++ } -++ } -++ -++ public static InputStream getResourceAsStream(final ClassLoader cl, -++ final String name) -++ { -++ return (InputStream) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ InputStream ris; -++ if (cl == null) { -++ ris = Object.class.getResourceAsStream("/"+name); -++ } else { -++ ris = cl.getResourceAsStream(name); -++ } -++ return ris; -++ } -++ }); -++ } -++ -++ /** -++ * Gets a resource bundle using the specified base name, the default locale, and the caller's class loader. -++ * @param bundle the base name of the resource bundle, a fully qualified class name -++ * @return a resource bundle for the given base name and the default locale -++ */ -++ public static ResourceBundle getResourceBundle(String bundle) { -++ return getResourceBundle(bundle, Locale.getDefault()); -++ } -++ -++ /** -++ * Gets a resource bundle using the specified base name and locale, and the caller's class loader. -++ * @param bundle the base name of the resource bundle, a fully qualified class name -++ * @param locale the locale for which a resource bundle is desired -++ * @return a resource bundle for the given base name and locale -++ */ -++ public static ResourceBundle getResourceBundle(final String bundle, final Locale locale) { -++ return AccessController.doPrivileged(new PrivilegedAction<ResourceBundle>() { -++ public ResourceBundle run() { -++ try { -++ return PropertyResourceBundle.getBundle(bundle, locale); -++ } catch (MissingResourceException e) { -++ try { -++ return PropertyResourceBundle.getBundle(bundle, new Locale("en", "US")); -++ } catch (MissingResourceException e2) { -++ throw new MissingResourceException( -++ "Could not load any resource bundle by " + bundle, bundle, ""); -++ } -++ } -++ } -++ }); -++ } -++ -++ static boolean getFileExists(final File f) { -++ return ((Boolean) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return f.exists() ? Boolean.TRUE : Boolean.FALSE; -++ } -++ })).booleanValue(); -++ } -++ -++ static long getLastModified(final File f) { -++ return ((Long) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return new Long(f.lastModified()); -++ } -++ })).longValue(); -++ } -++ -++ private SecuritySupport () {} -++} -+--- src/com/sun/org/apache/xerces/internal/xinclude/XIncludeMessageFormatter.java 2013-04-16 14:28:09.628154939 +0100 -++++ src/com/sun/org/apache/xerces/internal/xinclude/XIncludeMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -20,11 +20,11 @@ -+ -+ package com.sun.org.apache.xerces.internal.xinclude; -+ -++import com.sun.org.apache.xerces.internal.util.MessageFormatter; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+ import java.util.ResourceBundle; -+-import java.util.PropertyResourceBundle; -+-import com.sun.org.apache.xerces.internal.util.MessageFormatter; -+ -+ // TODO: fix error messages in XIncludeMessages.properties -+ /** -+@@ -32,6 +32,7 @@ -+ * -+ * @author Peter McCracken, IBM -+ * -++ * @version $Id: XIncludeMessageFormatter.java,v 1.7 2010-11-01 04:40:18 joehw Exp $ -+ */ -+ public class XIncludeMessageFormatter implements MessageFormatter { -+ -+@@ -61,12 +62,12 @@ -+ -+ if (fResourceBundle == null || locale != fLocale) { -+ if (locale != null) { -+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages", locale); -++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages", locale); -+ // memorize the most-recent locale -+ fLocale = locale; -+ } -+ if (fResourceBundle == null) -+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages"); -++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages"); -+ } -+ -+ String msg = fResourceBundle.getString(key); -+--- src/com/sun/org/apache/xerces/internal/xpointer/XPointerMessageFormatter.java 2013-04-16 14:28:09.636155069 +0100 -++++ src/com/sun/org/apache/xerces/internal/xpointer/XPointerMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -24,6 +24,7 @@ -+ import java.util.ResourceBundle; -+ import java.util.PropertyResourceBundle; -+ import com.sun.org.apache.xerces.internal.util.MessageFormatter; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ -+ /** -+ * XPointerMessageFormatter provides error messages for the XPointer Framework -+@@ -31,6 +32,7 @@ -+ * -+ * @xerces.internal -+ * -++ * @version $Id: XPointerMessageFormatter.java,v 1.5 2010-11-01 04:40:26 joehw Exp $ -+ */ -+ class XPointerMessageFormatter implements MessageFormatter { -+ -+@@ -64,14 +66,14 @@ -+ -+ if (fResourceBundle == null || locale != fLocale) { -+ if (locale != null) { -+- fResourceBundle = PropertyResourceBundle.getBundle( -++ fResourceBundle = SecuritySupport.getResourceBundle( -+ "com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages", locale); -+ // memorize the most-recent locale -+ fLocale = locale; -+ } -+ if (fResourceBundle == null) -+- fResourceBundle = PropertyResourceBundle -+- .getBundle("com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages"); -++ fResourceBundle = SecuritySupport.getResourceBundle( -++ "com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages"); -+ } -+ -+ String msg = fResourceBundle.getString(key); -+--- src/com/sun/org/apache/xml/internal/dtm/DTMManager.java 2013-04-16 14:28:09.644155197 +0100 -++++ src/com/sun/org/apache/xml/internal/dtm/DTMManager.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -26,6 +26,7 @@ -+ import com.sun.org.apache.xml.internal.res.XMLMessages; -+ import com.sun.org.apache.xml.internal.utils.PrefixResolver; -+ import com.sun.org.apache.xml.internal.utils.XMLStringFactory; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ /** -+ * A DTMManager instance can be used to create DTM and -+@@ -358,7 +359,7 @@ -+ { -+ try -+ { -+- debug = System.getProperty("dtm.debug") != null; -++ debug = SecuritySupport.getSystemProperty("dtm.debug") != null; -+ } -+ catch (SecurityException ex){} -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ca.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ca.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("ca", "ES")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_cs.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_cs.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("cs", "CZ")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_de.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_de.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_es.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_es.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("es", "ES")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_fr.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_fr.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_it.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_it.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("it", "IT")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ja.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ja.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources.java 2013-04-16 14:28:09.660155456 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources.java 2013-04-16 14:29:26.557394511 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -461,67 +458,4 @@ -+ return msgCopy; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ko.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ko.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("ko", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sk.java 2013-04-16 14:28:09.664155519 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sk.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_tr.java 2013-04-16 14:28:09.668155584 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_tr.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("tr", "TR")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_CN.java 2013-04-16 14:28:09.668155584 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_CN.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("zh", "CN")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "\u65e0\u6cd5\u88c5\u5165\u4efb\u4f55\u8d44\u6e90\u5305\u3002", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_TW.java 2013-04-16 14:28:09.668155584 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_TW.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -24,9 +24,6 @@ -+ -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -442,67 +439,4 @@ -+ }; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XMLErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XMLErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XMLErrorResources) ResourceBundle.getBundle(className, -+- new Locale("zh", "TW")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xml/internal/res/XMLMessages.java 2013-04-16 14:28:09.668155584 +0100 -++++ src/com/sun/org/apache/xml/internal/res/XMLMessages.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -22,10 +22,9 @@ -+ */ -+ package com.sun.org.apache.xml.internal.res; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.util.ListResourceBundle; -+ import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * A utility class for issuing XML error messages. -+@@ -82,8 +81,9 @@ -+ */ -+ public static final String createXMLMessage(String msgKey, Object args[]) -+ { -+- if (XMLBundle == null) -+- XMLBundle = loadResourceBundle(XML_ERROR_RESOURCES); -++ if (XMLBundle == null) { -++ XMLBundle = SecuritySupport.getResourceBundle(XML_ERROR_RESOURCES); -++ } -+ -+ if (XMLBundle != null) -+ { -+@@ -156,61 +156,4 @@ -+ return fmsg; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className The class name of the resource bundle. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static ListResourceBundle loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- Locale locale = Locale.getDefault(); -+- -+- try -+- { -+- return (ListResourceBundle)ResourceBundle.getBundle(className, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (ListResourceBundle)ResourceBundle.getBundle( -+- className, new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles." + className, className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which can be appended to a resource name -+- */ -+- protected static String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+ } -+--- src/com/sun/org/apache/xml/internal/resolver/Catalog.java 2013-04-16 14:28:09.668155584 +0100 -++++ src/com/sun/org/apache/xml/internal/resolver/Catalog.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -23,6 +23,8 @@ -+ -+ package com.sun.org.apache.xml.internal.resolver; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -++ -+ import java.io.IOException; -+ import java.io.FileNotFoundException; -+ import java.io.InputStream; -+@@ -819,7 +821,7 @@ -+ // tack on a basename because URLs point to files not dirs -+ catalogCwd = FileURL.makeURL("basename"); -+ } catch (MalformedURLException e) { -+- String userdir = System.getProperty("user.dir"); -++ String userdir = SecuritySupport.getSystemProperty("user.dir"); -+ userdir.replace('\\', '/'); -+ catalogManager.debug.message(1, "Malformed URL on cwd", userdir); -+ catalogCwd = null; -+@@ -1715,7 +1717,7 @@ -+ protected String resolveLocalSystem(String systemId) -+ throws MalformedURLException, IOException { -+ -+- String osname = System.getProperty("os.name"); -++ String osname = SecuritySupport.getSystemProperty("os.name"); -+ boolean windows = (osname.indexOf("Windows") >= 0); -+ Enumeration en = catalogEntries.elements(); -+ while (en.hasMoreElements()) { -+--- src/com/sun/org/apache/xml/internal/resolver/CatalogManager.java 2013-04-16 14:28:09.668155584 +0100 -++++ src/com/sun/org/apache/xml/internal/resolver/CatalogManager.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -23,6 +23,7 @@ -+ -+ package com.sun.org.apache.xml.internal.resolver; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import java.io.InputStream; -+ -+ import java.net.URL; -+@@ -141,8 +142,8 @@ -+ -+ /** Flag to ignore missing property files and/or properties */ -+ private boolean ignoreMissingProperties -+- = (System.getProperty(pIgnoreMissing) != null -+- || System.getProperty(pFiles) != null); -++ = (SecuritySupport.getSystemProperty(pIgnoreMissing) != null -++ || SecuritySupport.getSystemProperty(pFiles) != null); -+ -+ /** Holds the resources after they are loaded from the file. */ -+ private ResourceBundle resources; -+@@ -331,7 +332,7 @@ -+ private int queryVerbosity () { -+ String defaultVerbStr = Integer.toString(defaultVerbosity); -+ -+- String verbStr = System.getProperty(pVerbosity); -++ String verbStr = SecuritySupport.getSystemProperty(pVerbosity); -+ -+ if (verbStr == null) { -+ if (resources==null) readProperties(); -+@@ -466,7 +467,7 @@ -+ * @return A semicolon delimited list of catlog file URIs -+ */ -+ private String queryCatalogFiles () { -+- String catalogList = System.getProperty(pFiles); -++ String catalogList = SecuritySupport.getSystemProperty(pFiles); -+ fromPropertiesFile = false; -+ -+ if (catalogList == null) { -+@@ -551,7 +552,7 @@ -+ * defaultPreferSetting. -+ */ -+ private boolean queryPreferPublic () { -+- String prefer = System.getProperty(pPrefer); -++ String prefer = SecuritySupport.getSystemProperty(pPrefer); -+ -+ if (prefer == null) { -+ if (resources==null) readProperties(); -+@@ -610,7 +611,7 @@ -+ * defaultUseStaticCatalog. -+ */ -+ private boolean queryUseStaticCatalog () { -+- String staticCatalog = System.getProperty(pStatic); -++ String staticCatalog = SecuritySupport.getSystemProperty(pStatic); -+ -+ if (staticCatalog == null) { -+ if (resources==null) readProperties(); -+@@ -741,7 +742,7 @@ -+ * defaultOasisXMLCatalogPI. -+ */ -+ public boolean queryAllowOasisXMLCatalogPI () { -+- String allow = System.getProperty(pAllowPI); -++ String allow = SecuritySupport.getSystemProperty(pAllowPI); -+ -+ if (allow == null) { -+ if (resources==null) readProperties(); -+@@ -794,7 +795,7 @@ -+ * -+ */ -+ public String queryCatalogClassName () { -+- String className = System.getProperty(pClassname); -++ String className = SecuritySupport.getSystemProperty(pClassname); -+ -+ if (className == null) { -+ if (resources==null) readProperties(); -+--- src/com/sun/org/apache/xml/internal/resolver/Resolver.java 2013-04-16 14:28:09.668155584 +0100 -++++ src/com/sun/org/apache/xml/internal/resolver/Resolver.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -31,6 +31,7 @@ -+ import java.net.URL; -+ import java.net.URLConnection; -+ import java.net.MalformedURLException; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import com.sun.org.apache.xml.internal.resolver.readers.SAXCatalogReader; -+ import com.sun.org.apache.xml.internal.resolver.readers.OASISXMLCatalogReader; -+ import com.sun.org.apache.xml.internal.resolver.readers.TR9401CatalogReader; -+@@ -521,7 +522,7 @@ -+ */ -+ private Vector resolveAllLocalSystem(String systemId) { -+ Vector map = new Vector(); -+- String osname = System.getProperty("os.name"); -++ String osname = SecuritySupport.getSystemProperty("os.name"); -+ boolean windows = (osname.indexOf("Windows") >= 0); -+ Enumeration en = catalogEntries.elements(); -+ while (en.hasMoreElements()) { -+@@ -549,7 +550,7 @@ -+ */ -+ private Vector resolveLocalSystemReverse(String systemId) { -+ Vector map = new Vector(); -+- String osname = System.getProperty("os.name"); -++ String osname = SecuritySupport.getSystemProperty("os.name"); -+ boolean windows = (osname.indexOf("Windows") >= 0); -+ Enumeration en = catalogEntries.elements(); -+ while (en.hasMoreElements()) { -+--- src/com/sun/org/apache/xml/internal/serialize/SerializerFactory.java 2013-04-16 14:28:09.684155841 +0100 -++++ src/com/sun/org/apache/xml/internal/serialize/SerializerFactory.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -21,6 +21,7 @@ -+ -+ package com.sun.org.apache.xml.internal.serialize; -+ -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ -+ import java.io.OutputStream; -+ import java.io.Writer; -+@@ -63,7 +64,7 @@ -+ factory = new SerializerFactoryImpl( Method.TEXT ); -+ registerSerializerFactory( factory ); -+ -+- list = System.getProperty( FactoriesProperty ); -++ list = SecuritySupport.getSystemProperty( FactoriesProperty ); -+ if ( list != null ) { -+ token = new StringTokenizer( list, " ;,:" ); -+ while ( token.hasMoreTokens() ) { -+--- src/com/sun/org/apache/xml/internal/serializer/Encodings.java 2013-04-16 14:28:09.684155841 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/Encodings.