(String,Exception)
++
++ //
++ // methods
++ //
++
++ /** Returns the exception associated to this error. */
++ public Exception getException() {
++ return exception;
++ } // getException():Exception
++
++} // class ConfigurationError
+--- src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java 1970-01-01 01:00:00.000000000 +0100
++++ src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java 2013-04-16 14:29:26.557394511 +0100
+@@ -0,0 +1,436 @@
++/*
++ * reserved comment block
++ * DO NOT REMOVE OR ALTER!
++ */
++/*
++ * Copyright 2001-2005 The Apache Software Foundation.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.sun.org.apache.xerces.internal.utils;
++
++import java.io.InputStream;
++import java.io.IOException;
++import java.io.File;
++import java.io.FileInputStream;
++
++import java.util.Properties;
++import java.io.BufferedReader;
++import java.io.InputStreamReader;
++
++/**
++ * This class is duplicated for each JAXP subpackage so keep it in sync.
++ * It is package private and therefore is not exposed as part of the JAXP
++ * API.
++ *
++ * This code is designed to implement the JAXP 1.1 spec pluggability
++ * feature and is designed to run on JDK version 1.1 and
++ * later, and to compile on JDK 1.2 and onward.
++ * The code also runs both as part of an unbundled jar file and
++ * when bundled as part of the JDK.
++ *
++ *
++ * @version $Id: ObjectFactory.java,v 1.6 2010/04/23 01:44:34 joehw Exp $
++ */
++public final class ObjectFactory {
++
++ //
++ // Constants
++ //
++ private static final String DEFAULT_INTERNAL_CLASSES = "com.sun.org.apache.";
++
++ // name of default properties file to look for in JDK's jre/lib directory
++ private static final String DEFAULT_PROPERTIES_FILENAME = "xerces.properties";
++
++ /** Set to true for debugging */
++ private static final boolean DEBUG = isDebugEnabled();
++
++ /**
++ * Default columns per line.
++ */
++ private static final int DEFAULT_LINE_LENGTH = 80;
++
++ /** cache the contents of the xerces.properties file.
++ * Until an attempt has been made to read this file, this will
++ * be null; if the file does not exist or we encounter some other error
++ * during the read, this will be empty.
++ */
++ private static Properties fXercesProperties = null;
++
++ /***
++ * Cache the time stamp of the xerces.properties file so
++ * that we know if it's been modified and can invalidate
++ * the cache when necessary.
++ */
++ private static long fLastModified = -1;
++
++ //
++ // static methods
++ //
++
++ /**
++ * Finds the implementation Class object in the specified order. The
++ * specified order is the following:
++ *
++ * - query the system property using
System.getProperty
++ * - read
META-INF/services/factoryId file
++ * - use fallback classname
++ *
++ *
++ * @return Class object of factory, never null
++ *
++ * @param factoryId Name of the factory to find, same as
++ * a property name
++ * @param fallbackClassName Implementation class name, if nothing else
++ * is found. Use null to mean no fallback.
++ *
++ * @exception ObjectFactory.ConfigurationError
++ */
++ public static Object createObject(String factoryId, String fallbackClassName)
++ throws ConfigurationError {
++ return createObject(factoryId, null, fallbackClassName);
++ } // createObject(String,String):Object
++
++ /**
++ * Finds the implementation Class object in the specified order. The
++ * specified order is the following:
++ *
++ * - query the system property using
System.getProperty
++ * - read
$java.home/lib/propertiesFilename file
++ * - read
META-INF/services/factoryId file
++ * - use fallback classname
++ *
++ *
++ * @return Class object of factory, never null
++ *
++ * @param factoryId Name of the factory to find, same as
++ * a property name
++ * @param propertiesFilename The filename in the $java.home/lib directory
++ * of the properties file. If none specified,
++ * ${java.home}/lib/xerces.properties will be used.
++ * @param fallbackClassName Implementation class name, if nothing else
++ * is found. Use null to mean no fallback.
++ *
++ * @exception ObjectFactory.ConfigurationError
++ */
++ public static Object createObject(String factoryId,
++ String propertiesFilename,
++ String fallbackClassName)
++ throws ConfigurationError
++ {
++ if (DEBUG) debugPrintln("debug is on");
++
++ ClassLoader cl = findClassLoader();
++
++ // Use the system property first
++ try {
++ String systemProp = SecuritySupport.getSystemProperty(factoryId);
++ if (systemProp != null && systemProp.length() > 0) {
++ if (DEBUG) debugPrintln("found system property, value=" + systemProp);
++ return newInstance(systemProp, cl, true);
++ }
++ } catch (SecurityException se) {
++ // Ignore and continue w/ next location
++ }
++
++ // JAXP specific change
++ // always use fallback class to avoid the expense of constantly
++ // "stat"ing a non-existent "xerces.properties" and jar SPI entry
++ // see CR 6400863: Expensive creating of SAX parser in Mustang
++ if (fallbackClassName == null) {
++ throw new ConfigurationError(
++ "Provider for " + factoryId + " cannot be found", null);
++ }
++
++ if (DEBUG) debugPrintln("using fallback, value=" + fallbackClassName);
++ return newInstance(fallbackClassName, cl, true);
++
++ } // createObject(String,String,String):Object
++
++ //
++ // Private static methods
++ //
++
++ /** Returns true if debug has been enabled. */
++ private static boolean isDebugEnabled() {
++ try {
++ String val = SecuritySupport.getSystemProperty("xerces.debug");
++ // Allow simply setting the prop to turn on debug
++ return (val != null && (!"false".equals(val)));
++ }
++ catch (SecurityException se) {}
++ return false;
++ } // isDebugEnabled()
++
++ /** Prints a message to standard error if debugging is enabled. */
++ private static void debugPrintln(String msg) {
++ if (DEBUG) {
++ System.err.println("XERCES: " + msg);
++ }
++ } // debugPrintln(String)
++
++ /**
++ * Figure out which ClassLoader to use. For JDK 1.2 and later use
++ * the context ClassLoader.
++ */
++ public static ClassLoader findClassLoader()
++ throws ConfigurationError
++ {
++ if (System.getSecurityManager()!=null) {
++ //this will ensure bootclassloader is used
++ return null;
++ }
++ // Figure out which ClassLoader to use for loading the provider
++ // class. If there is a Context ClassLoader then use it.