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -34,6 +34,7 @@ -+ import java.util.Properties; -+ import java.util.StringTokenizer; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ /** -+ * Provides information about encodings. Depends on the Java runtime -+@@ -218,7 +219,7 @@ -+ // Get the default system character encoding. This may be -+ // incorrect if they passed in a writer, but right now there -+ // seems to be no way to get the encoding from a writer. -+- encoding = System.getProperty("file.encoding", "UTF8"); -++ encoding = SecuritySupport.getSystemProperty("file.encoding", "UTF8"); -+ -+ if (null != encoding) -+ { -+@@ -312,7 +313,7 @@ -+ -+ try -+ { -+- urlString = System.getProperty(ENCODINGS_PROP, ""); -++ urlString = SecuritySupport.getSystemProperty(ENCODINGS_PROP, ""); -+ } -+ catch (SecurityException e) -+ { -+@@ -324,9 +325,7 @@ -+ } -+ -+ if (is == null) { -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- is = ss.getResourceAsStream(ObjectFactory.findClassLoader(), -+- ENCODINGS_FILE); -++ is = SecuritySupport.getResourceAsStream(ENCODINGS_FILE); -+ } -+ -+ Properties props = new Properties(); -+--- src/com/sun/org/apache/xml/internal/serializer/ObjectFactory.java 2013-04-16 14:28:09.688155906 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/ObjectFactory.java 1970-01-01 01:00:00.000000000 +0100 -+@@ -1,662 +0,0 @@ -+-/* -+- * reserved comment block -+- * DO NOT REMOVE OR ALTER! -+- */ -+-/* -+- * Copyright 2001-2004 The Apache Software Foundation. -+- * -+- * Licensed under the Apache License, Version 2.0 (the "License"); -+- * you may not use this file except in compliance with the License. -+- * You may obtain a copy of the License at -+- * -+- * http://www.apache.org/licenses/LICENSE-2.0 -+- * -+- * Unless required by applicable law or agreed to in writing, software -+- * distributed under the License is distributed on an "AS IS" BASIS, -+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+- * See the License for the specific language governing permissions and -+- * limitations under the License. -+- */ -+-/* -+- * $Id: ObjectFactory.java,v 1.2.4.1 2005/09/15 08:15:20 suresh_emailid Exp $ -+- */ -+- -+-package com.sun.org.apache.xml.internal.serializer; -+- -+-import java.io.BufferedReader; -+-import java.io.File; -+-import java.io.FileInputStream; -+-import java.io.IOException; -+-import java.io.InputStream; -+-import java.io.InputStreamReader; -+-import java.util.Properties; -+- -+-/** -+- * This class is duplicated for each JAXP subpackage so keep it in sync. -+- * It is package private and therefore is not exposed as part of the JAXP -+- * API. -+- * <p> -+- * This code is designed to implement the JAXP 1.1 spec pluggability -+- * feature and is designed to run on JDK version 1.1 and -+- * later, and to compile on JDK 1.2 and onward. -+- * The code also runs both as part of an unbundled jar file and -+- * when bundled as part of the JDK. -+- * <p> -+- * This class was moved from the <code>javax.xml.parsers.ObjectFactory</code> -+- * class and modified to be used as a general utility for creating objects -+- * dynamically. -+- * -+- * @xsl.usage internal -+- */ -+-class ObjectFactory { -+- -+- // -+- // Constants -+- // -+- -+- // name of default properties file to look for in JDK's jre/lib directory -+- private static final String DEFAULT_PROPERTIES_FILENAME = -+- "xalan.properties"; -+- -+- private static final String SERVICES_PATH = "META-INF/services/"; -+- -+- /** Set to true for debugging */ -+- private static final boolean DEBUG = false; -+- -+- /** cache the contents of the xalan.properties file. -+- * Until an attempt has been made to read this file, this will -+- * be null; if the file does not exist or we encounter some other error -+- * during the read, this will be empty. -+- */ -+- private static Properties fXalanProperties = null; -+- -+- /*** -+- * Cache the time stamp of the xalan.properties file so -+- * that we know if it's been modified and can invalidate -+- * the cache when necessary. -+- */ -+- private static long fLastModified = -1; -+- -+- // -+- // Public static methods -+- // -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return instance of factory, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Object createObject(String factoryId, String fallbackClassName) -+- throws ConfigurationError { -+- return createObject(factoryId, null, fallbackClassName); -+- } // createObject(String,String):Object -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return instance of factory, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Object createObject(String factoryId, -+- String propertiesFilename, -+- String fallbackClassName) -+- throws ConfigurationError -+- { -+- Class factoryClass = lookUpFactoryClass(factoryId, -+- propertiesFilename, -+- fallbackClassName); -+- -+- if (factoryClass == null) { -+- throw new ConfigurationError( -+- "Provider for " + factoryId + " cannot be found", null); -+- } -+- -+- try{ -+- Object instance = factoryClass.newInstance(); -+- if (DEBUG) debugPrintln("created new instance of factory " + factoryId); -+- return instance; -+- } catch (Exception x) { -+- throw new ConfigurationError( -+- "Provider for factory " + factoryId -+- + " could not be instantiated: " + x, x); -+- } -+- } // createObject(String,String,String):Object -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return Class object of factory, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Class lookUpFactoryClass(String factoryId) -+- throws ConfigurationError -+- { -+- return lookUpFactoryClass(factoryId, null, null); -+- } // lookUpFactoryClass(String):Class -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return Class object that provides factory service, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Class lookUpFactoryClass(String factoryId, -+- String propertiesFilename, -+- String fallbackClassName) -+- throws ConfigurationError -+- { -+- String factoryClassName = lookUpFactoryClassName(factoryId, -+- propertiesFilename, -+- fallbackClassName); -+- ClassLoader cl = findClassLoader(); -+- -+- if (factoryClassName == null) { -+- factoryClassName = fallbackClassName; -+- } -+- -+- // assert(className != null); -+- try{ -+- Class providerClass = findProviderClass(factoryClassName, -+- cl, -+- true); -+- if (DEBUG) debugPrintln("created new instance of " + providerClass + -+- " using ClassLoader: " + cl); -+- return providerClass; -+- } catch (ClassNotFoundException x) { -+- throw new ConfigurationError( -+- "Provider " + factoryClassName + " not found", x); -+- } catch (Exception x) { -+- throw new ConfigurationError( -+- "Provider "+factoryClassName+" could not be instantiated: "+x, -+- x); -+- } -+- } // lookUpFactoryClass(String,String,String):Class -+- -+- /** -+- * Finds the name of the required implementation class in the specified -+- * order. The specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return name of class that provides factory service, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static String lookUpFactoryClassName(String factoryId, -+- String propertiesFilename, -+- String fallbackClassName) -+- { -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- -+- // Use the system property first -+- try { -+- String systemProp = ss.getSystemProperty(factoryId); -+- if (systemProp != null) { -+- if (DEBUG) debugPrintln("found system property, value=" + systemProp); -+- return systemProp; -+- } -+- } catch (SecurityException se) { -+- // Ignore and continue w/ next location -+- } -+- -+- // Try to read from propertiesFilename, or -+- // $java.home/lib/xalan.properties -+- String factoryClassName = null; -+- // no properties file name specified; use -+- // $JAVA_HOME/lib/xalan.properties: -+- if (propertiesFilename == null) { -+- File propertiesFile = null; -+- boolean propertiesFileExists = false; -+- try { -+- String javah = ss.getSystemProperty("java.home"); -+- propertiesFilename = javah + File.separator + -+- "lib" + File.separator + DEFAULT_PROPERTIES_FILENAME; -+- propertiesFile = new File(propertiesFilename); -+- propertiesFileExists = ss.getFileExists(propertiesFile); -+- } catch (SecurityException e) { -+- // try again... -+- fLastModified = -1; -+- fXalanProperties = null; -+- } -+- -+- synchronized (ObjectFactory.class) { -+- boolean loadProperties = false; -+- FileInputStream fis = null; -+- try { -+- // file existed last time -+- if(fLastModified >= 0) { -+- if(propertiesFileExists && -+- (fLastModified < (fLastModified = ss.getLastModified(propertiesFile)))) { -+- loadProperties = true; -+- } else { -+- // file has stopped existing... -+- if(!propertiesFileExists) { -+- fLastModified = -1; -+- fXalanProperties = null; -+- } // else, file wasn't modified! -+- } -+- } else { -+- // file has started to exist: -+- if(propertiesFileExists) { -+- loadProperties = true; -+- fLastModified = ss.getLastModified(propertiesFile); -+- } // else, nothing's changed -+- } -+- if(loadProperties) { -+- // must never have attempted to read xalan.properties -+- // before (or it's outdeated) -+- fXalanProperties = new Properties(); -+- fis = ss.getFileInputStream(propertiesFile); -+- fXalanProperties.load(fis); -+- } -+- } catch (Exception x) { -+- fXalanProperties = null; -+- fLastModified = -1; -+- // assert(x instanceof FileNotFoundException -+- // || x instanceof SecurityException) -+- // In both cases, ignore and continue w/ next location -+- } -+- finally { -+- // try to close the input stream if one was opened. -+- if (fis != null) { -+- try { -+- fis.close(); -+- } -+- // Ignore the exception. -+- catch (IOException exc) {} -+- } -+- } -+- } -+- if(fXalanProperties != null) { -+- factoryClassName = fXalanProperties.getProperty(factoryId); -+- } -+- } else { -+- FileInputStream fis = null; -+- try { -+- fis = ss.getFileInputStream(new File(propertiesFilename)); -+- Properties props = new Properties(); -+- props.load(fis); -+- factoryClassName = props.getProperty(factoryId); -+- } catch (Exception x) { -+- // assert(x instanceof FileNotFoundException -+- // || x instanceof SecurityException) -+- // In both cases, ignore and continue w/ next location -+- } -+- finally { -+- // try to close the input stream if one was opened. -+- if (fis != null) { -+- try { -+- fis.close(); -+- } -+- // Ignore the exception. -+- catch (IOException exc) {} -+- } -+- } -+- } -+- if (factoryClassName != null) { -+- if (DEBUG) debugPrintln("found in " + propertiesFilename + ", value=" -+- + factoryClassName); -+- return factoryClassName; -+- } -+- -+- // Try Jar Service Provider Mechanism -+- return findJarServiceProviderName(factoryId); -+- } // lookUpFactoryClass(String,String):String -+- -+- // -+- // Private static methods -+- // -+- -+- /** Prints a message to standard error if debugging is enabled. */ -+- private static void debugPrintln(String msg) { -+- if (DEBUG) { -+- System.err.println("JAXP: " + msg); -+- } -+- } // debugPrintln(String) -+- -+- /** -+- * Figure out which ClassLoader to use. For JDK 1.2 and later use -+- * the context ClassLoader. -+- */ -+- static ClassLoader findClassLoader() -+- throws ConfigurationError -+- { -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- -+- // Figure out which ClassLoader to use for loading the provider -+- // class. If there is a Context ClassLoader then use it. -+- ClassLoader context = ss.getContextClassLoader(); -+- ClassLoader system = ss.getSystemClassLoader(); -+- -+- ClassLoader chain = system; -+- while (true) { -+- if (context == chain) { -+- // Assert: we are on JDK 1.1 or we have no Context ClassLoader -+- // or any Context ClassLoader in chain of system classloader -+- // (including extension ClassLoader) so extend to widest -+- // ClassLoader (always look in system ClassLoader if Xalan -+- // is in boot/extension/system classpath and in current -+- // ClassLoader otherwise); normal classloaders delegate -+- // back to system ClassLoader first so this widening doesn't -+- // change the fact that context ClassLoader will be consulted -+- ClassLoader current = ObjectFactory.class.getClassLoader(); -+- -+- chain = system; -+- while (true) { -+- if (current == chain) { -+- // Assert: Current ClassLoader in chain of -+- // boot/extension/system ClassLoaders -+- return system; -+- } -+- if (chain == null) { -+- break; -+- } -+- chain = ss.getParentClassLoader(chain); -+- } -+- -+- // Assert: Current ClassLoader not in chain of -+- // boot/extension/system ClassLoaders -+- return current; -+- } -+- -+- if (chain == null) { -+- // boot ClassLoader reached -+- break; -+- } -+- -+- // Check for any extension ClassLoaders in chain up to -+- // boot ClassLoader -+- chain = ss.getParentClassLoader(chain); -+- }; -+- -+- // Assert: Context ClassLoader not in chain of -+- // boot/extension/system ClassLoaders -+- return context; -+- } // findClassLoader():ClassLoader -+- -+- /** -+- * Create an instance of a class using the specified ClassLoader -+- */ -+- static Object newInstance(String className, ClassLoader cl, -+- boolean doFallback) -+- throws ConfigurationError -+- { -+- // assert(className != null); -+- try{ -+- Class providerClass = findProviderClass(className, cl, doFallback); -+- Object instance = providerClass.newInstance(); -+- if (DEBUG) debugPrintln("created new instance of " + providerClass + -+- " using ClassLoader: " + cl); -+- return instance; -+- } catch (ClassNotFoundException x) { -+- throw new ConfigurationError( -+- "Provider " + className + " not found", x); -+- } catch (Exception x) { -+- throw new ConfigurationError( -+- "Provider " + className + " could not be instantiated: " + x, -+- x); -+- } -+- } -+- -+- /** -+- * Find a Class using the specified ClassLoader -+- */ -+- static Class findProviderClass(String className, ClassLoader cl, -+- boolean doFallback) -+- throws ClassNotFoundException, ConfigurationError -+- { -+- //throw security exception if the calling thread is not allowed to access the -+- //class. Restrict the access to the package classes as specified in java.security policy. -+- SecurityManager security = System.getSecurityManager(); -+- try{ -+- if (security != null){ -+- final int lastDot = className.lastIndexOf("."); -+- String packageName = className; -+- if (lastDot != -1) packageName = className.substring(0, lastDot); -+- security.checkPackageAccess(packageName); -+- } -+- }catch(SecurityException e){ -+- throw e; -+- } -+- -+- Class providerClass; -+- if (cl == null) { -+- // XXX Use the bootstrap ClassLoader. There is no way to -+- // load a class using the bootstrap ClassLoader that works -+- // in both JDK 1.1 and Java 2. However, this should still -+- // work b/c the following should be true: -+- // -+- // (cl == null) iff current ClassLoader == null -+- // -+- // Thus Class.forName(String) will use the current -+- // ClassLoader which will be the bootstrap ClassLoader. -+- providerClass = Class.forName(className); -+- } else { -+- try { -+- providerClass = cl.loadClass(className); -+- } catch (ClassNotFoundException x) { -+- if (doFallback) { -+- // Fall back to current classloader -+- ClassLoader current = ObjectFactory.class.getClassLoader(); -+- if (current == null) { -+- providerClass = Class.forName(className); -+- } else if (cl != current) { -+- cl = current; -+- providerClass = cl.loadClass(className); -+- } else { -+- throw x; -+- } -+- } else { -+- throw x; -+- } -+- } -+- } -+- -+- return providerClass; -+- } -+- -+- /** -+- * Find the name of service provider using Jar Service Provider Mechanism -+- * -+- * @return instance of provider class if found or null -+- */ -+- private static String findJarServiceProviderName(String factoryId) -+- { -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- String serviceId = SERVICES_PATH + factoryId; -+- InputStream is = null; -+- -+- // First try the Context ClassLoader -+- ClassLoader cl = findClassLoader(); -+- -+- is = ss.getResourceAsStream(cl, serviceId); -+- -+- // If no provider found then try the current ClassLoader -+- if (is == null) { -+- ClassLoader current = ObjectFactory.class.getClassLoader(); -+- if (cl != current) { -+- cl = current; -+- is = ss.getResourceAsStream(cl, serviceId); -+- } -+- } -+- -+- if (is == null) { -+- // No provider found -+- return null; -+- } -+- -+- if (DEBUG) debugPrintln("found jar resource=" + serviceId + -+- " using ClassLoader: " + cl); -+- -+- // Read the service provider name in UTF-8 as specified in -+- // the jar spec. Unfortunately this fails in Microsoft -+- // VJ++, which does not implement the UTF-8 -+- // encoding. Theoretically, we should simply let it fail in -+- // that case, since the JVM is obviously broken if it -+- // doesn't support such a basic standard. But since there -+- // are still some users attempting to use VJ++ for -+- // development, we have dropped in a fallback which makes a -+- // second attempt using the platform's default encoding. In -+- // VJ++ this is apparently ASCII, which is a subset of -+- // UTF-8... and since the strings we'll be reading here are -+- // also primarily limited to the 7-bit ASCII range (at -+- // least, in English versions), this should work well -+- // enough to keep us on the air until we're ready to -+- // officially decommit from VJ++. [Edited comment from -+- // jkesselm] -+- BufferedReader rd; -+- try { -+- rd = new BufferedReader(new InputStreamReader(is, "UTF-8")); -+- } catch (java.io.UnsupportedEncodingException e) { -+- rd = new BufferedReader(new InputStreamReader(is)); -+- } -+- -+- String factoryClassName = null; -+- try { -+- // XXX Does not handle all possible input as specified by the -+- // Jar Service Provider specification -+- factoryClassName = rd.readLine(); -+- } catch (IOException x) { -+- // No provider found -+- return null; -+- } -+- finally { -+- try { -+- // try to close the reader. -+- rd.close(); -+- } -+- // Ignore the exception. -+- catch (IOException exc) {} -+- } -+- -+- if (factoryClassName != null && -+- ! "".equals(factoryClassName)) { -+- if (DEBUG) debugPrintln("found in resource, value=" -+- + factoryClassName); -+- -+- // Note: here we do not want to fall back to the current -+- // ClassLoader because we want to avoid the case where the -+- // resource file was found using one ClassLoader and the -+- // provider class was instantiated using a different one. -+- return factoryClassName; -+- } -+- -+- // No provider found -+- return null; -+- } -+- -+- // -+- // Classes -+- // -+- -+- /** -+- * A configuration error. -+- */ -+- static class ConfigurationError -+- extends Error { -+- static final long serialVersionUID = 8859254254255146542L; -+- // -+- // Data -+- // -+- -+- /** Exception. */ -+- private Exception exception; -+- -+- // -+- // Constructors -+- // -+- -+- /** -+- * Construct a new instance with the specified detail string and -+- * exception. -+- */ -+- ConfigurationError(String msg, Exception x) { -+- super(msg); -+- this.exception = x; -+- } // <init>(String,Exception) -+- -+- // -+- // Public methods -+- // -+- -+- /** Returns the exception associated to this error. */ -+- Exception getException() { -+- return exception; -+- } // getException():Exception -+- -+- } // class ConfigurationError -+- -+-} // class ObjectFactory -+--- src/com/sun/org/apache/xml/internal/serializer/OutputPropertiesFactory.java 2013-04-16 14:28:09.688155906 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/OutputPropertiesFactory.java 2013-04-16 14:29:26.561394576 +0100 -+@@ -22,6 +22,7 @@ -+ */ -+ package com.sun.org.apache.xml.internal.serializer; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.io.BufferedInputStream; -+ import java.io.IOException; -+ import java.io.InputStream; -+@@ -451,7 +452,7 @@ -+ String value = null; -+ try -+ { -+- value = System.getProperty(key); -++ value = SecuritySupport.getSystemProperty(key); -+ } -+ catch (SecurityException se) -+ { -+@@ -464,7 +465,7 @@ -+ String newValue = null; -+ try -+ { -+- newValue = System.getProperty(newKey); -++ newValue = SecuritySupport.getSystemProperty(newKey); -+ } -+ catch (SecurityException se) -+ { -+--- src/com/sun/org/apache/xml/internal/serializer/SecuritySupport12.java 2013-04-16 14:28:09.688155906 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/SecuritySupport12.java 1970-01-01 01:00:00.000000000 +0100 -+@@ -1,145 +0,0 @@ -+-/* -+- * reserved comment block -+- * DO NOT REMOVE OR ALTER! -+- */ -+-/* -+- * Copyright 2002-2004 The Apache Software Foundation. -+- * -+- * Licensed under the Apache License, Version 2.0 (the "License"); -+- * you may not use this file except in compliance with the License. -+- * You may obtain a copy of the License at -+- * -+- * http://www.apache.org/licenses/LICENSE-2.0 -+- * -+- * Unless required by applicable law or agreed to in writing, software -+- * distributed under the License is distributed on an "AS IS" BASIS, -+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+- * See the License for the specific language governing permissions and -+- * limitations under the License. -+- */ -+-/* -+- * $Id: SecuritySupport12.java,v 1.2.4.1 2005/09/15 08:15:22 suresh_emailid Exp $ -+- */ -+- -+-package com.sun.org.apache.xml.internal.serializer; -+- -+-import java.io.File; -+-import java.io.FileInputStream; -+-import java.io.FileNotFoundException; -+-import java.io.InputStream; -+-import java.security.AccessController; -+-import java.security.PrivilegedAction; -+-import java.security.PrivilegedActionException; -+-import java.security.PrivilegedExceptionAction; -+- -+-/** -+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync. -+- * It is package private and therefore is not exposed as part of the Xalan-Java -+- * API. -+- * -+- * Security related methods that only work on J2SE 1.2 and newer. -+- */ -+-class SecuritySupport12 extends SecuritySupport { -+- -+- ClassLoader getContextClassLoader() { -+- return (ClassLoader) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- ClassLoader cl = null; -+- try { -+- cl = Thread.currentThread().getContextClassLoader(); -+- } catch (SecurityException ex) { } -+- return cl; -+- } -+- }); -+- } -+- -+- ClassLoader getSystemClassLoader() { -+- return (ClassLoader) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- ClassLoader cl = null; -+- try { -+- cl = ClassLoader.getSystemClassLoader(); -+- } catch (SecurityException ex) {} -+- return cl; -+- } -+- }); -+- } -+- -+- ClassLoader getParentClassLoader(final ClassLoader cl) { -+- return (ClassLoader) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- ClassLoader parent = null; -+- try { -+- parent = cl.getParent(); -+- } catch (SecurityException ex) {} -+- -+- // eliminate loops in case of the boot -+- // ClassLoader returning itself as a parent -+- return (parent == cl) ? null : parent; -+- } -+- }); -+- } -+- -+- String getSystemProperty(final String propName) { -+- return (String) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- return System.getProperty(propName); -+- } -+- }); -+- } -+- -+- FileInputStream getFileInputStream(final File file) -+- throws FileNotFoundException -+- { -+- try { -+- return (FileInputStream) -+- AccessController.doPrivileged(new PrivilegedExceptionAction() { -+- public Object run() throws FileNotFoundException { -+- return new FileInputStream(file); -+- } -+- }); -+- } catch (PrivilegedActionException e) { -+- throw (FileNotFoundException)e.getException(); -+- } -+- } -+- -+- InputStream getResourceAsStream(final ClassLoader cl, -+- final String name) -+- { -+- return (InputStream) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- InputStream ris; -+- if (cl == null) { -+- ris = ClassLoader.getSystemResourceAsStream(name); -+- } else { -+- ris = cl.getResourceAsStream(name); -+- } -+- return ris; -+- } -+- }); -+- } -+- -+- boolean getFileExists(final File f) { -+- return ((Boolean) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- return new Boolean(f.exists()); -+- } -+- })).booleanValue(); -+- } -+- -+- long getLastModified(final File f) { -+- return ((Long) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- return new Long(f.lastModified()); -+- } -+- })).longValue(); -+- } -+- -+-} -+--- src/com/sun/org/apache/xml/internal/serializer/SecuritySupport.java 2013-04-16 14:28:09.688155906 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100 -+@@ -1,125 +0,0 @@ -+-/* -+- * reserved comment block -+- * DO NOT REMOVE OR ALTER! -+- */ -+-/* -+- * Copyright 2002-2004 The Apache Software Foundation. -+- * -+- * Licensed under the Apache License, Version 2.0 (the "License"); -+- * you may not use this file except in compliance with the License. -+- * You may obtain a copy of the License at -+- * -+- * http://www.apache.org/licenses/LICENSE-2.0 -+- * -+- * Unless required by applicable law or agreed to in writing, software -+- * distributed under the License is distributed on an "AS IS" BASIS, -+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+- * See the License for the specific language governing permissions and -+- * limitations under the License. -+- */ -+-/* -+- * $Id: SecuritySupport.java,v 1.2.4.1 2005/09/15 08:15:21 suresh_emailid Exp $ -+- */ -+- -+-package com.sun.org.apache.xml.internal.serializer; -+- -+-import java.io.File; -+-import java.io.FileInputStream; -+-import java.io.FileNotFoundException; -+-import java.io.InputStream; -+- -+-/** -+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync. -+- * It is package private and therefore is not exposed as part of the Xalan-Java -+- * API. -+- * -+- * Base class with security related methods that work on JDK 1.1. -+- */ -+-class SecuritySupport { -+- -+- /* -+- * Make this of type Object so that the verifier won't try to -+- * prove its type, thus possibly trying to load the SecuritySupport12 -+- * class. -+- */ -+- private static final Object securitySupport; -+- -+- static { -+- SecuritySupport ss = null; -+- try { -+- Class c = Class.forName("java.security.AccessController"); -+- // if that worked, we're on 1.2. -+- /* -+- // don't reference the class explicitly so it doesn't -+- // get dragged in accidentally. -+- c = Class.forName("javax.mail.SecuritySupport12"); -+- Constructor cons = c.getConstructor(new Class[] { }); -+- ss = (SecuritySupport)cons.newInstance(new Object[] { }); -+- */ -+- /* -+- * Unfortunately, we can't load the class using reflection -+- * because the class is package private. And the class has -+- * to be package private so the APIs aren't exposed to other -+- * code that could use them to circumvent security. Thus, -+- * we accept the risk that the direct reference might fail -+- * on some JDK 1.1 JVMs, even though we would never execute -+- * this code in such a case. Sigh... -+- */ -+- ss = new SecuritySupport12(); -+- } catch (Exception ex) { -+- // ignore it -+- } finally { -+- if (ss == null) -+- ss = new SecuritySupport(); -+- securitySupport = ss; -+- } -+- } -+- -+- /** -+- * Return an appropriate instance of this class, depending on whether -+- * we're on a JDK 1.1 or J2SE 1.2 (or later) system. -+- */ -+- static SecuritySupport getInstance() { -+- return (SecuritySupport)securitySupport; -+- } -+- -+- ClassLoader getContextClassLoader() { -+- return null; -+- } -+- -+- ClassLoader getSystemClassLoader() { -+- return null; -+- } -+- -+- ClassLoader getParentClassLoader(ClassLoader cl) { -+- return null; -+- } -+- -+- String getSystemProperty(String propName) { -+- return System.getProperty(propName); -+- } -+- -+- FileInputStream getFileInputStream(File file) -+- throws FileNotFoundException -+- { -+- return new FileInputStream(file); -+- } -+- -+- InputStream getResourceAsStream(ClassLoader cl, String name) { -+- InputStream ris; -+- if (cl == null) { -+- ris = ClassLoader.getSystemResourceAsStream(name); -+- } else { -+- ris = cl.getResourceAsStream(name); -+- } -+- return ris; -+- } -+- -+- boolean getFileExists(File f) { -+- return f.exists(); -+- } -+- -+- long getLastModified(File f) { -+- return f.lastModified(); -+- } -+-} -+--- src/com/sun/org/apache/xml/internal/serializer/ToStream.java 2013-04-16 14:28:09.700156100 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/ToStream.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -22,6 +22,7 @@ -+ */ -+ package com.sun.org.apache.xml.internal.serializer; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.io.IOException; -+ import java.io.OutputStream; -+ import java.io.UnsupportedEncodingException; -+@@ -140,7 +141,7 @@ -+ * extension attribute xalan:line-separator. -+ */ -+ protected char[] m_lineSep = -+- System.getProperty("line.separator").toCharArray(); -++ SecuritySupport.getSystemProperty("line.separator").toCharArray(); -+ -+ /** -+ * True if the the system line separator is to be used. -+--- src/com/sun/org/apache/xml/internal/serializer/TreeWalker.java 2013-04-16 14:28:09.704156164 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/TreeWalker.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -22,6 +22,7 @@ -+ */ -+ package com.sun.org.apache.xml.internal.serializer; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.io.File; -+ -+ import com.sun.org.apache.xml.internal.serializer.utils.AttList; -+@@ -104,7 +105,7 @@ -+ else { -+ try { -+ // Bug see Bugzilla 26741 -+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl"); -++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl"); -+ } -+ catch (SecurityException se) {// user.dir not accessible from applet -+ } -+@@ -115,7 +116,7 @@ -+ m_contentHandler.setDocumentLocator(m_locator); -+ try { -+ // Bug see Bugzilla 26741 -+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl"); -++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl"); -+ } -+ catch (SecurityException se){// user.dir not accessible from applet -+ -+--- src/com/sun/org/apache/xml/internal/serializer/utils/Messages.java 2013-04-16 14:28:09.708156229 +0100 -++++ src/com/sun/org/apache/xml/internal/serializer/utils/Messages.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -22,6 +22,7 @@ -+ */ -+ package com.sun.org.apache.xml.internal.serializer.utils; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.util.ListResourceBundle; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+@@ -87,9 +88,6 @@ -+ * can have the Message strings translated in an alternate language -+ * in a errorResourceClass with a language suffix. -+ * -+- * More sophisticated use of this class would be to pass null -+- * when contructing it, but then call loadResourceBundle() -+- * before creating any messages. -+ * -+ * This class is not a public API, it is only public because it is -+ * used in com.sun.org.apache.xml.internal.serializer. -+@@ -126,18 +124,6 @@ -+ m_resourceBundleName = resourceBundle; -+ } -+ -+- /* -+- * Set the Locale object to use. If this method is not called the -+- * default locale is used. This method needs to be called before -+- * loadResourceBundle(). -+- * -+- * @param locale non-null reference to Locale object. -+- * @xsl.usage internal -+- */ -+-// public void setLocale(Locale locale) -+-// { -+-// m_locale = locale; -+-// } -+ -+ /** -+ * Get the Locale object that is being used. -+@@ -151,16 +137,6 @@ -+ } -+ -+ /** -+- * Get the ListResourceBundle being used by this Messages instance which was -+- * previously set by a call to loadResourceBundle(className) -+- * @xsl.usage internal -+- */ -+- private ListResourceBundle getResourceBundle() -+- { -+- return m_resourceBundle; -+- } -+- -+- /** -+ * Creates a message from the specified key and replacement -+ * arguments, localized to the given locale. -+ * -+@@ -174,7 +150,7 @@ -+ public final String createMessage(String msgKey, Object args[]) -+ { -+ if (m_resourceBundle == null) -+- m_resourceBundle = loadResourceBundle(m_resourceBundleName); -++ m_resourceBundle = SecuritySupport.getResourceBundle(m_resourceBundleName); -+ -+ if (m_resourceBundle != null) -+ { -+@@ -293,76 +269,4 @@ -+ return fmsg; -+ } -+ -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className the name of the class that implements ListResourceBundle, -+- * without language suffix. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- * @xsl.usage internal -+- */ -+- private ListResourceBundle loadResourceBundle(String resourceBundle) -+- throws MissingResourceException -+- { -+- m_resourceBundleName = resourceBundle; -+- Locale locale = getLocale(); -+- -+- ListResourceBundle lrb; -+- -+- try -+- { -+- -+- ResourceBundle rb = -+- ResourceBundle.getBundle(m_resourceBundleName, locale); -+- lrb = (ListResourceBundle) rb; -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- lrb = -+- (ListResourceBundle) ResourceBundle.getBundle( -+- m_resourceBundleName, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles." + m_resourceBundleName, -+- m_resourceBundleName, -+- ""); -+- } -+- } -+- m_resourceBundle = lrb; -+- return lrb; -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which can be appended to a resource name -+- * @xsl.usage internal -+- */ -+- private static String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+ } -+--- src/com/sun/org/apache/xml/internal/utils/res/XResourceBundle.java 2013-04-16 14:28:09.728156552 +0100 -++++ src/com/sun/org/apache/xml/internal/utils/res/XResourceBundle.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -22,6 +22,8 @@ -+ */ -+ package com.sun.org.apache.xml.internal.utils.res; -+ -++import java.security.AccessController; -++import java.security.PrivilegedAction; -+ import java.util.ListResourceBundle; -+ import java.util.Locale; -+ import java.util.MissingResourceException; -+@@ -29,114 +31,45 @@ -+ -+ /** -+ * The default (english) resource bundle. -++ * -+ * @xsl.usage internal -+ */ -+-public class XResourceBundle extends ListResourceBundle -+-{ -++public class XResourceBundle extends ListResourceBundle { -+ -+- /** Error resource constants */ -+- public static final String ERROR_RESOURCES = -+- "com.sun.org.apache.xalan.internal.res.XSLTErrorResources", XSLT_RESOURCE = -+- "com.sun.org.apache.xml.internal.utils.res.XResourceBundle", LANG_BUNDLE_NAME = -+- "com.sun.org.apache.xml.internal.utils.res.XResources", MULT_ORDER = -+- "multiplierOrder", MULT_PRECEDES = "precedes", MULT_FOLLOWS = -+- "follows", LANG_ORIENTATION = "orientation", LANG_RIGHTTOLEFT = -+- "rightToLeft", LANG_LEFTTORIGHT = "leftToRight", LANG_NUMBERING = -+- "numbering", LANG_ADDITIVE = "additive", LANG_MULT_ADD = -+- "multiplicative-additive", LANG_MULTIPLIER = -+- "multiplier", LANG_MULTIPLIER_CHAR = -+- "multiplierChar", LANG_NUMBERGROUPS = "numberGroups", LANG_NUM_TABLES = -+- "tables", LANG_ALPHABET = "alphabet", LANG_TRAD_ALPHABET = "tradAlphabet"; -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @param locale the locale to prefer when searching for the bundle -+- */ -+- public static final XResourceBundle loadResourceBundle( -+- String className, Locale locale) throws MissingResourceException -+- { -+- -+- String suffix = getResourceSuffix(locale); -+- -+- //System.out.println("resource " + className + suffix); -+- try -+- { -+- -+- // first try with the given locale -+- String resourceName = className + suffix; -+- return (XResourceBundle) ResourceBundle.getBundle(resourceName, locale); -++ /** -++ * Error resource constants -++ */ -++ public static final String ERROR_RESOURCES = -++ "com.sun.org.apache.xalan.internal.res.XSLTErrorResources", XSLT_RESOURCE = -++ "com.sun.org.apache.xml.internal.utils.res.XResourceBundle", LANG_BUNDLE_NAME = -++ "com.sun.org.apache.xml.internal.utils.res.XResources", MULT_ORDER = -++ "multiplierOrder", MULT_PRECEDES = "precedes", MULT_FOLLOWS = -++ "follows", LANG_ORIENTATION = "orientation", LANG_RIGHTTOLEFT = -++ "rightToLeft", LANG_LEFTTORIGHT = "leftToRight", LANG_NUMBERING = -++ "numbering", LANG_ADDITIVE = "additive", LANG_MULT_ADD = -++ "multiplicative-additive", LANG_MULTIPLIER = -++ "multiplier", LANG_MULTIPLIER_CHAR = -++ "multiplierChar", LANG_NUMBERGROUPS = "numberGroups", LANG_NUM_TABLES = -++ "tables", LANG_ALPHABET = "alphabet", LANG_TRAD_ALPHABET = "tradAlphabet"; -++ -++ -++ /** -++ * Get the association list. -++ * -++ * @return The association list. -++ */ -++ public Object[][] getContents() { -++ return new Object[][]{ -++ {"ui_language", "en"}, {"help_language", "en"}, {"language", "en"}, -++ {"alphabet", new CharArrayWrapper(new char[]{'A', 'B', 'C', 'D', 'E', 'F', 'G', -++ 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', -++ 'V', 'W', 'X', 'Y', 'Z'})}, -++ {"tradAlphabet", new CharArrayWrapper(new char[]{'A', 'B', 'C', 'D', 'E', 'F', -++ 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', -++ 'U', 'V', 'W', 'X', 'Y', 'Z'})}, -++ //language orientation -++ {"orientation", "LeftToRight"}, -++ //language numbering -++ {"numbering", "additive"},}; -+ } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XResourceBundle) ResourceBundle.getBundle( -+- XSLT_RESOURCE, new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String lang = locale.getLanguage(); -+- String country = locale.getCountry(); -+- String variant = locale.getVariant(); -+- String suffix = "_" + locale.getLanguage(); -+- -+- if (lang.equals("zh")) -+- suffix += "_" + country; -+- -+- if (country.equals("JP")) -+- suffix += "_" + country + "_" + variant; -+- -+- return suffix; -+- } -+- -+- /** -+- * Get the association list. -+- * -+- * @return The association list. -+- */ -+- public Object[][] getContents() -+- { -+- return new Object[][] -+- { -+- { "ui_language", "en" }, { "help_language", "en" }, { "language", "en" }, -+- { "alphabet", new CharArrayWrapper(new char[]{ 'A', 'B', 'C', 'D', 'E', 'F', 'G', -+- 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U', -+- 'V', 'W', 'X', 'Y', 'Z' })}, -+- { "tradAlphabet", new CharArrayWrapper(new char[]{ 'A', 'B', 'C', 'D', 'E', 'F', -+- 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', -+- 'U', 'V', 'W', 'X', 'Y', 'Z' }) }, -+- -+- //language orientation -+- { "orientation", "LeftToRight" }, -+- -+- //language numbering -+- { "numbering", "additive" }, -+- }; -+- } -+ } -+--- src/com/sun/org/apache/xml/internal/utils/TreeWalker.java 2013-04-16 14:28:09.720156422 +0100 -++++ src/com/sun/org/apache/xml/internal/utils/TreeWalker.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -22,6 +22,7 @@ -+ */ -+ package com.sun.org.apache.xml.internal.utils; -+ -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ import java.io.File; -+ -+ import org.w3c.dom.Comment; -+@@ -93,7 +94,7 @@ -+ else { -+ try { -+ // Bug see Bugzilla 26741 -+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl"); -++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl"); -+ } -+ catch (SecurityException se) {// user.dir not accessible from applet -+ } -+@@ -112,7 +113,7 @@ -+ m_contentHandler.setDocumentLocator(m_locator); -+ try { -+ // Bug see Bugzilla 26741 -+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl"); -++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl"); -+ } -+ catch (SecurityException se){// user.dir not accessible from applet -+ } -+@@ -131,7 +132,7 @@ -+ m_contentHandler.setDocumentLocator(m_locator); -+ try { -+ // Bug see Bugzilla 26741 -+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl"); -++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl"); -+ } -+ catch (SecurityException se){// user.dir not accessible from applet -+ -+--- src/com/sun/org/apache/xpath/internal/functions/FuncSystemProperty.java 2013-04-16 14:28:09.752156937 +0100 -++++ src/com/sun/org/apache/xpath/internal/functions/FuncSystemProperty.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -31,6 +31,8 @@ -+ import com.sun.org.apache.xpath.internal.objects.XObject; -+ import com.sun.org.apache.xpath.internal.objects.XString; -+ import com.sun.org.apache.xpath.internal.res.XPATHErrorResources; -++import com.sun.org.apache.xalan.internal.utils.ObjectFactory; -++import com.sun.org.apache.xalan.internal.utils.SecuritySupport; -+ -+ /** -+ * Execute the SystemProperty() function. -+@@ -100,7 +102,7 @@ -+ -+ try -+ { -+- result = System.getProperty(propName); -++ result = SecuritySupport.getSystemProperty(propName); -+ -+ if (null == result) -+ { -+@@ -122,7 +124,7 @@ -+ { -+ try -+ { -+- result = System.getProperty(fullName); -++ result = SecuritySupport.getSystemProperty(fullName); -+ -+ if (null == result) -+ { -+@@ -163,14 +165,12 @@ -+ * should already be fully qualified as path/filename -+ * @param target The target property bag the file will be placed into. -+ */ -+- private void loadPropertyFile(String file, Properties target) -++ public void loadPropertyFile(String file, Properties target) -+ { -+ try -+ { -+ // Use SecuritySupport class to provide priveleged access to property file -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- -+- InputStream is = ss.getResourceAsStream(ObjectFactory.findClassLoader(), -++ InputStream is = SecuritySupport.getResourceAsStream(ObjectFactory.findClassLoader(), -+ file); -+ -+ // get a buffered version -+--- src/com/sun/org/apache/xpath/internal/functions/ObjectFactory.java 2013-04-16 14:28:09.752156937 +0100 -++++ src/com/sun/org/apache/xpath/internal/functions/ObjectFactory.java 1970-01-01 01:00:00.000000000 +0100 -+@@ -1,663 +0,0 @@ -+-/* -+- * reserved comment block -+- * DO NOT REMOVE OR ALTER! -+- */ -+-/* -+- * Copyright 2001-2004 The Apache Software Foundation. -+- * -+- * Licensed under the Apache License, Version 2.0 (the "License"); -+- * you may not use this file except in compliance with the License. -+- * You may obtain a copy of the License at -+- * -+- * http://www.apache.org/licenses/LICENSE-2.0 -+- * -+- * Unless required by applicable law or agreed to in writing, software -+- * distributed under the License is distributed on an "AS IS" BASIS, -+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+- * See the License for the specific language governing permissions and -+- * limitations under the License. -+- */ -+-/* -+- * $Id: ObjectFactory.java,v 1.2.4.1 2005/09/14 20:25:54 jeffsuttor Exp $ -+- */ -+- -+-package com.sun.org.apache.xpath.internal.functions; -+- -+-import java.io.InputStream; -+-import java.io.IOException; -+-import java.io.File; -+-import java.io.FileInputStream; -+- -+-import java.util.Properties; -+-import java.io.BufferedReader; -+-import java.io.InputStreamReader; -+- -+-/** -+- * This class is duplicated for each JAXP subpackage so keep it in sync. -+- * It is package private and therefore is not exposed as part of the JAXP -+- * API. -+- * <p> -+- * This code is designed to implement the JAXP 1.1 spec pluggability -+- * feature and is designed to run on JDK version 1.1 and -+- * later, and to compile on JDK 1.2 and onward. -+- * The code also runs both as part of an unbundled jar file and -+- * when bundled as part of the JDK. -+- * <p> -+- * This class was moved from the <code>javax.xml.parsers.ObjectFactory</code> -+- * class and modified to be used as a general utility for creating objects -+- * dynamically. -+- * -+- * @version $Id: ObjectFactory.java,v 1.7 2008/04/02 00:40:59 joehw Exp $ -+- */ -+-class ObjectFactory { -+- -+- // -+- // Constants -+- // -+- -+- // name of default properties file to look for in JDK's jre/lib directory -+- private static final String DEFAULT_PROPERTIES_FILENAME = -+- "xalan.properties"; -+- -+- private static final String SERVICES_PATH = "META-INF/services/"; -+- -+- /** Set to true for debugging */ -+- private static final boolean DEBUG = false; -+- -+- /** cache the contents of the xalan.properties file. -+- * Until an attempt has been made to read this file, this will -+- * be null; if the file does not exist or we encounter some other error -+- * during the read, this will be empty. -+- */ -+- private static Properties fXalanProperties = null; -+- -+- /*** -+- * Cache the time stamp of the xalan.properties file so -+- * that we know if it's been modified and can invalidate -+- * the cache when necessary. -+- */ -+- private static long fLastModified = -1; -+- -+- // -+- // Public static methods -+- // -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return instance of factory, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Object createObject(String factoryId, String fallbackClassName) -+- throws ConfigurationError { -+- return createObject(factoryId, null, fallbackClassName); -+- } // createObject(String,String):Object -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return instance of factory, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Object createObject(String factoryId, -+- String propertiesFilename, -+- String fallbackClassName) -+- throws ConfigurationError -+- { -+- Class factoryClass = lookUpFactoryClass(factoryId, -+- propertiesFilename, -+- fallbackClassName); -+- -+- if (factoryClass == null) { -+- throw new ConfigurationError( -+- "Provider for " + factoryId + " cannot be found", null); -+- } -+- -+- try{ -+- Object instance = factoryClass.newInstance(); -+- if (DEBUG) debugPrintln("created new instance of factory " + factoryId); -+- return instance; -+- } catch (Exception x) { -+- throw new ConfigurationError( -+- "Provider for factory " + factoryId -+- + " could not be instantiated: " + x, x); -+- } -+- } // createObject(String,String,String):Object -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return Class object of factory, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Class lookUpFactoryClass(String factoryId) -+- throws ConfigurationError -+- { -+- return lookUpFactoryClass(factoryId, null, null); -+- } // lookUpFactoryClass(String):Class -+- -+- /** -+- * Finds the implementation Class object in the specified order. The -+- * specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return Class object that provides factory service, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static Class lookUpFactoryClass(String factoryId, -+- String propertiesFilename, -+- String fallbackClassName) -+- throws ConfigurationError -+- { -+- String factoryClassName = lookUpFactoryClassName(factoryId, -+- propertiesFilename, -+- fallbackClassName); -+- ClassLoader cl = findClassLoader(); -+- -+- if (factoryClassName == null) { -+- factoryClassName = fallbackClassName; -+- } -+- -+- // assert(className != null); -+- try{ -+- Class providerClass = findProviderClass(factoryClassName, -+- cl, -+- true); -+- if (DEBUG) debugPrintln("created new instance of " + providerClass + -+- " using ClassLoader: " + cl); -+- return providerClass; -+- } catch (ClassNotFoundException x) { -+- throw new ConfigurationError( -+- "Provider " + factoryClassName + " not found", x); -+- } catch (Exception x) { -+- throw new ConfigurationError( -+- "Provider "+factoryClassName+" could not be instantiated: "+x, -+- x); -+- } -+- } // lookUpFactoryClass(String,String,String):Class -+- -+- /** -+- * Finds the name of the required implementation class in the specified -+- * order. The specified order is the following: -+- * <ol> -+- * <li>query the system property using <code>System.getProperty</code> -+- * <li>read <code>$java.home/lib/<i>propertiesFilename</i></code> file -+- * <li>read <code>META-INF/services/<i>factoryId</i></code> file -+- * <li>use fallback classname -+- * </ol> -+- * -+- * @return name of class that provides factory service, never null -+- * -+- * @param factoryId Name of the factory to find, same as -+- * a property name -+- * @param propertiesFilename The filename in the $java.home/lib directory -+- * of the properties file. If none specified, -+- * ${java.home}/lib/xalan.properties will be used. -+- * @param fallbackClassName Implementation class name, if nothing else -+- * is found. Use null to mean no fallback. -+- * -+- * @exception ObjectFactory.ConfigurationError -+- */ -+- static String lookUpFactoryClassName(String factoryId, -+- String propertiesFilename, -+- String fallbackClassName) -+- { -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- -+- // Use the system property first -+- try { -+- String systemProp = ss.getSystemProperty(factoryId); -+- if (systemProp != null) { -+- if (DEBUG) debugPrintln("found system property, value=" + systemProp); -+- return systemProp; -+- } -+- } catch (SecurityException se) { -+- // Ignore and continue w/ next location -+- } -+- -+- // Try to read from propertiesFilename, or -+- // $java.home/lib/xalan.properties -+- String factoryClassName = null; -+- // no properties file name specified; use -+- // $JAVA_HOME/lib/xalan.properties: -+- if (propertiesFilename == null) { -+- File propertiesFile = null; -+- boolean propertiesFileExists = false; -+- try { -+- String javah = ss.getSystemProperty("java.home"); -+- propertiesFilename = javah + File.separator + -+- "lib" + File.separator + DEFAULT_PROPERTIES_FILENAME; -+- propertiesFile = new