++ ClassLoader context = SecuritySupport.getContextClassLoader();
++ ClassLoader system = SecuritySupport.getSystemClassLoader();
++
++ ClassLoader chain = system;
++ while (true) {
++ if (context == chain) {
++ // Assert: we are on JDK 1.1 or we have no Context ClassLoader
++ // or any Context ClassLoader in chain of system classloader
++ // (including extension ClassLoader) so extend to widest
++ // ClassLoader (always look in system ClassLoader if Xerces
++ // is in boot/extension/system classpath and in current
++ // ClassLoader otherwise); normal classloaders delegate
++ // back to system ClassLoader first so this widening doesn't
++ // change the fact that context ClassLoader will be consulted
++ ClassLoader current = ObjectFactory.class.getClassLoader();
++
++ chain = system;
++ while (true) {
++ if (current == chain) {
++ // Assert: Current ClassLoader in chain of
++ // boot/extension/system ClassLoaders
++ return system;
++ }
++ if (chain == null) {
++ break;
++ }
++ chain = SecuritySupport.getParentClassLoader(chain);
++ }
++
++ // Assert: Current ClassLoader not in chain of
++ // boot/extension/system ClassLoaders
++ return current;
++ }
++
++ if (chain == null) {
++ // boot ClassLoader reached
++ break;
++ }
++
++ // Check for any extension ClassLoaders in chain up to
++ // boot ClassLoader
++ chain = SecuritySupport.getParentClassLoader(chain);
++ };
++
++ // Assert: Context ClassLoader not in chain of
++ // boot/extension/system ClassLoaders
++ return context;
++ } // findClassLoader():ClassLoader
++
++ /**
++ * Create an instance of a class using the same classloader for the ObjectFactory by default
++ * or bootclassloader when Security Manager is in place
++ */
++ public static Object newInstance(String className, boolean doFallback)
++ throws ConfigurationError
++ {
++ if (System.getSecurityManager()!=null) {
++ return newInstance(className, null, doFallback);
++ } else {
++ return newInstance(className,
++ findClassLoader (), doFallback);
++ }
++ }
++
++ /**
++ * Create an instance of a class using the specified ClassLoader
++ */
++ public static Object newInstance(String className, ClassLoader cl,
++ boolean doFallback)
++ throws ConfigurationError
++ {
++ // assert(className != null);
++ try{
++ Class providerClass = findProviderClass(className, cl, doFallback);
++ Object instance = providerClass.newInstance();
++ if (DEBUG) debugPrintln("created new instance of " + providerClass +
++ " using ClassLoader: " + cl);
++ return instance;
++ } catch (ClassNotFoundException x) {
++ throw new ConfigurationError(
++ "Provider " + className + " not found", x);
++ } catch (Exception x) {
++ throw new ConfigurationError(
++ "Provider " + className + " could not be instantiated: " + x,
++ x);
++ }
++ }
++
++ /**
++ * Find a Class using the same classloader for the ObjectFactory by default
++ * or bootclassloader when Security Manager is in place
++ */
++ public static Class findProviderClass(String className, boolean doFallback)
++ throws ClassNotFoundException, ConfigurationError
++ {
++ if (System.getSecurityManager()!=null) {
++ return Class.forName(className);
++ } else {
++ return findProviderClass (className,
++ findClassLoader (), doFallback);
++ }
++ }
++ /**
++ * Find a Class using the specified ClassLoader
++ */
++ public static Class findProviderClass(String className, ClassLoader cl,
++ boolean doFallback)
++ throws ClassNotFoundException, ConfigurationError
++ {
++ //throw security exception if the calling thread is not allowed to access the package
++ //restrict the access to package as speicified in java.security policy
++ SecurityManager security = System.getSecurityManager();
++ if (security != null) {
++ if (className.startsWith(DEFAULT_INTERNAL_CLASSES)) {
++ cl = null;
++ } else {
++ final int lastDot = className.lastIndexOf(".");
++ String packageName = className;
++ if (lastDot != -1) packageName = className.substring(0, lastDot);
++ security.checkPackageAccess(packageName);
++ }
++ }
++ Class providerClass;
++ if (cl == null) {
++ //use the bootstrap ClassLoader.
++ providerClass = Class.forName(className);
++ } else {
++ try {
++ providerClass = cl.loadClass(className);
++ } catch (ClassNotFoundException x) {
++ if (doFallback) {
++ // Fall back to current classloader
++ ClassLoader current = ObjectFactory.class.getClassLoader();
++ if (current == null) {
++ providerClass = Class.forName(className);
++ } else if (cl != current) {
++ cl = current;
++ providerClass = cl.loadClass(className);
++ } else {
++ throw x;
++ }
++ } else {
++ throw x;
++ }
++ }
++ }
++
++ return providerClass;
++ }
++
++ /*
++ * Try to find provider using Jar Service Provider Mechanism
++ *
++ * @return instance of provider class if found or null
++ */
++ private static Object findJarServiceProvider(String factoryId)
++ throws ConfigurationError
++ {
++ String serviceId = "META-INF/services/" + factoryId;
++ InputStream is = null;
++
++ // First try the Context ClassLoader
++ ClassLoader cl = findClassLoader();
++
++ is = SecuritySupport.getResourceAsStream(cl, serviceId);
++
++ // If no provider found then try the current ClassLoader
++ if (is == null) {
++ ClassLoader current = ObjectFactory.class.getClassLoader();
++ if (cl != current) {
++ cl = current;
++ is = SecuritySupport.getResourceAsStream(cl, serviceId);
++ }
++ }
++
++ if (is == null) {
++ // No provider found
++ return null;
++ }
++
++ if (DEBUG) debugPrintln("found jar resource=" + serviceId +
++ " using ClassLoader: " + cl);
++
++ // Read the service provider name in UTF-8 as specified in
++ // the jar spec. Unfortunately this fails in Microsoft
++ // VJ++, which does not implement the UTF-8
++ // encoding. Theoretically, we should simply let it fail in
++ // that case, since the JVM is obviously broken if it
++ // doesn't support such a basic standard. But since there
++ // are still some users attempting to use VJ++ for
++ // development, we have dropped in a fallback which makes a
++ // second attempt using the platform's default encoding. In
++ // VJ++ this is apparently ASCII, which is a subset of
++ // UTF-8... and since the strings we'll be reading here are
++ // also primarily limited to the 7-bit ASCII range (at
++ // least, in English versions), this should work well
++ // enough to keep us on the air until we're ready to
++ // officially decommit from VJ++. [Edited comment from
++ // jkesselm]
++ BufferedReader rd;
++ try {
++ rd = new BufferedReader(new InputStreamReader(is, "UTF-8"), DEFAULT_LINE_LENGTH);
++ } catch (java.io.UnsupportedEncodingException e) {
++ rd = new BufferedReader(new InputStreamReader(is), DEFAULT_LINE_LENGTH);
++ }
++
++ String factoryClassName = null;
++ try {
++ // XXX Does not handle all possible input as specified by the
++ // Jar Service Provider specification
++ factoryClassName = rd.readLine();
++ } catch (IOException x) {
++ // No provider found
++ return null;
++ }
++ finally {
++ try {
++ // try to close the reader.