File(propertiesFilename); -+- propertiesFileExists = ss.getFileExists(propertiesFile); -+- } catch (SecurityException e) { -+- // try again... -+- fLastModified = -1; -+- fXalanProperties = null; -+- } -+- -+- synchronized (ObjectFactory.class) { -+- boolean loadProperties = false; -+- FileInputStream fis = null; -+- try { -+- // file existed last time -+- if(fLastModified >= 0) { -+- if(propertiesFileExists && -+- (fLastModified < (fLastModified = ss.getLastModified(propertiesFile)))) { -+- loadProperties = true; -+- } else { -+- // file has stopped existing... -+- if(!propertiesFileExists) { -+- fLastModified = -1; -+- fXalanProperties = null; -+- } // else, file wasn't modified! -+- } -+- } else { -+- // file has started to exist: -+- if(propertiesFileExists) { -+- loadProperties = true; -+- fLastModified = ss.getLastModified(propertiesFile); -+- } // else, nothing's changed -+- } -+- if(loadProperties) { -+- // must never have attempted to read xalan.properties -+- // before (or it's outdeated) -+- fXalanProperties = new Properties(); -+- fis = ss.getFileInputStream(propertiesFile); -+- fXalanProperties.load(fis); -+- } -+- } catch (Exception x) { -+- fXalanProperties = null; -+- fLastModified = -1; -+- // assert(x instanceof FileNotFoundException -+- // || x instanceof SecurityException) -+- // In both cases, ignore and continue w/ next location -+- } -+- finally { -+- // try to close the input stream if one was opened. -+- if (fis != null) { -+- try { -+- fis.close(); -+- } -+- // Ignore the exception. -+- catch (IOException exc) {} -+- } -+- } -+- } -+- if(fXalanProperties != null) { -+- factoryClassName = fXalanProperties.getProperty(factoryId); -+- } -+- } else { -+- FileInputStream fis = null; -+- try { -+- fis = ss.getFileInputStream(new File(propertiesFilename)); -+- Properties props = new Properties(); -+- props.load(fis); -+- factoryClassName = props.getProperty(factoryId); -+- } catch (Exception x) { -+- // assert(x instanceof FileNotFoundException -+- // || x instanceof SecurityException) -+- // In both cases, ignore and continue w/ next location -+- } -+- finally { -+- // try to close the input stream if one was opened. -+- if (fis != null) { -+- try { -+- fis.close(); -+- } -+- // Ignore the exception. -+- catch (IOException exc) {} -+- } -+- } -+- } -+- if (factoryClassName != null) { -+- if (DEBUG) debugPrintln("found in " + propertiesFilename + ", value=" -+- + factoryClassName); -+- return factoryClassName; -+- } -+- -+- // Try Jar Service Provider Mechanism -+- return findJarServiceProviderName(factoryId); -+- } // lookUpFactoryClass(String,String):String -+- -+- // -+- // Private static methods -+- // -+- -+- /** Prints a message to standard error if debugging is enabled. */ -+- private static void debugPrintln(String msg) { -+- if (DEBUG) { -+- System.err.println("JAXP: " + msg); -+- } -+- } // debugPrintln(String) -+- -+- /** -+- * Figure out which ClassLoader to use. For JDK 1.2 and later use -+- * the context ClassLoader. -+- */ -+- static ClassLoader findClassLoader() -+- throws ConfigurationError -+- { -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- -+- // Figure out which ClassLoader to use for loading the provider -+- // class. If there is a Context ClassLoader then use it. -+- ClassLoader context = ss.getContextClassLoader(); -+- ClassLoader system = ss.getSystemClassLoader(); -+- -+- ClassLoader chain = system; -+- while (true) { -+- if (context == chain) { -+- // Assert: we are on JDK 1.1 or we have no Context ClassLoader -+- // or any Context ClassLoader in chain of system classloader -+- // (including extension ClassLoader) so extend to widest -+- // ClassLoader (always look in system ClassLoader if Xalan -+- // is in boot/extension/system classpath and in current -+- // ClassLoader otherwise); normal classloaders delegate -+- // back to system ClassLoader first so this widening doesn't -+- // change the fact that context ClassLoader will be consulted -+- ClassLoader current = ObjectFactory.class.getClassLoader(); -+- -+- chain = system; -+- while (true) { -+- if (current == chain) { -+- // Assert: Current ClassLoader in chain of -+- // boot/extension/system ClassLoaders -+- return system; -+- } -+- if (chain == null) { -+- break; -+- } -+- chain = ss.getParentClassLoader(chain); -+- } -+- -+- // Assert: Current ClassLoader not in chain of -+- // boot/extension/system ClassLoaders -+- return current; -+- } -+- -+- if (chain == null) { -+- // boot ClassLoader reached -+- break; -+- } -+- -+- // Check for any extension ClassLoaders in chain up to -+- // boot ClassLoader -+- chain = ss.getParentClassLoader(chain); -+- }; -+- -+- // Assert: Context ClassLoader not in chain of -+- // boot/extension/system ClassLoaders -+- return context; -+- } // findClassLoader():ClassLoader -+- -+- /** -+- * Create an instance of a class using the specified ClassLoader -+- */ -+- static Object newInstance(String className, ClassLoader cl, -+- boolean doFallback) -+- throws ConfigurationError -+- { -+- // assert(className != null); -+- try{ -+- Class providerClass = findProviderClass(className, cl, doFallback); -+- Object instance = providerClass.newInstance(); -+- if (DEBUG) debugPrintln("created new instance of " + providerClass + -+- " using ClassLoader: " + cl); -+- return instance; -+- } catch (ClassNotFoundException x) { -+- throw new ConfigurationError( -+- "Provider " + className + " not found", x); -+- } catch (Exception x) { -+- throw new ConfigurationError( -+- "Provider " + className + " could not be instantiated: " + x, -+- x); -+- } -+- } -+- -+- /** -+- * Find a Class using the specified ClassLoader -+- */ -+- static Class findProviderClass(String className, ClassLoader cl, -+- boolean doFallback) -+- throws ClassNotFoundException, ConfigurationError -+- { -+- //throw security exception if the calling thread is not allowed to access the -+- //class. Restrict the access to the package classes as specified in java.security policy. -+- SecurityManager security = System.getSecurityManager(); -+- try{ -+- if (security != null){ -+- final int lastDot = className.lastIndexOf("."); -+- String packageName = className; -+- if (lastDot != -1) packageName = className.substring(0, lastDot); -+- security.checkPackageAccess(packageName); -+- } -+- }catch(SecurityException e){ -+- throw e; -+- } -+- -+- Class providerClass; -+- if (cl == null) { -+- // XXX Use the bootstrap ClassLoader. There is no way to -+- // load a class using the bootstrap ClassLoader that works -+- // in both JDK 1.1 and Java 2. However, this should still -+- // work b/c the following should be true: -+- // -+- // (cl == null) iff current ClassLoader == null -+- // -+- // Thus Class.forName(String) will use the current -+- // ClassLoader which will be the bootstrap ClassLoader. -+- providerClass = Class.forName(className); -+- } else { -+- try { -+- providerClass = cl.loadClass(className); -+- } catch (ClassNotFoundException x) { -+- if (doFallback) { -+- // Fall back to current classloader -+- ClassLoader current = ObjectFactory.class.getClassLoader(); -+- if (current == null) { -+- providerClass = Class.forName(className); -+- } else if (cl != current) { -+- cl = current; -+- providerClass = cl.loadClass(className); -+- } else { -+- throw x; -+- } -+- } else { -+- throw x; -+- } -+- } -+- } -+- -+- return providerClass; -+- } -+- -+- /** -+- * Find the name of service provider using Jar Service Provider Mechanism -+- * -+- * @return instance of provider class if found or null -+- */ -+- private static String findJarServiceProviderName(String factoryId) -+- { -+- SecuritySupport ss = SecuritySupport.getInstance(); -+- String serviceId = SERVICES_PATH + factoryId; -+- InputStream is = null; -+- -+- // First try the Context ClassLoader -+- ClassLoader cl = findClassLoader(); -+- -+- is = ss.getResourceAsStream(cl, serviceId); -+- -+- // If no provider found then try the current ClassLoader -+- if (is == null) { -+- ClassLoader current = ObjectFactory.class.getClassLoader(); -+- if (cl != current) { -+- cl = current; -+- is = ss.getResourceAsStream(cl, serviceId); -+- } -+- } -+- -+- if (is == null) { -+- // No provider found -+- return null; -+- } -+- -+- if (DEBUG) debugPrintln("found jar resource=" + serviceId + -+- " using ClassLoader: " + cl); -+- -+- // Read the service provider name in UTF-8 as specified in -+- // the jar spec. Unfortunately this fails in Microsoft -+- // VJ++, which does not implement the UTF-8 -+- // encoding. Theoretically, we should simply let it fail in -+- // that case, since the JVM is obviously broken if it -+- // doesn't support such a basic standard. But since there -+- // are still some users attempting to use VJ++ for -+- // development, we have dropped in a fallback which makes a -+- // second attempt using the platform's default encoding. In -+- // VJ++ this is apparently ASCII, which is a subset of -+- // UTF-8... and since the strings we'll be reading here are -+- // also primarily limited to the 7-bit ASCII range (at -+- // least, in English versions), this should work well -+- // enough to keep us on the air until we're ready to -+- // officially decommit from VJ++. [Edited comment from -+- // jkesselm] -+- BufferedReader rd; -+- try { -+- rd = new BufferedReader(new InputStreamReader(is, "UTF-8")); -+- } catch (java.io.UnsupportedEncodingException e) { -+- rd = new BufferedReader(new InputStreamReader(is)); -+- } -+- -+- String factoryClassName = null; -+- try { -+- // XXX Does not handle all possible input as specified by the -+- // Jar Service Provider specification -+- factoryClassName = rd.readLine(); -+- } catch (IOException x) { -+- // No provider found -+- return null; -+- } -+- finally { -+- try { -+- // try to close the reader. -+- rd.close(); -+- } -+- // Ignore the exception. -+- catch (IOException exc) {} -+- } -+- -+- if (factoryClassName != null && -+- ! "".equals(factoryClassName)) { -+- if (DEBUG) debugPrintln("found in resource, value=" -+- + factoryClassName); -+- -+- // Note: here we do not want to fall back to the current -+- // ClassLoader because we want to avoid the case where the -+- // resource file was found using one ClassLoader and the -+- // provider class was instantiated using a different one. -+- return factoryClassName; -+- } -+- -+- // No provider found -+- return null; -+- } -+- -+- // -+- // Classes -+- // -+- -+- /** -+- * A configuration error. -+- */ -+- static class ConfigurationError -+- extends Error { -+- static final long serialVersionUID = -5782303800588797207L; -+- // -+- // Data -+- // -+- -+- /** Exception. */ -+- private Exception exception; -+- -+- // -+- // Constructors -+- // -+- -+- /** -+- * Construct a new instance with the specified detail string and -+- * exception. -+- */ -+- ConfigurationError(String msg, Exception x) { -+- super(msg); -+- this.exception = x; -+- } // <init>(String,Exception) -+- -+- // -+- // Public methods -+- // -+- -+- /** Returns the exception associated to this error. */ -+- Exception getException() { -+- return exception; -+- } // getException():Exception -+- -+- } // class ConfigurationError -+- -+-} // class ObjectFactory -+--- src/com/sun/org/apache/xpath/internal/functions/SecuritySupport12.java 2013-04-16 14:28:09.752156937 +0100 -++++ src/com/sun/org/apache/xpath/internal/functions/SecuritySupport12.java 1970-01-01 01:00:00.000000000 +0100 -+@@ -1,148 +0,0 @@ -+-/* -+- * reserved comment block -+- * DO NOT REMOVE OR ALTER! -+- */ -+-/* -+- * Copyright 2002-2004 The Apache Software Foundation. -+- * -+- * Licensed under the Apache License, Version 2.0 (the "License"); -+- * you may not use this file except in compliance with the License. -+- * You may obtain a copy of the License at -+- * -+- * http://www.apache.org/licenses/LICENSE-2.0 -+- * -+- * Unless required by applicable law or agreed to in writing, software -+- * distributed under the License is distributed on an "AS IS" BASIS, -+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+- * See the License for the specific language governing permissions and -+- * limitations under the License. -+- */ -+-/* -+- * $Id: SecuritySupport12.java,v 1.1.2.1 2005/08/01 01:29:45 jeffsuttor Exp $ -+- */ -+- -+-package com.sun.org.apache.xpath.internal.functions; -+- -+-import java.io.File; -+-import java.io.FileInputStream; -+-import java.io.FileNotFoundException; -+-import java.io.InputStream; -+- -+-import java.security.AccessController; -+-import java.security.PrivilegedAction; -+-import java.security.PrivilegedActionException; -+-import java.security.PrivilegedExceptionAction; -+- -+-import java.util.Properties; -+- -+-/** -+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync. -+- * It is package private and therefore is not exposed as part of the Xalan-Java -+- * API. -+- * -+- * Security related methods that only work on J2SE 1.2 and newer. -+- */ -+-class SecuritySupport12 extends SecuritySupport { -+- -+- ClassLoader getContextClassLoader() { -+- return (ClassLoader) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- ClassLoader cl = null; -+- try { -+- cl = Thread.currentThread().getContextClassLoader(); -+- } catch (SecurityException ex) { } -+- return cl; -+- } -+- }); -+- } -+- -+- ClassLoader getSystemClassLoader() { -+- return (ClassLoader) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- ClassLoader cl = null; -+- try { -+- cl = ClassLoader.getSystemClassLoader(); -+- } catch (SecurityException ex) {} -+- return cl; -+- } -+- }); -+- } -+- -+- ClassLoader getParentClassLoader(final ClassLoader cl) { -+- return (ClassLoader) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- ClassLoader parent = null; -+- try { -+- parent = cl.getParent(); -+- } catch (SecurityException ex) {} -+- -+- // eliminate loops in case of the boot -+- // ClassLoader returning itself as a parent -+- return (parent == cl) ? null : parent; -+- } -+- }); -+- } -+- -+- String getSystemProperty(final String propName) { -+- return (String) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- return System.getProperty(propName); -+- } -+- }); -+- } -+- -+- FileInputStream getFileInputStream(final File file) -+- throws FileNotFoundException -+- { -+- try { -+- return (FileInputStream) -+- AccessController.doPrivileged(new PrivilegedExceptionAction() { -+- public Object run() throws FileNotFoundException { -+- return new FileInputStream(file); -+- } -+- }); -+- } catch (PrivilegedActionException e) { -+- throw (FileNotFoundException)e.getException(); -+- } -+- } -+- -+- InputStream getResourceAsStream(final ClassLoader cl, -+- final String name) -+- { -+- return (InputStream) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- InputStream ris; -+- if (cl == null) { -+- ris = ClassLoader.getSystemResourceAsStream(name); -+- } else { -+- ris = cl.getResourceAsStream(name); -+- } -+- return ris; -+- } -+- }); -+- } -+- -+- boolean getFileExists(final File f) { -+- return ((Boolean) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- return new Boolean(f.exists()); -+- } -+- })).booleanValue(); -+- } -+- -+- long getLastModified(final File f) { -+- return ((Long) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- return new Long(f.lastModified()); -+- } -+- })).longValue(); -+- } -+- -+-} -+--- src/com/sun/org/apache/xpath/internal/functions/SecuritySupport.java 2013-04-16 14:28:09.752156937 +0100 -++++ src/com/sun/org/apache/xpath/internal/functions/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100 -+@@ -1,127 +0,0 @@ -+-/* -+- * reserved comment block -+- * DO NOT REMOVE OR ALTER! -+- */ -+-/* -+- * Copyright 2002-2004 The Apache Software Foundation. -+- * -+- * Licensed under the Apache License, Version 2.0 (the "License"); -+- * you may not use this file except in compliance with the License. -+- * You may obtain a copy of the License at -+- * -+- * http://www.apache.org/licenses/LICENSE-2.0 -+- * -+- * Unless required by applicable law or agreed to in writing, software -+- * distributed under the License is distributed on an "AS IS" BASIS, -+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+- * See the License for the specific language governing permissions and -+- * limitations under the License. -+- */ -+-/* -+- * $Id: SecuritySupport.java,v 1.1.2.1 