++ rd.close();
++ }
++ // Ignore the exception.
++ catch (IOException exc) {}
++ }
++
++ if (factoryClassName != null &&
++ ! "".equals(factoryClassName)) {
++ if (DEBUG) debugPrintln("found in resource, value="
++ + factoryClassName);
++
++ // Note: here we do not want to fall back to the current
++ // ClassLoader because we want to avoid the case where the
++ // resource file was found using one ClassLoader and the
++ // provider class was instantiated using a different one.
++ return newInstance(factoryClassName, cl, false);
++ }
++
++ // No provider found
++ return null;
++ }
++
++} // class ObjectFactory
+--- src/com/sun/org/apache/xerces/internal/utils/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100
++++ src/com/sun/org/apache/xerces/internal/utils/SecuritySupport.java 2013-04-16 14:29:26.557394511 +0100
+@@ -0,0 +1,199 @@
++/*
++ * reserved comment block
++ * DO NOT REMOVE OR ALTER!
++ */
++/*
++ * Copyright 2002,2004 The Apache Software Foundation.
++ *
++ * Licensed under the Apache License, Version 2.0 (the "License");
++ * you may not use this file except in compliance with the License.
++ * You may obtain a copy of the License at
++ *
++ * http://www.apache.org/licenses/LICENSE-2.0
++ *
++ * Unless required by applicable law or agreed to in writing, software
++ * distributed under the License is distributed on an "AS IS" BASIS,
++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
++ * See the License for the specific language governing permissions and
++ * limitations under the License.
++ */
++
++package com.sun.org.apache.xerces.internal.utils;
++
++import java.io.File;
++import java.io.FileInputStream;
++import java.io.FileNotFoundException;
++import java.io.InputStream;
++
++import java.security.AccessController;
++import java.security.PrivilegedAction;
++import java.security.PrivilegedActionException;
++import java.security.PrivilegedExceptionAction;
++import java.util.Locale;
++import java.util.MissingResourceException;
++import java.util.PropertyResourceBundle;
++import java.util.ResourceBundle;
++
++/**
++ * This class is duplicated for each subpackage so keep it in sync.
++ * It is package private and therefore is not exposed as part of any API.
++ *
++ * @xerces.internal
++ */
++public final class SecuritySupport {
++
++ private static final SecuritySupport securitySupport = new SecuritySupport();
++
++ /**
++ * Return an instance of this class.
++ */
++ public static SecuritySupport getInstance() {
++ return securitySupport;
++ }
++
++ static ClassLoader getContextClassLoader() {
++ return (ClassLoader)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ ClassLoader cl = null;
++ try {
++ cl = Thread.currentThread().getContextClassLoader();
++ } catch (SecurityException ex) { }
++ return cl;
++ }
++ });
++ }
++
++ static ClassLoader getSystemClassLoader() {
++ return (ClassLoader)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ ClassLoader cl = null;
++ try {
++ cl = ClassLoader.getSystemClassLoader();
++ } catch (SecurityException ex) {}
++ return cl;
++ }
++ });
++ }
++
++ static ClassLoader getParentClassLoader(final ClassLoader cl) {
++ return (ClassLoader)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ ClassLoader parent = null;
++ try {
++ parent = cl.getParent();
++ } catch (SecurityException ex) {}
++
++ // eliminate loops in case of the boot
++ // ClassLoader returning itself as a parent
++ return (parent == cl) ? null : parent;
++ }
++ });
++ }
++
++ public static String getSystemProperty(final String propName) {
++ return (String)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ return System.getProperty(propName);
++ }
++ });
++ }
++
++ static FileInputStream getFileInputStream(final File file)
++ throws FileNotFoundException
++ {
++ try {
++ return (FileInputStream)
++ AccessController.doPrivileged(new PrivilegedExceptionAction() {
++ public Object run() throws FileNotFoundException {
++ return new FileInputStream(file);
++ }
++ });
++ } catch (PrivilegedActionException e) {
++ throw (FileNotFoundException)e.getException();
++ }
++ }
++ /**
++ * Return resource using the same classloader for the ObjectFactory by default
++ * or bootclassloader when Security Manager is in place
++ */
++ public static InputStream getResourceAsStream(final String name) {
++ if (System.getSecurityManager()!=null) {
++ return getResourceAsStream(null, name);
++ } else {
++ return getResourceAsStream(ObjectFactory.findClassLoader(), name);
++ }
++ }
++
++ public static InputStream getResourceAsStream(final ClassLoader cl,
++ final String name)
++ {
++ return (InputStream)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ InputStream ris;
++ if (cl == null) {
++ ris = Object.class.getResourceAsStream("/"+name);
++ } else {
++ ris = cl.getResourceAsStream(name);
++ }
++ return ris;
++ }
++ });
++ }
++
++ /**
++ * Gets a resource bundle using the specified base name, the default locale, and the caller's class loader.
++ * @param bundle the base name of the resource bundle, a fully qualified class name
++ * @return a resource bundle for the given base name and the default locale
++ */
++ public static ResourceBundle getResourceBundle(String bundle) {
++ return getResourceBundle(bundle, Locale.getDefault());
++ }
++
++ /**
++ * Gets a resource bundle using the specified base name and locale, and the caller's class loader.
++ * @param bundle the base name of the resource bundle, a fully qualified class name
++ * @param locale the locale for which a resource bundle is desired
++ * @return a resource bundle for the given base name and locale
++ */
++ public static ResourceBundle getResourceBundle(final String bundle, final Locale locale) {
++ return AccessController.doPrivileged(new PrivilegedAction() {
++ public ResourceBundle run() {
++ try {
++ return PropertyResourceBundle.getBundle(bundle, locale);
++ } catch (MissingResourceException e) {
++ try {
++ return PropertyResourceBundle.getBundle(bundle, new Locale("en", "US"));
++ } catch (MissingResourceException e2) {
++ throw new MissingResourceException(
++ "Could not load any resource bundle by " + bundle, bundle, "");
++ }
++ }
++ }
++ });
++ }
++
++ static boolean getFileExists(final File f) {
++ return ((Boolean)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ return f.exists() ? Boolean.TRUE : Boolean.FALSE;
++ }
++ })).booleanValue();
++ }
++
++ static long getLastModified(final File f) {
++ return ((Long)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ return new Long(f.lastModified());
++ }
++ })).longValue();
++ }
++
++ private SecuritySupport () {}
++}
+--- src/com/sun/org/apache/xerces/internal/xinclude/XIncludeMessageFormatter.java 2013-04-16 14:28:09.628154939 +0100
++++ src/com/sun/org/apache/xerces/internal/xinclude/XIncludeMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100
+@@ -20,11 +20,11 @@
+
+ package com.sun.org.apache.xerces.internal.xinclude;
+
++import com.sun.org.apache.xerces.internal.util.MessageFormatter;
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+ import java.util.Locale;
+ import java.util.MissingResourceException;
+ import java.util.ResourceBundle;
+-import java.util.PropertyResourceBundle;
+-import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+
+ // TODO: fix error messages in XIncludeMessages.properties
+ /**
+@@ -32,6 +32,7 @@
+ *
+ * @author Peter McCracken, IBM
+ *
++ * @version $Id: XIncludeMessageFormatter.java,v 1.7 2010-11-01 04:40:18 joehw Exp $
+ */
+ public class XIncludeMessageFormatter implements MessageFormatter {
+
+@@ -61,12 +62,12 @@
+
+ if (fResourceBundle == null || locale != fLocale) {
+ if (locale != null) {
+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages", locale);
++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages", locale);
+ // memorize the most-recent locale
+ fLocale = locale;
+ }
+ if (fResourceBundle == null)
+- fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages");
++ fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages");
+ }
+
+ String msg = fResourceBundle.getString(key);
+--- src/com/sun/org/apache/xerces/internal/xpointer/XPointerMessageFormatter.java 2013-04-16 14:28:09.636155069 +0100
++++ src/com/sun/org/apache/xerces/internal/xpointer/XPointerMessageFormatter.java 2013-04-16 14:29:26.557394511 +0100
+@@ -24,6 +24,7 @@
+ import java.util.ResourceBundle;
+ import java.util.PropertyResourceBundle;
+ import com.sun.org.apache.xerces.internal.util.MessageFormatter;
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+
+ /**
+ * XPointerMessageFormatter provides error messages for the XPointer Framework
+@@ -31,6 +32,7 @@
+ *
+ * @xerces.internal
+ *
++ * @version $Id: XPointerMessageFormatter.java,v 1.5 2010-11-01 04:40:26 joehw Exp $
+ */
+ class XPointerMessageFormatter implements MessageFormatter {
+
+@@ -64,14 +66,14 @@
+
+ if (fResourceBundle == null || locale != fLocale) {
+ if (locale != null) {
+- fResourceBundle = PropertyResourceBundle.getBundle(
++ fResourceBundle = SecuritySupport.getResourceBundle(
+ "com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages", locale);
+ // memorize the most-recent locale
+ fLocale = locale;
+ }
+ if (fResourceBundle == null)
+- fResourceBundle = PropertyResourceBundle
+- .getBundle("com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages");
++ fResourceBundle = SecuritySupport.getResourceBundle(
++ "com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages");
+ }
+
+ String msg = fResourceBundle.getString(key);
+--- src/com/sun/org/apache/xml/internal/dtm/DTMManager.java 2013-04-16 14:28:09.644155197 +0100
++++ src/com/sun/org/apache/xml/internal/dtm/DTMManager.java 2013-04-16 14:29:26.557394511 +0100
+@@ -26,6 +26,7 @@
+ import com.sun.org.apache.xml.internal.res.XMLMessages;
+ import com.sun.org.apache.xml.internal.utils.PrefixResolver;
+ import com.sun.org.apache.xml.internal.utils.XMLStringFactory;
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+
+ /**
+ * A DTMManager instance can be used to create DTM and
+@@ -358,7 +359,7 @@
+ {
+ try
+ {
+- debug = System.getProperty("dtm.debug") != null;
++ debug = SecuritySupport.getSystemProperty("dtm.debug") != null;
+ }
+ catch (SecurityException ex){}
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ca.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ca.java 2013-04-16 14:29:26.557394511 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("ca", "ES"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_cs.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_cs.java 2013-04-16 14:29:26.557394511 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("cs", "CZ"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_de.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_de.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_es.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_es.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("es", "ES"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_fr.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_fr.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_it.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_it.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("it", "IT"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ja.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ja.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources.java 2013-04-16 14:28:09.660155456 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources.java 2013-04-16 14:29:26.557394511 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -461,67 +458,4 @@
+ return msgCopy;
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ko.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ko.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("ko", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sk.java 2013-04-16 14:28:09.664155519 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sk.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_tr.java 2013-04-16 14:28:09.668155584 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_tr.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("tr", "TR"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_CN.java 2013-04-16 14:28:09.668155584 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_CN.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("zh", "CN"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "\u65e0\u6cd5\u88c5\u5165\u4efb\u4f55\u8d44\u6e90\u5305\u3002", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_TW.java 2013-04-16 14:28:09.668155584 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_TW.java 2013-04-16 14:29:26.561394576 +0100
+@@ -24,9 +24,6 @@
+
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -442,67 +439,4 @@
+ };
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XMLErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XMLErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XMLErrorResources) ResourceBundle.getBundle(className,
+- new Locale("zh", "TW"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xml/internal/res/XMLMessages.java 2013-04-16 14:28:09.668155584 +0100
++++ src/com/sun/org/apache/xml/internal/res/XMLMessages.java 2013-04-16 14:29:26.561394576 +0100
+@@ -22,10 +22,9 @@
+ */
+ package com.sun.org.apache.xml.internal.res;
+
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+ import java.util.ListResourceBundle;
+ import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * A utility class for issuing XML error messages.