2005/08/01 01:29:39 jeffsuttor Exp $ -+- */ -+- -+-package com.sun.org.apache.xpath.internal.functions; -+- -+-import java.io.File; -+-import java.io.FileInputStream; -+-import java.io.FileNotFoundException; -+-import java.io.InputStream; -+- -+-import java.util.Properties; -+- -+-/** -+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync. -+- * It is package private and therefore is not exposed as part of the Xalan-Java -+- * API. -+- * -+- * Base class with security related methods that work on JDK 1.1. -+- */ -+-class SecuritySupport { -+- -+- /* -+- * Make this of type Object so that the verifier won't try to -+- * prove its type, thus possibly trying to load the SecuritySupport12 -+- * class. -+- */ -+- private static final Object securitySupport; -+- -+- static { -+- SecuritySupport ss = null; -+- try { -+- Class c = Class.forName("java.security.AccessController"); -+- // if that worked, we're on 1.2. -+- /* -+- // don't reference the class explicitly so it doesn't -+- // get dragged in accidentally. -+- c = Class.forName("javax.mail.SecuritySupport12"); -+- Constructor cons = c.getConstructor(new Class[] { }); -+- ss = (SecuritySupport)cons.newInstance(new Object[] { }); -+- */ -+- /* -+- * Unfortunately, we can't load the class using reflection -+- * because the class is package private. And the class has -+- * to be package private so the APIs aren't exposed to other -+- * code that could use them to circumvent security. Thus, -+- * we accept the risk that the direct reference might fail -+- * on some JDK 1.1 JVMs, even though we would never execute -+- * this code in such a case. Sigh... -+- */ -+- ss = new SecuritySupport12(); -+- } catch (Exception ex) { -+- // ignore it -+- } finally { -+- if (ss == null) -+- ss = new SecuritySupport(); -+- securitySupport = ss; -+- } -+- } -+- -+- /** -+- * Return an appropriate instance of this class, depending on whether -+- * we're on a JDK 1.1 or J2SE 1.2 (or later) system. -+- */ -+- static SecuritySupport getInstance() { -+- return (SecuritySupport)securitySupport; -+- } -+- -+- ClassLoader getContextClassLoader() { -+- return null; -+- } -+- -+- ClassLoader getSystemClassLoader() { -+- return null; -+- } -+- -+- ClassLoader getParentClassLoader(ClassLoader cl) { -+- return null; -+- } -+- -+- String getSystemProperty(String propName) { -+- return System.getProperty(propName); -+- } -+- -+- FileInputStream getFileInputStream(File file) -+- throws FileNotFoundException -+- { -+- return new FileInputStream(file); -+- } -+- -+- InputStream getResourceAsStream(ClassLoader cl, String name) { -+- InputStream ris; -+- if (cl == null) { -+- ris = ClassLoader.getSystemResourceAsStream(name); -+- } else { -+- ris = cl.getResourceAsStream(name); -+- } -+- return ris; -+- } -+- -+- boolean getFileExists(File f) { -+- return f.exists(); -+- } -+- -+- long getLastModified(File f) { -+- return f.lastModified(); -+- } -+-} -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_de.java 2013-04-16 14:28:09.764157131 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_de.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1269,68 +1266,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "MUSTER "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_es.java 2013-04-16 14:28:09.764157131 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_es.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1273,68 +1270,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("es", "ES")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_fr.java 2013-04-16 14:28:09.768157196 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_fr.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1270,68 +1267,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_it.java 2013-04-16 14:28:09.768157196 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_it.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1272,68 +1269,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "MODELLO "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("it", "IT")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ja.java 2013-04-16 14:28:09.768157196 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ja.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1269,68 +1266,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "\u30d1\u30bf\u30fc\u30f3 "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources.java 2013-04-16 14:28:09.764157131 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -938,68 +935,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("en", "US")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ko.java 2013-04-16 14:28:09.768157196 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ko.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1269,68 +1266,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("ko", "KR")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_CN.java 2013-04-16 14:28:09.772157260 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_CN.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1270,68 +1267,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("zh", "CN")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "\u65e0\u6cd5\u88c5\u5165\u4efb\u4f55\u8d44\u6e90\u5305\u3002", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_TW.java 2013-04-16 14:28:09.772157260 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_TW.java 2013-04-16 14:29:26.565394640 +0100 -+@@ -23,9 +23,6 @@ -+ package com.sun.org.apache.xpath.internal.res; -+ -+ import java.util.ListResourceBundle; -+-import java.util.Locale; -+-import java.util.MissingResourceException; -+-import java.util.ResourceBundle; -+ -+ /** -+ * Set up error messages. -+@@ -1270,68 +1267,4 @@ -+ /** Field QUERY_HEADER */ -+ public static final String QUERY_HEADER = "PATTERN "; -+ -+- -+- /** -+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior -+- * of ResourceBundle.getBundle(). -+- * -+- * @param className Name of local-specific subclass. -+- * @return the ResourceBundle -+- * @throws MissingResourceException -+- */ -+- public static final XPATHErrorResources loadResourceBundle(String className) -+- throws MissingResourceException -+- { -+- -+- Locale locale = Locale.getDefault(); -+- String suffix = getResourceSuffix(locale); -+- -+- try -+- { -+- -+- // first try with the given locale -+- return (XPATHErrorResources) ResourceBundle.getBundle(className -+- + suffix, locale); -+- } -+- catch (MissingResourceException e) -+- { -+- try // try to fall back to en_US if we can't load -+- { -+- -+- // Since we can't find the localized property file, -+- // fall back to en_US. -+- return (XPATHErrorResources) ResourceBundle.getBundle(className, -+- new Locale("zh", "TW")); -+- } -+- catch (MissingResourceException e2) -+- { -+- -+- // Now we are really in trouble. -+- // very bad, definitely very bad...not going to get very far -+- throw new MissingResourceException( -+- "Could not load any resource bundles.", className, ""); -+- } -+- } -+- } -+- -+- /** -+- * Return the resource file suffic for the indicated locale -+- * For most locales, this will be based the language code. However -+- * for Chinese, we do distinguish between Taiwan and PRC -+- * -+- * @param locale the locale -+- * @return an String suffix which canbe appended to a resource name -+- */ -+- private static final String getResourceSuffix(Locale locale) -+- { -+- -+- String suffix = "_" + locale.getLanguage(); -+- String country = locale.getCountry(); -+- -+- if (country.equals("TW")) -+- suffix += "_" + country; -+- -+- return suffix; -+- } -+- -+ } -+--- src/com/sun/org/apache/xpath/internal/res/XPATHMessages.java 2013-04-16 14:28:09.772157260 +0100 -++++ src/com/sun/org/apache/xpath/internal/res/XPATHMessages.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -22,130 +22,128 @@ -+ */ -+ package com.sun.org.apache.xpath.internal.res; -+ -+-import java.util.ListResourceBundle; -+- -++import com.sun.org.apache.bcel.internal.util.SecuritySupport; -+ import com.sun.org.apache.xml.internal.res.XMLMessages; -++import java.util.ListResourceBundle; -+ -+ /** -+ * A utility class for issuing XPath error messages. -++ * -+ * @xsl.usage internal -+ */ -+-public class XPATHMessages extends XMLMessages -+-{ -+- /** The language specific resource object for XPath messages. */ -+- private static ListResourceBundle XPATHBundle = null; -+- -+- /** The class name of the XPath error message string table. */ -+- private static final String XPATH_ERROR_RESOURCES = -+- "com.sun.org.apache.xpath.internal.res.XPATHErrorResources"; -+- -+- /** -+- * Creates a message from the specified key and replacement -+- * arguments, localized to the given locale. -+- * -+- * @param msgKey The key for the message text. -+- * @param args The arguments to be used as replacement text -+- * in the message created. -+- * -+- * @return The formatted message string. -+- */ -+- public static final String createXPATHMessage(String msgKey, Object args[]) //throws Exception -+- { -+- if (XPATHBundle == null) -+- XPATHBundle = loadResourceBundle(XPATH_ERROR_RESOURCES); -++public class XPATHMessages extends XMLMessages { -+ -+- if (XPATHBundle != null) -++ /** -++ * The language specific resource object for XPath messages. -++ */ -++ private static ListResourceBundle XPATHBundle = null; -++ /** -++ * The class name of the XPath error message string table. -++ */ -++ private static final String XPATH_ERROR_RESOURCES = -++ "com.sun.org.apache.xpath.internal.res.XPATHErrorResources"; -++ -++ /** -++ * Creates a message from the specified key and replacement arguments, -++ * localized to the given locale. -++ * -++ * @param msgKey The key for the message text. -++ * @param args The arguments to be used as replacement text in the message -++ * created. -++ * -++ * @return The formatted message string. -++ */ -++ public static final String createXPATHMessage(String msgKey, Object args[]) //throws Exception -+ { -+- return createXPATHMsg(XPATHBundle, msgKey, args); -+- } -+- else -+- return "Could not load any resource bundles."; -+- } -+- -+- /** -+- * Creates a message from the specified key and replacement -+- * arguments, localized to the given locale. -+- * -+- * @param msgKey The key for the message text. -+- * @param args The arguments to be used as replacement text -+- * in the message created. -+- * -+- * @return The formatted warning string. -+- */ -+- public static final String createXPATHWarning(String msgKey, Object args[]) //throws Exception -+- { -+- if (XPATHBundle == null) -+- XPATHBundle = loadResourceBundle(XPATH_ERROR_RESOURCES); -++ if (XPATHBundle == null) { -++ XPATHBundle = SecuritySupport.getResourceBundle(XPATH_ERROR_RESOURCES); -++ } -+ -+- if (XPATHBundle != null) -+- { -+- return createXPATHMsg(XPATHBundle, msgKey, args); -++ if (XPATHBundle != null) { -++ return createXPATHMsg(XPATHBundle, msgKey, args); -++ } else { -++ return "Could not load any resource bundles."; -++ } -+ } -+- else -+- return "Could not load any resource bundles."; -+- } -+- -+- /** -+- * Creates a message from the specified key and replacement -+- * arguments, localized to the given locale. -+- * -+- * @param fResourceBundle The resource bundle to use. -+- * @param msgKey The message key to use. -+- * @param args The arguments to be used as replacement text -+- * in the message created. -+- * -+- * @return The formatted message string. -+- */ -+- public static final String createXPATHMsg(ListResourceBundle fResourceBundle, -+- String msgKey, Object args[]) //throws Exception -+- { -+- -+- String fmsg = null; -+- boolean throwex = false; -+- String msg = null; -+- -+- if (msgKey != null) -+- msg = fResourceBundle.getString(msgKey); -+ -+- if (msg == null) -++ /** -++ * Creates a message from the specified key and replacement arguments, -++ * localized to the given locale. -++ * -++ * @param msgKey The key for the message text. -++ * @param args The arguments to be used as replacement text in the message -++ * created. -++ * -++ * @return The formatted warning string. -++ */ -++ public static final String createXPATHWarning(String msgKey, Object args[]) //throws Exception -+ { -+- msg = fResourceBundle.getString(XPATHErrorResources.BAD_CODE); -+- throwex = true; -++ if (XPATHBundle == null) { -++ XPATHBundle = SecuritySupport.getResourceBundle(XPATH_ERROR_RESOURCES); -++ } -++ -++ if (XPATHBundle != null) { -++ return createXPATHMsg(XPATHBundle, msgKey, args); -++ } else { -++ return "Could not load any resource bundles."; -++ } -+ } -+ -+- if (args != null) -++ /** -++ * Creates a message from the specified key and replacement arguments, -++ * localized to the given locale. -++ * -++ * @param fResourceBundle The resource bundle to use. -++ * @param msgKey The message key to use. -++ * @param args The arguments to be used as replacement text in the message -++ * created. -++ * -++ * @return The formatted message string. -++ */ -++ public static final String createXPATHMsg(ListResourceBundle fResourceBundle, -++ String msgKey, Object args[]) //throws Exception -+ { -+- try -+- { -+ -+- // Do this to keep format from crying. -+- // This is better than making a bunch of conditional -+- // code all over the place. -+- int n = args.length; -+- -+- for (int i = 0; i < n; i++) -+- { -+- if (null == args[i]) -+- args[i] = ""; -+- } -+- -+- fmsg = java.text.MessageFormat.format(msg, args); -+- } -+- catch (Exception e) -+- { -+- fmsg = fResourceBundle.getString(XPATHErrorResources.FORMAT_FAILED); -+- fmsg += " " + msg; -+- } -+- } -+- else -+- fmsg = msg; -++ String fmsg = null; -++ boolean throwex = false; -++ String msg = null; -+ -+- if (throwex) -+- { -+- throw new RuntimeException(fmsg); -+- } -++ if (msgKey != null) { -++ msg = fResourceBundle.getString(msgKey); -++ } -++ -++ if (msg == null) { -++ msg = fResourceBundle.getString(XPATHErrorResources.BAD_CODE); -++ throwex = true; -++ } -+ -+- return fmsg; -+- } -++ if (args != null) { -++ try { -+ -++ // Do this to keep format from crying. -++ // This is better than making a bunch of conditional -++ // code all over the place. -++ int n = args.length; -++ -++ for (int i = 0; i < n; i++) { -++ if (null == args[i]) { -++ args[i] = ""; -++ } -++ } -++ -++ fmsg = java.text.MessageFormat.format(msg, args); -++ } catch (Exception e) { -++ fmsg = fResourceBundle.getString(XPATHErrorResources.FORMAT_FAILED); -++ fmsg += " " + msg; -++ } -++ } else { -++ fmsg = msg; -++ } -++ -++ if (throwex) { -++ throw new RuntimeException(fmsg); -++ } -++ -++ return fmsg; -++ } -+ } -+--- src/com/sun/xml/internal/stream/writers/WriterUtility.java 2013-04-16 14:28:09.780157389 +0100 -++++ src/com/sun/xml/internal/stream/writers/WriterUtility.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -32,6 +32,7 @@ -+ import java.nio.charset.Charset; -+ import java.nio.charset.CharsetEncoder; -+ import com.sun.org.apache.xerces.internal.util.XMLChar; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ -+ /** -+ * Implements common xml writer functions. -+@@ -240,7 +241,7 @@ -+ -+ private CharsetEncoder getDefaultEncoder(){ -+ try{ -+- String encoding = System.getProperty("file.encoding"); -++ String encoding = SecuritySupport.getSystemProperty("file.encoding"); -+ if(encoding != null){ -+ return Charset.forName(encoding).newEncoder(); -+ } -+--- src/com/sun/xml/internal/stream/writers/XMLStreamWriterImpl.java 2013-04-16 14:28:09.780157389 +0100 -++++ src/com/sun/xml/internal/stream/writers/XMLStreamWriterImpl.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -53,6 +53,7 @@ -+ import com.sun.org.apache.xerces.internal.impl.PropertyManager; -+ import com.sun.org.apache.xerces.internal.util.NamespaceSupport; -+ import com.sun.org.apache.xerces.internal.util.SymbolTable; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ import com.sun.org.apache.xerces.internal.xni.QName; -+ -+ import com.sun.xml.internal.stream.util.ReadOnlyIterator; -+@@ -339,7 +340,7 @@ -+ fEncoder = Charset.forName(encoding).newEncoder(); -+ } -+ } else { -+- encoding = System.getProperty("file.encoding"); -++ encoding = SecuritySupport.getSystemProperty("file.encoding"); -+ if (encoding != null && encoding.equalsIgnoreCase("utf-8")) { -+ fWriter = new UTF8OutputStreamWriter(os); -+ } else { -+--- src/com/sun/xml/internal/stream/XMLEntityStorage.java 2013-04-16 14:28:09.772157260 +0100 -++++ src/com/sun/xml/internal/stream/XMLEntityStorage.