+@@ -82,8 +81,9 @@
+ */
+ public static final String createXMLMessage(String msgKey, Object args[])
+ {
+- if (XMLBundle == null)
+- XMLBundle = loadResourceBundle(XML_ERROR_RESOURCES);
++ if (XMLBundle == null) {
++ XMLBundle = SecuritySupport.getResourceBundle(XML_ERROR_RESOURCES);
++ }
+
+ if (XMLBundle != null)
+ {
+@@ -156,61 +156,4 @@
+ return fmsg;
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className The class name of the resource bundle.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static ListResourceBundle loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+- Locale locale = Locale.getDefault();
+-
+- try
+- {
+- return (ListResourceBundle)ResourceBundle.getBundle(className, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (ListResourceBundle)ResourceBundle.getBundle(
+- className, new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles." + className, className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which can be appended to a resource name
+- */
+- protected static String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+ }
+--- src/com/sun/org/apache/xml/internal/resolver/Catalog.java 2013-04-16 14:28:09.668155584 +0100
++++ src/com/sun/org/apache/xml/internal/resolver/Catalog.java 2013-04-16 14:29:26.561394576 +0100
+@@ -23,6 +23,8 @@
+
+ package com.sun.org.apache.xml.internal.resolver;
+
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
++
+ import java.io.IOException;
+ import java.io.FileNotFoundException;
+ import java.io.InputStream;
+@@ -819,7 +821,7 @@
+ // tack on a basename because URLs point to files not dirs
+ catalogCwd = FileURL.makeURL("basename");
+ } catch (MalformedURLException e) {
+- String userdir = System.getProperty("user.dir");
++ String userdir = SecuritySupport.getSystemProperty("user.dir");
+ userdir.replace('\\', '/');
+ catalogManager.debug.message(1, "Malformed URL on cwd", userdir);
+ catalogCwd = null;
+@@ -1715,7 +1717,7 @@
+ protected String resolveLocalSystem(String systemId)
+ throws MalformedURLException, IOException {
+
+- String osname = System.getProperty("os.name");
++ String osname = SecuritySupport.getSystemProperty("os.name");
+ boolean windows = (osname.indexOf("Windows") >= 0);
+ Enumeration en = catalogEntries.elements();
+ while (en.hasMoreElements()) {
+--- src/com/sun/org/apache/xml/internal/resolver/CatalogManager.java 2013-04-16 14:28:09.668155584 +0100
++++ src/com/sun/org/apache/xml/internal/resolver/CatalogManager.java 2013-04-16 14:29:26.561394576 +0100
+@@ -23,6 +23,7 @@
+
+ package com.sun.org.apache.xml.internal.resolver;
+
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+ import java.io.InputStream;
+
+ import java.net.URL;
+@@ -141,8 +142,8 @@
+
+ /** Flag to ignore missing property files and/or properties */
+ private boolean ignoreMissingProperties
+- = (System.getProperty(pIgnoreMissing) != null
+- || System.getProperty(pFiles) != null);
++ = (SecuritySupport.getSystemProperty(pIgnoreMissing) != null
++ || SecuritySupport.getSystemProperty(pFiles) != null);
+
+ /** Holds the resources after they are loaded from the file. */
+ private ResourceBundle resources;
+@@ -331,7 +332,7 @@
+ private int queryVerbosity () {
+ String defaultVerbStr = Integer.toString(defaultVerbosity);
+
+- String verbStr = System.getProperty(pVerbosity);
++ String verbStr = SecuritySupport.getSystemProperty(pVerbosity);
+
+ if (verbStr == null) {
+ if (resources==null) readProperties();
+@@ -466,7 +467,7 @@
+ * @return A semicolon delimited list of catlog file URIs
+ */
+ private String queryCatalogFiles () {
+- String catalogList = System.getProperty(pFiles);
++ String catalogList = SecuritySupport.getSystemProperty(pFiles);
+ fromPropertiesFile = false;
+
+ if (catalogList == null) {
+@@ -551,7 +552,7 @@
+ * defaultPreferSetting.
+ */
+ private boolean queryPreferPublic () {
+- String prefer = System.getProperty(pPrefer);
++ String prefer = SecuritySupport.getSystemProperty(pPrefer);
+
+ if (prefer == null) {
+ if (resources==null) readProperties();
+@@ -610,7 +611,7 @@
+ * defaultUseStaticCatalog.
+ */
+ private boolean queryUseStaticCatalog () {
+- String staticCatalog = System.getProperty(pStatic);
++ String staticCatalog = SecuritySupport.getSystemProperty(pStatic);
+
+ if (staticCatalog == null) {
+ if (resources==null) readProperties();
+@@ -741,7 +742,7 @@
+ * defaultOasisXMLCatalogPI.
+ */
+ public boolean queryAllowOasisXMLCatalogPI () {
+- String allow = System.getProperty(pAllowPI);
++ String allow = SecuritySupport.getSystemProperty(pAllowPI);
+
+ if (allow == null) {
+ if (resources==null) readProperties();
+@@ -794,7 +795,7 @@
+ *
+ */
+ public String queryCatalogClassName () {
+- String className = System.getProperty(pClassname);
++ String className = SecuritySupport.getSystemProperty(pClassname);
+
+ if (className == null) {
+ if (resources==null) readProperties();
+--- src/com/sun/org/apache/xml/internal/resolver/Resolver.java 2013-04-16 14:28:09.668155584 +0100
++++ src/com/sun/org/apache/xml/internal/resolver/Resolver.java 2013-04-16 14:29:26.561394576 +0100
+@@ -31,6 +31,7 @@
+ import java.net.URL;
+ import java.net.URLConnection;
+ import java.net.MalformedURLException;
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+ import com.sun.org.apache.xml.internal.resolver.readers.SAXCatalogReader;
+ import com.sun.org.apache.xml.internal.resolver.readers.OASISXMLCatalogReader;
+ import com.sun.org.apache.xml.internal.resolver.readers.TR9401CatalogReader;
+@@ -521,7 +522,7 @@
+ */
+ private Vector resolveAllLocalSystem(String systemId) {
+ Vector map = new Vector();
+- String osname = System.getProperty("os.name");
++ String osname = SecuritySupport.getSystemProperty("os.name");
+ boolean windows = (osname.indexOf("Windows") >= 0);
+ Enumeration en = catalogEntries.elements();
+ while (en.hasMoreElements()) {
+@@ -549,7 +550,7 @@
+ */
+ private Vector resolveLocalSystemReverse(String systemId) {
+ Vector map = new Vector();
+- String osname = System.getProperty("os.name");
++ String osname = SecuritySupport.getSystemProperty("os.name");
+ boolean windows = (osname.indexOf("Windows") >= 0);
+ Enumeration en = catalogEntries.elements();
+ while (en.hasMoreElements()) {
+--- src/com/sun/org/apache/xml/internal/serialize/SerializerFactory.java 2013-04-16 14:28:09.684155841 +0100
++++ src/com/sun/org/apache/xml/internal/serialize/SerializerFactory.java 2013-04-16 14:29:26.561394576 +0100
+@@ -21,6 +21,7 @@
+
+ package com.sun.org.apache.xml.internal.serialize;
+
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+
+ import java.io.OutputStream;
+ import java.io.Writer;
+@@ -63,7 +64,7 @@
+ factory = new SerializerFactoryImpl( Method.TEXT );
+ registerSerializerFactory( factory );
+
+- list = System.getProperty( FactoriesProperty );
++ list = SecuritySupport.getSystemProperty( FactoriesProperty );
+ if ( list != null ) {
+ token = new StringTokenizer( list, " ;,:" );
+ while ( token.hasMoreTokens() ) {
+--- src/com/sun/org/apache/xml/internal/serializer/Encodings.java 2013-04-16 14:28:09.684155841 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/Encodings.java 2013-04-16 14:29:26.561394576 +0100
+@@ -34,6 +34,7 @@
+ import java.util.Properties;
+ import java.util.StringTokenizer;
+
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+
+ /**
+ * Provides information about encodings. Depends on the Java runtime
+@@ -218,7 +219,7 @@
+ // Get the default system character encoding. This may be
+ // incorrect if they passed in a writer, but right now there
+ // seems to be no way to get the encoding from a writer.
+- encoding = System.getProperty("file.encoding", "UTF8");
++ encoding = SecuritySupport.getSystemProperty("file.encoding", "UTF8");
+
+ if (null != encoding)
+ {
+@@ -312,7 +313,7 @@
+
+ try
+ {
+- urlString = System.getProperty(ENCODINGS_PROP, "");
++ urlString = SecuritySupport.getSystemProperty(ENCODINGS_PROP, "");
+ }
+ catch (SecurityException e)
+ {
+@@ -324,9 +325,7 @@
+ }
+
+ if (is == null) {
+- SecuritySupport ss = SecuritySupport.getInstance();
+- is = ss.getResourceAsStream(ObjectFactory.findClassLoader(),
+- ENCODINGS_FILE);
++ is = SecuritySupport.getResourceAsStream(ENCODINGS_FILE);
+ }
+
+ Properties props = new Properties();
+--- src/com/sun/org/apache/xml/internal/serializer/ObjectFactory.java 2013-04-16 14:28:09.688155906 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/ObjectFactory.java 1970-01-01 01:00:00.000000000 +0100
+@@ -1,662 +0,0 @@
+-/*
+- * reserved comment block
+- * DO NOT REMOVE OR ALTER!
+- */
+-/*
+- * Copyright 2001-2004 The Apache Software Foundation.
+- *
+- * Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- *
+- * http://www.apache.org/licenses/LICENSE-2.0
+- *
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-/*
+- * $Id: ObjectFactory.java,v 1.2.4.1 2005/09/15 08:15:20 suresh_emailid Exp $
+- */
+-
+-package com.sun.org.apache.xml.internal.serializer;
+-
+-import java.io.BufferedReader;
+-import java.io.File;
+-import java.io.FileInputStream;
+-import java.io.IOException;
+-import java.io.InputStream;
+-import java.io.InputStreamReader;
+-import java.util.Properties;
+-
+-/**
+- * This class is duplicated for each JAXP subpackage so keep it in sync.
+- * It is package private and therefore is not exposed as part of the JAXP
+- * API.
+- *
+- * This code is designed to implement the JAXP 1.1 spec pluggability
+- * feature and is designed to run on JDK version 1.1 and
+- * later, and to compile on JDK 1.2 and onward.
+- * The code also runs both as part of an unbundled jar file and
+- * when bundled as part of the JDK.
+- *
+- * This class was moved from the javax.xml.parsers.ObjectFactory
+- * class and modified to be used as a general utility for creating objects
+- * dynamically.
+- *
+- * @xsl.usage internal
+- */
+-class ObjectFactory {
+-
+- //
+- // Constants
+- //
+-
+- // name of default properties file to look for in JDK's jre/lib directory
+- private static final String DEFAULT_PROPERTIES_FILENAME =
+- "xalan.properties";
+-
+- private static final String SERVICES_PATH = "META-INF/services/";
+-
+- /** Set to true for debugging */
+- private static final boolean DEBUG = false;
+-
+- /** cache the contents of the xalan.properties file.
+- * Until an attempt has been made to read this file, this will
+- * be null; if the file does not exist or we encounter some other error
+- * during the read, this will be empty.
+- */
+- private static Properties fXalanProperties = null;
+-
+- /***
+- * Cache the time stamp of the xalan.properties file so
+- * that we know if it's been modified and can invalidate
+- * the cache when necessary.