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -36,6 +36,7 @@ -+ import com.sun.org.apache.xerces.internal.impl.PropertyManager; -+ import com.sun.org.apache.xerces.internal.impl.XMLErrorReporter; -+ import com.sun.org.apache.xerces.internal.impl.Constants; -++import com.sun.org.apache.xerces.internal.utils.SecuritySupport; -+ -+ /** -+ * -+@@ -410,7 +411,7 @@ -+ // get the user.dir property -+ String userDir = ""; -+ try { -+- userDir = System.getProperty("user.dir"); -++ userDir = SecuritySupport.getSystemProperty("user.dir"); -+ } -+ catch (SecurityException se) { -+ } -+--- src/javax/xml/datatype/FactoryFinder.java 2013-04-16 14:28:09.784157453 +0100 -++++ src/javax/xml/datatype/FactoryFinder.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -44,6 +44,7 @@ -+ * @author Santiago.PericasGeertsen@sun.com -+ */ -+ class FactoryFinder { -++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal"; -+ -+ /** -+ * Internal debug flag. -+@@ -95,18 +96,24 @@ -+ * If the class loader supplied is <code>null</code>, first try using the -+ * context class loader followed by the current (i.e. bootstrap) class -+ * loader. -++ * -++ * Use bootstrap classLoader if cl = null and useBSClsLoader is true -+ */ -+ static private Class getProviderClass(String className, ClassLoader cl, -+- boolean doFallback) throws ClassNotFoundException -++ boolean doFallback, boolean useBSClsLoader) throws ClassNotFoundException -+ { -+ try { -+ if (cl == null) { -+- cl = ss.getContextClassLoader(); -+- if (cl == null) { -+- throw new ClassNotFoundException(); -+- } -+- else { -+- return cl.loadClass(className); -++ if (useBSClsLoader) { -++ return Class.forName(className, true, FactoryFinder.class.getClassLoader()); -++ } else { -++ cl = ss.getContextClassLoader(); -++ if (cl == null) { -++ throw new ClassNotFoundException(); -++ } -++ else { -++ return cl.loadClass(className); -++ } -+ } -+ } -+ else { -+@@ -131,8 +138,8 @@ -+ * @param className Name of the concrete class corresponding to the -+ * service provider -+ * -+- * @param cl ClassLoader to use to load the class, null means to use -+- * the bootstrap ClassLoader -++ * @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code> -++ * current <code>Thread</code>'s context classLoader is used to load the factory class. -+ * -+ * @param doFallback True if the current ClassLoader should be tried as -+ * a fallback if the class is not found using cl -+@@ -140,8 +147,38 @@ -+ static Object newInstance(String className, ClassLoader cl, boolean doFallback) -+ throws ConfigurationError -+ { -++ return newInstance(className, cl, doFallback, false); -++ } -++ -++ /** -++ * Create an instance of a class. Delegates to method -++ * <code>getProviderClass()</code> in order to load the class. -++ * -++ * @param className Name of the concrete class corresponding to the -++ * service provider -++ * -++ * @param cl ClassLoader to use to load the class, null means to use -++ * the bootstrap ClassLoader -++ * -++ * @param doFallback True if the current ClassLoader should be tried as -++ * a fallback if the class is not found using cl -++ * -++ * @param useBSClsLoader True if cl=null actually meant bootstrap classLoader. This parameter -++ * is needed since DocumentBuilderFactory/SAXParserFactory defined null as context classLoader. -++ */ -++ static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader) -++ throws ConfigurationError -++ { -++ // make sure we have access to restricted packages -++ if (System.getSecurityManager() != null) { -++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) { -++ cl = null; -++ useBSClsLoader = true; -++ } -++ } -++ -+ try { -+- Class providerClass = getProviderClass(className, cl, doFallback); -++ Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader); -+ Object instance = providerClass.newInstance(); -+ if (debug) { // Extra check to avoid computing cl strings -+ dPrint("created new instance of " + providerClass + -+@@ -244,6 +281,7 @@ -+ -+ // First try the Context ClassLoader -+ ClassLoader cl = ss.getContextClassLoader(); -++ boolean useBSClsLoader = false; -+ if (cl != null) { -+ is = ss.getResourceAsStream(cl, serviceId); -+ -+@@ -251,11 +289,13 @@ -+ if (is == null) { -+ cl = FactoryFinder.class.getClassLoader(); -+ is = ss.getResourceAsStream(cl, serviceId); -++ useBSClsLoader = true; -+ } -+ } else { -+ // No Context ClassLoader, try the current ClassLoader -+ cl = FactoryFinder.class.getClassLoader(); -+ is = ss.getResourceAsStream(cl, serviceId); -++ useBSClsLoader = true; -+ } -+ -+ if (is == null) { -+@@ -293,7 +333,7 @@ -+ // ClassLoader because we want to avoid the case where the -+ // resource file was found using one ClassLoader and the -+ // provider class was instantiated using a different one. -+- return newInstance(factoryClassName, cl, false); -++ return newInstance(factoryClassName, cl, false, useBSClsLoader); -+ } -+ -+ // No provider found -+--- src/javax/xml/stream/FactoryFinder.java 2013-04-16 14:28:09.788157518 +0100 -++++ src/javax/xml/stream/FactoryFinder.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -25,14 +25,12 @@ -+ -+ package javax.xml.stream; -+ -+-import java.io.InputStream; -+-import java.io.IOException; -+-import java.io.File; -+-import java.io.FileInputStream; -+- -+-import java.util.Properties; -+ import java.io.BufferedReader; -++import java.io.File; -++import java.io.IOException; -++import java.io.InputStream; -+ import java.io.InputStreamReader; -++import java.util.Properties; -+ -+ /** -+ * <p>Implements pluggable Datatypes.</p> -+@@ -43,6 +41,8 @@ -+ * @author Santiago.PericasGeertsen@sun.com -+ */ -+ class FactoryFinder { -++ // Check we have access to package. -++ private static final String DEFAULT_PACKAGE = "com.sun.xml.internal."; -+ -+ /** -+ * Internal debug flag. -+@@ -94,18 +94,24 @@ -+ * If the class loader supplied is <code>null</code>, first try using the -+ * context class loader followed by the current (i.e. bootstrap) class -+ * loader. -++ * -++ * Use bootstrap classLoader if cl = null and useBSClsLoader is true -+ */ -+ static private Class getProviderClass(String className, ClassLoader cl, -+- boolean doFallback) throws ClassNotFoundException -++ boolean doFallback, boolean useBSClsLoader) throws ClassNotFoundException -+ { -+ try { -+ if (cl == null) { -+- cl = ss.getContextClassLoader(); -+- if (cl == null) { -+- throw new ClassNotFoundException(); -+- } -+- else { -+- return cl.loadClass(className); -++ if (useBSClsLoader) { -++ return Class.forName(className, true, FactoryFinder.class.getClassLoader()); -++ } else { -++ cl = ss.getContextClassLoader(); -++ if (cl == null) { -++ throw new ClassNotFoundException(); -++ } -++ else { -++ return cl.loadClass(className); -++ } -+ } -+ } -+ else { -+@@ -130,8 +136,8 @@ -+ * @param className Name of the concrete class corresponding to the -+ * service provider -+ * -+- * @param cl ClassLoader to use to load the class, null means to use -+- * the bootstrap ClassLoader -++ * @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code> -++ * current <code>Thread</code>'s context classLoader is used to load the factory class. -+ * -+ * @param doFallback True if the current ClassLoader should be tried as -+ * a fallback if the class is not found using cl -+@@ -139,8 +145,38 @@ -+ static Object newInstance(String className, ClassLoader cl, boolean doFallback) -+ throws ConfigurationError -+ { -++ return newInstance(className, cl, doFallback, false); -++ } -++ -++ /** -++ * Create an instance of a class. Delegates to method -++ * <code>getProviderClass()</code> in order to load the class. -++ * -++ * @param className Name of the concrete class corresponding to the -++ * service provider -++ * -++ * @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code> -++ * current <code>Thread</code>'s context classLoader is used to load the factory class. -++ * -++ * @param doFallback True if the current ClassLoader should be tried as -++ * a fallback if the class is not found using cl -++ * -++ * @param useBSClsLoader True if cl=null actually meant bootstrap classLoader. This parameter -++ * is needed since DocumentBuilderFactory/SAXParserFactory defined null as context classLoader. -++ */ -++ static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader) -++ throws ConfigurationError -++ { -++ // make sure we have access to restricted packages -++ if (System.getSecurityManager() != null) { -++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) { -++ cl = null; -++ useBSClsLoader = true; -++ } -++ } -++ -+ try { -+- Class providerClass = getProviderClass(className, cl, doFallback); -++ Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader); -+ Object instance = providerClass.newInstance(); -+ if (debug) { // Extra check to avoid computing cl strings -+ dPrint("created new instance of " + providerClass + -+@@ -233,11 +269,11 @@ -+ if (ss.doesFileExist(f)) { -+ dPrint("Read properties file "+f); -+ cacheProps.load(ss.getFileInputStream(f)); -+- } -+- } -+ } -+ } -+ } -++ } -++ } -+ factoryClassName = cacheProps.getProperty(factoryId); -+ -+ if (factoryClassName != null) { -+@@ -276,6 +312,7 @@ -+ -+ // First try the Context ClassLoader -+ ClassLoader cl = ss.getContextClassLoader(); -++ boolean useBSClsLoader = false; -+ if (cl != null) { -+ is = ss.getResourceAsStream(cl, serviceId); -+ -+@@ -283,11 +320,13 @@ -+ if (is == null) { -+ cl = FactoryFinder.class.getClassLoader(); -+ is = ss.getResourceAsStream(cl, serviceId); -++ useBSClsLoader = true; -+ } -+ } else { -+ // No Context ClassLoader, try the current ClassLoader -+ cl = FactoryFinder.class.getClassLoader(); -+ is = ss.getResourceAsStream(cl, serviceId); -++ useBSClsLoader = true; -+ } -+ -+ if (is == null) { -+@@ -325,7 +364,7 @@ -+ // ClassLoader because we want to avoid the case where the -+ // resource file was found using one ClassLoader and the -+ // provider class was instantiated using a different one. -+- return newInstance(factoryClassName, cl, false); -++ return newInstance(factoryClassName, cl, false, useBSClsLoader); -+ } -+ -+ // No provider found -+--- src/javax/xml/validation/SchemaFactoryFinder.java 2013-04-16 14:28:09.800157711 +0100 -++++ src/javax/xml/validation/SchemaFactoryFinder.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -53,6 +53,7 @@ -+ *<p> Take care of restrictions imposed by java security model </p> -+ */ -+ private static SecuritySupport ss = new SecuritySupport(); -++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal"; -+ /** -+ * <p>Cache properties for performance.</p> -+ */ -+@@ -212,28 +213,6 @@ -+ } -+ } -+ -+- /** -+- // try to read from $java.home/lib/jaxp.properties -+- try { -+- String javah = ss.getSystemProperty( "java.home" ); -+- String configFile = javah + File.separator + -+- "lib" + File.separator + "jaxp.properties"; -+- File f = new File( configFile ); -+- if( ss.doesFileExist(f)) { -+- sf = loadFromProperty( -+- propertyName,f.getAbsolutePath(), new FileInputStream(f)); -+- if(sf!=null) return sf; -+- } else { -+- debugPrintln("Tried to read "+ f.getAbsolutePath()+", but it doesn't exist."); -+- } -+- } catch(Throwable e) { -+- if( debug ) { -+- debugPrintln("failed to read $java.home/lib/jaxp.properties"); -+- e.printStackTrace(); -+- } -+- } -+- */ -+- -+ // try META-INF/services files -+ Iterator sitr = createServiceFileIterator(); -+ while(sitr.hasNext()) { -+@@ -268,14 +247,20 @@ -+ */ -+ private Class createClass(String className) { -+ Class clazz; -++ // make sure we have access to restricted packages -++ boolean internal = false; -++ if (System.getSecurityManager() != null) { -++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) { -++ internal = true; -++ } -++ } -+ -+- // use approprite ClassLoader -+ try { -+- if (classLoader != null) { -+- clazz = classLoader.loadClass(className); -+- } else { -+- clazz = Class.forName(className); -+- } -++ if (classLoader != null && !internal) { -++ clazz = classLoader.loadClass(className); -++ } else { -++ clazz = Class.forName(className); -++ } -+ } catch (Throwable t) { -+ if(debug) t.printStackTrace(); -+ return null; -+--- src/javax/xml/xpath/XPathFactoryFinder.java 2013-04-16 14:28:09.800157711 +0100 -++++ src/javax/xml/xpath/XPathFactoryFinder.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -47,6 +47,7 @@ -+ * @since 1.5 -+ */ -+ class XPathFactoryFinder { -++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xpath.internal"; -+ -+ private static SecuritySupport ss = new SecuritySupport() ; -+ /** debug support code. */ -+@@ -245,18 +246,25 @@ -+ */ -+ private Class createClass(String className) { -+ Class clazz; -+- -+- // use approprite ClassLoader -+- try { -+- if (classLoader != null) { -+- clazz = classLoader.loadClass(className); -+- } else { -+- clazz = Class.forName(className); -+- } -+- } catch (Throwable t) { -+- if(debug) t.printStackTrace(); -+- return null; -++ // make sure we have access to restricted packages -++ boolean internal = false; -++ if (System.getSecurityManager() != null) { -++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) { -++ internal = true; -+ } -++ } -++ -++ // use approprite ClassLoader -++ try { -++ if (classLoader != null && !internal) { -++ clazz = classLoader.loadClass(className); -++ } else { -++ clazz = Class.forName(className); -++ } -++ } catch (Throwable t) { -++ if(debug) t.printStackTrace(); -++ return null; -++ } -+ -+ return clazz; -+ } -+--- src/org/w3c/dom/bootstrap/DOMImplementationRegistry.java 2013-04-16 14:28:09.808157841 +0100 -++++ src/org/w3c/dom/bootstrap/DOMImplementationRegistry.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -104,6 +104,8 @@ -+ */ -+ private static final String FALLBACK_CLASS = -+ "com.sun.org.apache.xerces.internal.dom.DOMXSImplementationSourceImpl"; -++ private static final String DEFAULT_PACKAGE = -++ "com.sun.org.apache.xerces.internal.dom"; -+ /** -+ * Private constructor. -+ * @param srcs Vector List of DOMImplementationSources -+@@ -168,10 +170,15 @@ -+ StringTokenizer st = new StringTokenizer(p); -+ while (st.hasMoreTokens()) { -+ String sourceName = st.nextToken(); -+- // Use context class loader, falling back to Class.forName -+- // if and only if this fails... -++ // make sure we have access to restricted packages -++ boolean internal = false; -++ if (System.getSecurityManager() != null) { -++ if (sourceName != null && sourceName.startsWith(DEFAULT_PACKAGE)) { -++ internal = true; -++ } -++ } -+ Class sourceClass = null; -+- if (classLoader != null) { -++ if (classLoader != null && !internal) { -+ sourceClass = classLoader.loadClass(sourceName); -+ } else { -+ sourceClass = Class.forName(sourceName); -+--- src/org/xml/sax/helpers/NewInstance.java 2013-04-16 14:28:09.832158226 +0100 -++++ src/org/xml/sax/helpers/NewInstance.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -54,9 +54,10 @@ -+ * including versions of Java 2.</p> -+ * -+ * @author Edwin Goei, David Brownell -++ * @version 2.0.1 (sax2r2) -+ */ -+ class NewInstance { -+- -++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal"; -+ /** -+ * Creates a new instance of the specified class name -+ * -+@@ -66,8 +67,16 @@ -+ throws ClassNotFoundException, IllegalAccessException, -+ InstantiationException -+ { -++ // make sure we have access to restricted packages -++ boolean internal = false; -++ if (System.getSecurityManager() != null) { -++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) { -++ internal = true; -++ } -++ } -++ -+ Class driverClass; -+- if (classLoader == null) { -++ if (classLoader == null || internal) { -+ driverClass = Class.forName(className); -+ } else { -+ driverClass = classLoader.loadClass(className); -+@@ -75,29 +84,4 @@ -+ return driverClass.newInstance(); -+ } -+ -+- /** -+- * Figure out which ClassLoader to use. For JDK 1.2 and later use -+- * the context ClassLoader. -+- */ -+- static ClassLoader getClassLoader () -+- { -+- Method m = null; -+- -+- try { -+- m = Thread.class.getMethod("getContextClassLoader", (Class[]) null); -+- } catch (NoSuchMethodException e) { -+- // Assume that we are running JDK 1.1, use the current ClassLoader -+- return NewInstance.class.getClassLoader(); -+- } -+- -+- try { -+- return (ClassLoader) m.invoke(Thread.currentThread(), (Object[]) null); -+- } catch (IllegalAccessException e) { -+- // assert(false) -+- throw new UnknownError(e.getMessage()); -+- } catch (InvocationTargetException e) { -+- // assert(e.getTargetException() instanceof SecurityException) -+- throw new UnknownError(e.getMessage()); -+- } -+- } -+ } -+--- src/org/xml/sax/helpers/ParserAdapter.java 2013-04-16 14:28:09.836158291 +0100 -++++ src/org/xml/sax/helpers/ParserAdapter.