+- */
+- private static long fLastModified = -1;
+-
+- //
+- // Public static methods
+- //
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return instance of factory, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Object createObject(String factoryId, String fallbackClassName)
+- throws ConfigurationError {
+- return createObject(factoryId, null, fallbackClassName);
+- } // createObject(String,String):Object
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return instance of factory, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Object createObject(String factoryId,
+- String propertiesFilename,
+- String fallbackClassName)
+- throws ConfigurationError
+- {
+- Class factoryClass = lookUpFactoryClass(factoryId,
+- propertiesFilename,
+- fallbackClassName);
+-
+- if (factoryClass == null) {
+- throw new ConfigurationError(
+- "Provider for " + factoryId + " cannot be found", null);
+- }
+-
+- try{
+- Object instance = factoryClass.newInstance();
+- if (DEBUG) debugPrintln("created new instance of factory " + factoryId);
+- return instance;
+- } catch (Exception x) {
+- throw new ConfigurationError(
+- "Provider for factory " + factoryId
+- + " could not be instantiated: " + x, x);
+- }
+- } // createObject(String,String,String):Object
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return Class object of factory, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Class lookUpFactoryClass(String factoryId)
+- throws ConfigurationError
+- {
+- return lookUpFactoryClass(factoryId, null, null);
+- } // lookUpFactoryClass(String):Class
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return Class object that provides factory service, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Class lookUpFactoryClass(String factoryId,
+- String propertiesFilename,
+- String fallbackClassName)
+- throws ConfigurationError
+- {
+- String factoryClassName = lookUpFactoryClassName(factoryId,
+- propertiesFilename,
+- fallbackClassName);
+- ClassLoader cl = findClassLoader();
+-
+- if (factoryClassName == null) {
+- factoryClassName = fallbackClassName;
+- }
+-
+- // assert(className != null);
+- try{
+- Class providerClass = findProviderClass(factoryClassName,
+- cl,
+- true);
+- if (DEBUG) debugPrintln("created new instance of " + providerClass +
+- " using ClassLoader: " + cl);
+- return providerClass;
+- } catch (ClassNotFoundException x) {
+- throw new ConfigurationError(
+- "Provider " + factoryClassName + " not found", x);
+- } catch (Exception x) {
+- throw new ConfigurationError(
+- "Provider "+factoryClassName+" could not be instantiated: "+x,
+- x);
+- }
+- } // lookUpFactoryClass(String,String,String):Class
+-
+- /**
+- * Finds the name of the required implementation class in the specified
+- * order. The specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return name of class that provides factory service, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static String lookUpFactoryClassName(String factoryId,
+- String propertiesFilename,
+- String fallbackClassName)
+- {
+- SecuritySupport ss = SecuritySupport.getInstance();
+-
+- // Use the system property first
+- try {
+- String systemProp = ss.getSystemProperty(factoryId);
+- if (systemProp != null) {
+- if (DEBUG) debugPrintln("found system property, value=" + systemProp);
+- return systemProp;
+- }
+- } catch (SecurityException se) {
+- // Ignore and continue w/ next location
+- }
+-
+- // Try to read from propertiesFilename, or
+- // $java.home/lib/xalan.properties
+- String factoryClassName = null;
+- // no properties file name specified; use
+- // $JAVA_HOME/lib/xalan.properties:
+- if (propertiesFilename == null) {
+- File propertiesFile = null;
+- boolean propertiesFileExists = false;
+- try {
+- String javah = ss.getSystemProperty("java.home");
+- propertiesFilename = javah + File.separator +
+- "lib" + File.separator + DEFAULT_PROPERTIES_FILENAME;
+- propertiesFile = new File(propertiesFilename);
+- propertiesFileExists = ss.getFileExists(propertiesFile);
+- } catch (SecurityException e) {
+- // try again...
+- fLastModified = -1;
+- fXalanProperties = null;
+- }
+-
+- synchronized (ObjectFactory.class) {
+- boolean loadProperties = false;
+- FileInputStream fis = null;
+- try {
+- // file existed last time
+- if(fLastModified >= 0) {
+- if(propertiesFileExists &&
+- (fLastModified < (fLastModified = ss.getLastModified(propertiesFile)))) {
+- loadProperties = true;
+- } else {
+- // file has stopped existing...
+- if(!propertiesFileExists) {
+- fLastModified = -1;
+- fXalanProperties = null;
+- } // else, file wasn't modified!
+- }
+- } else {
+- // file has started to exist:
+- if(propertiesFileExists) {
+- loadProperties = true;
+- fLastModified = ss.getLastModified(propertiesFile);
+- } // else, nothing's changed
+- }
+- if(loadProperties) {
+- // must never have attempted to read xalan.properties
+- // before (or it's outdeated)
+- fXalanProperties = new Properties();
+- fis = ss.getFileInputStream(propertiesFile);
+- fXalanProperties.load(fis);
+- }
+- } catch (Exception x) {
+- fXalanProperties = null;
+- fLastModified = -1;
+- // assert(x instanceof FileNotFoundException
+- // || x instanceof SecurityException)
+- // In both cases, ignore and continue w/ next location
+- }
+- finally {
+- // try to close the input stream if one was opened.
+- if (fis != null) {
+- try {
+- fis.close();
+- }
+- // Ignore the exception.
+- catch (IOException exc) {}
+- }
+- }
+- }
+- if(fXalanProperties != null) {
+- factoryClassName = fXalanProperties.getProperty(factoryId);
+- }
+- } else {
+- FileInputStream fis = null;
+- try {
+- fis = ss.getFileInputStream(new File(propertiesFilename));
+- Properties props = new Properties();
+- props.load(fis);
+- factoryClassName = props.getProperty(factoryId);
+- } catch (Exception x) {
+- // assert(x instanceof FileNotFoundException
+- // || x instanceof SecurityException)
+- // In both cases, ignore and continue w/ next location
+- }
+- finally {
+- // try to close the input stream if one was opened.
+- if (fis != null) {
+- try {
+- fis.close();
+- }
+- // Ignore the exception.
+- catch (IOException exc) {}
+- }
+- }
+- }
+- if (factoryClassName != null) {
+- if (DEBUG) debugPrintln("found in " + propertiesFilename + ", value="
+- + factoryClassName);
+- return factoryClassName;
+- }
+-
+- // Try Jar Service Provider Mechanism
+- return findJarServiceProviderName(factoryId);
+- } // lookUpFactoryClass(String,String):String
+-
+- //
+- // Private static methods
+- //
+-
+- /** Prints a message to standard error if debugging is enabled. */
+- private static void debugPrintln(String msg) {
+- if (DEBUG) {
+- System.err.println("JAXP: " + msg);
+- }
+- } // debugPrintln(String)
+-
+- /**
+- * Figure out which ClassLoader to use. For JDK 1.2 and later use
+- * the context ClassLoader.