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -74,13 +74,14 @@ -+ * -+ * @since SAX 2.0 -+ * @author David Megginson -++ * @version 2.0.1 (sax2r2) -+ * @see org.xml.sax.helpers.XMLReaderAdapter -+ * @see org.xml.sax.XMLReader -+ * @see org.xml.sax.Parser -+ */ -+ public class ParserAdapter implements XMLReader, DocumentHandler -+ { -+- -++ private static SecuritySupport ss = new SecuritySupport(); -+ -+ //////////////////////////////////////////////////////////////////// -+ // Constructors. -+@@ -102,7 +103,7 @@ -+ { -+ super(); -+ -+- String driver = System.getProperty("org.xml.sax.parser"); -++ String driver = ss.getSystemProperty("org.xml.sax.parser"); -+ -+ try { -+ setup(ParserFactory.makeParser()); -+--- src/org/xml/sax/helpers/ParserFactory.java 2013-04-16 14:28:09.836158291 +0100 -++++ src/org/xml/sax/helpers/ParserFactory.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -30,12 +30,6 @@ -+ -+ package org.xml.sax.helpers; -+ -+-import java.lang.ClassNotFoundException; -+-import java.lang.IllegalAccessException; -+-import java.lang.InstantiationException; -+-import java.lang.SecurityException; -+-import java.lang.ClassCastException; -+- -+ import org.xml.sax.Parser; -+ -+ -+@@ -69,9 +63,10 @@ -+ * interface. -+ * @since SAX 1.0 -+ * @author David Megginson -++ * @version 2.0.1 (sax2r2) -+ */ -+ public class ParserFactory { -+- -++ private static SecuritySupport ss = new SecuritySupport(); -+ -+ /** -+ * Private null constructor. -+@@ -109,7 +104,7 @@ -+ NullPointerException, -+ ClassCastException -+ { -+- String className = System.getProperty("org.xml.sax.parser"); -++ String className = ss.getSystemProperty("org.xml.sax.parser"); -+ if (className == null) { -+ throw new NullPointerException("No value for sax.parser property"); -+ } else { -+@@ -146,7 +141,7 @@ -+ ClassCastException -+ { -+ return (Parser) NewInstance.newInstance ( -+- NewInstance.getClassLoader (), className); -++ ss.getContextClassLoader(), className); -+ } -+ -+ } -+--- src/org/xml/sax/helpers/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100 -++++ src/org/xml/sax/helpers/SecuritySupport.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -0,0 +1,108 @@ -++/* -++ * Copyright (c) 2004, 2006, Oracle and/or its affiliates. All rights reserved. -++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -++ * -++ * This code is free software; you can redistribute it and/or modify it -++ * under the terms of the GNU General Public License version 2 only, as -++ * published by the Free Software Foundation. Oracle designates this -++ * particular file as subject to the "Classpath" exception as provided -++ * by Oracle in the LICENSE file that accompanied this code. -++ * -++ * This code is distributed in the hope that it will be useful, but WITHOUT -++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -++ * version 2 for more details (a copy is included in the LICENSE file that -++ * accompanied this code). -++ * -++ * You should have received a copy of the GNU General Public License version -++ * 2 along with this work; if not, write to the Free Software Foundation, -++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -++ * -++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -++ * or visit www.oracle.com if you need additional information or have any -++ * questions. -++ */ -++ -++package org.xml.sax.helpers; -++ -++import java.io.*; -++import java.security.*; -++ -++/** -++ * This class is duplicated for each JAXP subpackage so keep it in sync. -++ * It is package private and therefore is not exposed as part of the JAXP -++ * API. -++ * -++ * Security related methods that only work on J2SE 1.2 and newer. -++ */ -++class SecuritySupport { -++ -++ -++ ClassLoader getContextClassLoader() throws SecurityException{ -++ return (ClassLoader) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ ClassLoader cl = null; -++ //try { -++ cl = Thread.currentThread().getContextClassLoader(); -++ //} catch (SecurityException ex) { } -++ -++ if (cl == null) -++ cl = ClassLoader.getSystemClassLoader(); -++ -++ return cl; -++ } -++ }); -++ } -++ -++ String getSystemProperty(final String propName) { -++ return (String) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return System.getProperty(propName); -++ } -++ }); -++ } -++ -++ FileInputStream getFileInputStream(final File file) -++ throws FileNotFoundException -++ { -++ try { -++ return (FileInputStream) -++ AccessController.doPrivileged(new PrivilegedExceptionAction() { -++ public Object run() throws FileNotFoundException { -++ return new FileInputStream(file); -++ } -++ }); -++ } catch (PrivilegedActionException e) { -++ throw (FileNotFoundException)e.getException(); -++ } -++ } -++ -++ InputStream getResourceAsStream(final ClassLoader cl, -++ final String name) -++ { -++ return (InputStream) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ InputStream ris; -++ if (cl == null) { -++ ris = Object.class.getResourceAsStream(name); -++ } else { -++ ris = cl.getResourceAsStream(name); -++ } -++ return ris; -++ } -++ }); -++ } -++ -++ boolean doesFileExist(final File f) { -++ return ((Boolean) -++ AccessController.doPrivileged(new PrivilegedAction() { -++ public Object run() { -++ return new Boolean(f.exists()); -++ } -++ })).booleanValue(); -++ } -++ -++} -+--- src/org/xml/sax/helpers/XMLReaderFactory.java 2013-04-16 14:28:09.836158291 +0100 -++++ src/org/xml/sax/helpers/XMLReaderFactory.java 2013-04-16 14:29:26.569394704 +0100 -+@@ -34,8 +34,6 @@ -+ import java.io.BufferedReader; -+ import java.io.InputStream; -+ import java.io.InputStreamReader; -+-import java.security.AccessController; -+-import java.security.PrivilegedAction; -+ import org.xml.sax.XMLReader; -+ import org.xml.sax.SAXException; -+ -+@@ -85,8 +83,8 @@ -+ } -+ -+ private static final String property = "org.xml.sax.driver"; -++ private static SecuritySupport ss = new SecuritySupport(); -+ -+- private static String _clsFromJar = null; -+ private static boolean _jarread = false; -+ /** -+ * Attempt to create an XMLReader from system defaults. -+@@ -134,43 +132,45 @@ -+ throws SAXException -+ { -+ String className = null; -+- ClassLoader loader = NewInstance.getClassLoader (); -++ ClassLoader cl = ss.getContextClassLoader(); -+ -+ // 1. try the JVM-instance-wide system property -+- try { className = System.getProperty (property); } -+- catch (RuntimeException e) { /* normally fails for applets */ } -++ try { -++ className = ss.getSystemProperty(property); -++ } -++ catch (RuntimeException e) { /* continue searching */ } -+ -+ // 2. if that fails, try META-INF/services/ -+ if (className == null) { -+ if (!_jarread) { -+- final ClassLoader loader1 = loader; -+ _jarread = true; -+- _clsFromJar = (String) -+- AccessController.doPrivileged(new PrivilegedAction() { -+- public Object run() { -+- String clsName = null; -+- try { -+- String service = "META-INF/services/" + property; -+- InputStream in; -+- BufferedReader reader; -+- if (loader1 == null) -+- in = ClassLoader.getSystemResourceAsStream (service); -+- else -+- in = loader1.getResourceAsStream (service); -+- -+- if (in != null) { -+- reader = new BufferedReader ( -+- new InputStreamReader (in, "UTF8")); -+- clsName = reader.readLine (); -+- in.close (); -+- } -+- } catch (Exception e) { -++ String service = "META-INF/services/" + property; -++ InputStream in; -++ BufferedReader reader; -++ -++ try { -++ if (cl != null) { -++ in = ss.getResourceAsStream(cl, service); -++ -++ // If no provider found then try the current ClassLoader -++ if (in == null) { -++ cl = null; -++ in = ss.getResourceAsStream(cl, service); -+ } -+- return clsName; -++ } else { -++ // No Context ClassLoader, try the current ClassLoader -++ in = ss.getResourceAsStream(cl, service); -+ } -+- }); -++ -++ if (in != null) { -++ reader = new BufferedReader ( -++ new InputStreamReader (in, "UTF8")); -++ className = reader.readLine (); -++ in.close (); -++ } -++ } catch (Exception e) { -++ } -+ } -+- className = _clsFromJar; -+ } -+ -+ // 3. Distro-specific fallback -+@@ -187,7 +187,7 @@ -+ -+ // do we know the XMLReader implementation class yet? -+ if (className != null) -+- return loadClass (loader, className); -++ return loadClass (cl, className); -+ -+ // 4. panic -- adapt any SAX1 parser -+ try { -+@@ -217,7 +217,7 @@ -+ public static XMLReader createXMLReader (String className) -+ throws SAXException -+ { -+- return loadClass (NewInstance.getClassLoader (), className); -++ return loadClass (ss.getContextClassLoader(), className); -+ } -+ -+ private static XMLReader loadClass (ClassLoader loader, String className) ---- jdk/src/share/lib/security/java.security 2013-04-16 14:28:12.392199476 +0100 -+++ jdk/src/share/lib/security/java.security 2013-04-16 14:29:26.545394318 +0100 -@@ -130,10 +130,27 @@ - package.access=sun.,\ - com.sun.xml.internal.bind.,\ - com.sun.xml.internal.org.jvnet.staxex.,\ -+ com.sun.xml.internal.stream.,\ - com.sun.xml.internal.ws.,\ - com.sun.imageio.,\ - com.sun.istack.internal.,\ -- com.sun.jmx. -+ com.sun.jmx.,\ -+ com.sun.org.apache.bcel.internal.,\ -+ com.sun.org.apache.regexp.internal.,\ -+ com.sun.org.apache.xerces.internal.,\ -+ com.sun.org.apache.xpath.internal.,\ -+ com.sun.org.apache.xalan.internal.extensions.,\ -+ com.sun.org.apache.xalan.internal.lib.,\ -+ com.sun.org.apache.xalan.internal.res.,\ -+ com.sun.org.apache.xalan.internal.templates.,\ -+ com.sun.org.apache.xalan.internal.xslt.,\ -+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ -+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ -+ com.sun.org.apache.xalan.internal.xsltc.trax.,\ -+ com.sun.org.apache.xalan.internal.xsltc.util.,\ -+ com.sun.org.apache.xml.internal.res.,\ -+ com.sun.org.apache.xml.internal.serializer.utils.,\ -+ com.sun.org.apache.xml.internal.utils. - - # - # List of comma-separated packages that start with or equal this string -@@ -148,10 +165,27 @@ - package.definition=sun.,\ - com.sun.xml.internal.bind.,\ - com.sun.xml.internal.org.jvnet.staxex.,\ -+ com.sun.xml.internal.stream.,\ - com.sun.xml.internal.ws.,\ - com.sun.imageio.,\ - com.sun.istack.internal.,\ -- com.sun.jmx. -+ com.sun.jmx.,\ -+ com.sun.org.apache.bcel.internal.,\ -+ com.sun.org.apache.regexp.internal.,\ -+ com.sun.org.apache.xerces.internal.,\ -+ com.sun.org.apache.xpath.internal.,\ -+ com.sun.org.apache.xalan.internal.extensions.,\ -+ com.sun.org.apache.xalan.internal.lib.,\ -+ com.sun.org.apache.xalan.internal.res.,\ -+ com.sun.org.apache.xalan.internal.templates.,\ -+ com.sun.org.apache.xalan.internal.xslt.,\ -+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ -+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ -+ com.sun.org.apache.xalan.internal.xsltc.trax.,\ -+ com.sun.org.apache.xalan.internal.xsltc.util.,\ -+ com.sun.org.apache.xml.internal.res.,\ -+ com.sun.org.apache.xml.internal.serializer.utils.,\ -+ com.sun.org.apache.xml.internal.utils. - - # - # Determines whether this properties file can be appended to ---- jdk/src/share/lib/security/java.security-solaris 2013-04-16 14:28:12.396199540 +0100 -+++ jdk/src/share/lib/security/java.security-solaris 2013-04-16 14:30:42.026610629 +0100 -@@ -131,10 +131,27 @@ - package.access=sun.,\ - com.sun.xml.internal.bind.,\ - com.sun.xml.internal.org.jvnet.staxex.,\ -+ com.sun.xml.internal.stream.,\ - com.sun.xml.internal.ws.,\ - com.sun.imageio. - com.sun.istack.internal.,\ -- com.sun.jmx. -+ com.sun.jmx.,\ -+ com.sun.org.apache.bcel.internal.,\ -+ com.sun.org.apache.regexp.internal.,\ -+ com.sun.org.apache.xerces.internal.,\ -+ com.sun.org.apache.xpath.internal.,\ -+ com.sun.org.apache.xalan.internal.extensions.,\ -+ com.sun.org.apache.xalan.internal.lib.,\ -+ com.sun.org.apache.xalan.internal.res.,\ -+ com.sun.org.apache.xalan.internal.templates.,\ -+ com.sun.org.apache.xalan.internal.xslt.,\ -+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ -+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ -+ com.sun.org.apache.xalan.internal.xsltc.trax.,\ -+ com.sun.org.apache.xalan.internal.xsltc.util.,\ -+ com.sun.org.apache.xml.internal.res.,\ -+ com.sun.org.apache.xml.internal.serializer.utils.,\ -+ com.sun.org.apache.xml.internal.utils. - - # - # List of comma-separated packages that start with or equal this string -@@ -149,10 +166,27 @@ - package.definition=sun.,\ - com.sun.xml.internal.bind.,\ - com.sun.xml.internal.org.jvnet.staxex.,\ -+ com.sun.xml.internal.stream.,\ - com.sun.xml.internal.ws.,\ - com.sun.imageio. - com.sun.istack.internal.,\ -- com.sun.jmx. -+ com.sun.jmx.,\ -+ com.sun.org.apache.bcel.internal.,\ -+ com.sun.org.apache.regexp.internal.,\ -+ com.sun.org.apache.xerces.internal.,\ -+ com.sun.org.apache.xpath.internal.,\ -+ com.sun.org.apache.xalan.internal.extensions.,\ -+ com.sun.org.apache.xalan.internal.lib.,\ -+ com.sun.org.apache.xalan.internal.res.,\ -+ com.sun.org.apache.xalan.internal.templates.,\ -+ com.sun.org.apache.xalan.internal.xslt.,\ -+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ -+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ -+ com.sun.org.apache.xalan.internal.xsltc.trax.,\ -+ com.sun.org.apache.xalan.internal.xsltc.util.,\ -+ com.sun.org.apache.xml.internal.res.,\ -+ com.sun.org.apache.xml.internal.serializer.utils.,\ -+ com.sun.org.apache.xml.internal.utils. - - # - # Determines whether this properties file can be appended to ---- jdk/src/share/lib/security/java.security-windows 2013-04-16 14:28:12.396199540 +0100 -+++ jdk/src/share/lib/security/java.security-windows 2013-04-16 14:31:35.027464728 +0100 -@@ -131,10 +131,27 @@ - package.access=sun.,\ - com.sun.xml.internal.bind.,\ - com.sun.xml.internal.org.jvnet.staxex.,\ -+ com.sun.xml.internal.stream.,\ - com.sun.xml.internal.ws.,\ - com.sun.imageio. - com.sun.istack.internal.,\ -- com.sun.jmx. -+ com.sun.jmx.,\ -+ com.sun.org.apache.bcel.internal.,\ -+ com.sun.org.apache.regexp.internal.,\ -+ com.sun.org.apache.xerces.internal.,\ -+ com.sun.org.apache.xpath.internal.,\ -+ com.sun.org.apache.xalan.internal.extensions.,\ -+ com.sun.org.apache.xalan.internal.lib.,\ -+ com.sun.org.apache.xalan.internal.res.,\ -+ com.sun.org.apache.xalan.internal.templates.,\ -+ com.sun.org.apache.xalan.internal.xslt.,\ -+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ -+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ -+ com.sun.org.apache.xalan.internal.xsltc.trax.,\ -+ com.sun.org.apache.xalan.internal.xsltc.util.,\ -+ com.sun.org.apache.xml.internal.res.,\ -+ com.sun.org.apache.xml.internal.serializer.utils.,\ -+ com.sun.org.apache.xml.internal.utils. - - # - # List of comma-separated packages that start with or equal this string -@@ -149,10 +166,27 @@ - package.definition=sun.,\ - com.sun.xml.internal.bind.,\ - com.sun.xml.internal.org.jvnet.staxex.,\ -+ com.sun.xml.internal.stream.,\ - com.sun.xml.internal.ws.,\ - com.sun.imageio. - com.sun.istack.internal.,\ -- com.sun.jmx. -+ com.sun.jmx.,\ -+ com.sun.org.apache.bcel.internal.,\ -+ com.sun.org.apache.regexp.internal.,\ -+ com.sun.org.apache.xerces.internal.,\ -+ com.sun.org.apache.xpath.internal.,\ -+ com.sun.org.apache.xalan.internal.extensions.,\ -+ com.sun.org.apache.xalan.internal.lib.,\ -+ com.sun.org.apache.xalan.internal.res.,\ -+ com.sun.org.apache.xalan.internal.templates.,\ -+ com.sun.org.apache.xalan.internal.xslt.,\ -+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\ -+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\ -+ com.sun.org.apache.xalan.internal.xsltc.trax.,\ -+ com.sun.org.apache.xalan.internal.xsltc.util.,\ -+ com.sun.org.apache.xml.internal.res.,\ -+ com.sun.org.apache.xml.internal.serializer.utils.,\ -+ com.sun.org.apache.xml.internal.utils. - - # - # Determines whether this properties file can be appended to |