+- */
+- static ClassLoader findClassLoader()
+- throws ConfigurationError
+- {
+- SecuritySupport ss = SecuritySupport.getInstance();
+-
+- // Figure out which ClassLoader to use for loading the provider
+- // class. If there is a Context ClassLoader then use it.
+- ClassLoader context = ss.getContextClassLoader();
+- ClassLoader system = ss.getSystemClassLoader();
+-
+- ClassLoader chain = system;
+- while (true) {
+- if (context == chain) {
+- // Assert: we are on JDK 1.1 or we have no Context ClassLoader
+- // or any Context ClassLoader in chain of system classloader
+- // (including extension ClassLoader) so extend to widest
+- // ClassLoader (always look in system ClassLoader if Xalan
+- // is in boot/extension/system classpath and in current
+- // ClassLoader otherwise); normal classloaders delegate
+- // back to system ClassLoader first so this widening doesn't
+- // change the fact that context ClassLoader will be consulted
+- ClassLoader current = ObjectFactory.class.getClassLoader();
+-
+- chain = system;
+- while (true) {
+- if (current == chain) {
+- // Assert: Current ClassLoader in chain of
+- // boot/extension/system ClassLoaders
+- return system;
+- }
+- if (chain == null) {
+- break;
+- }
+- chain = ss.getParentClassLoader(chain);
+- }
+-
+- // Assert: Current ClassLoader not in chain of
+- // boot/extension/system ClassLoaders
+- return current;
+- }
+-
+- if (chain == null) {
+- // boot ClassLoader reached
+- break;
+- }
+-
+- // Check for any extension ClassLoaders in chain up to
+- // boot ClassLoader
+- chain = ss.getParentClassLoader(chain);
+- };
+-
+- // Assert: Context ClassLoader not in chain of
+- // boot/extension/system ClassLoaders
+- return context;
+- } // findClassLoader():ClassLoader
+-
+- /**
+- * Create an instance of a class using the specified ClassLoader
+- */
+- static Object newInstance(String className, ClassLoader cl,
+- boolean doFallback)
+- throws ConfigurationError
+- {
+- // assert(className != null);
+- try{
+- Class providerClass = findProviderClass(className, cl, doFallback);
+- Object instance = providerClass.newInstance();
+- if (DEBUG) debugPrintln("created new instance of " + providerClass +
+- " using ClassLoader: " + cl);
+- return instance;
+- } catch (ClassNotFoundException x) {
+- throw new ConfigurationError(
+- "Provider " + className + " not found", x);
+- } catch (Exception x) {
+- throw new ConfigurationError(
+- "Provider " + className + " could not be instantiated: " + x,
+- x);
+- }
+- }
+-
+- /**
+- * Find a Class using the specified ClassLoader
+- */
+- static Class findProviderClass(String className, ClassLoader cl,
+- boolean doFallback)
+- throws ClassNotFoundException, ConfigurationError
+- {
+- //throw security exception if the calling thread is not allowed to access the
+- //class. Restrict the access to the package classes as specified in java.security policy.
+- SecurityManager security = System.getSecurityManager();
+- try{
+- if (security != null){
+- final int lastDot = className.lastIndexOf(".");
+- String packageName = className;
+- if (lastDot != -1) packageName = className.substring(0, lastDot);
+- security.checkPackageAccess(packageName);
+- }
+- }catch(SecurityException e){
+- throw e;
+- }
+-
+- Class providerClass;
+- if (cl == null) {
+- // XXX Use the bootstrap ClassLoader. There is no way to
+- // load a class using the bootstrap ClassLoader that works
+- // in both JDK 1.1 and Java 2. However, this should still
+- // work b/c the following should be true:
+- //
+- // (cl == null) iff current ClassLoader == null
+- //
+- // Thus Class.forName(String) will use the current
+- // ClassLoader which will be the bootstrap ClassLoader.
+- providerClass = Class.forName(className);
+- } else {
+- try {
+- providerClass = cl.loadClass(className);
+- } catch (ClassNotFoundException x) {
+- if (doFallback) {
+- // Fall back to current classloader
+- ClassLoader current = ObjectFactory.class.getClassLoader();
+- if (current == null) {
+- providerClass = Class.forName(className);
+- } else if (cl != current) {
+- cl = current;
+- providerClass = cl.loadClass(className);
+- } else {
+- throw x;
+- }
+- } else {
+- throw x;
+- }
+- }
+- }
+-
+- return providerClass;
+- }
+-
+- /**
+- * Find the name of service provider using Jar Service Provider Mechanism
+- *
+- * @return instance of provider class if found or null
+- */
+- private static String findJarServiceProviderName(String factoryId)
+- {
+- SecuritySupport ss = SecuritySupport.getInstance();
+- String serviceId = SERVICES_PATH + factoryId;
+- InputStream is = null;
+-
+- // First try the Context ClassLoader
+- ClassLoader cl = findClassLoader();
+-
+- is = ss.getResourceAsStream(cl, serviceId);
+-
+- // If no provider found then try the current ClassLoader
+- if (is == null) {
+- ClassLoader current = ObjectFactory.class.getClassLoader();
+- if (cl != current) {
+- cl = current;
+- is = ss.getResourceAsStream(cl, serviceId);
+- }
+- }
+-
+- if (is == null) {
+- // No provider found
+- return null;
+- }
+-
+- if (DEBUG) debugPrintln("found jar resource=" + serviceId +
+- " using ClassLoader: " + cl);
+-
+- // Read the service provider name in UTF-8 as specified in
+- // the jar spec. Unfortunately this fails in Microsoft
+- // VJ++, which does not implement the UTF-8
+- // encoding. Theoretically, we should simply let it fail in
+- // that case, since the JVM is obviously broken if it
+- // doesn't support such a basic standard. But since there
+- // are still some users attempting to use VJ++ for
+- // development, we have dropped in a fallback which makes a
+- // second attempt using the platform's default encoding. In
+- // VJ++ this is apparently ASCII, which is a subset of
+- // UTF-8... and since the strings we'll be reading here are
+- // also primarily limited to the 7-bit ASCII range (at
+- // least, in English versions), this should work well
+- // enough to keep us on the air until we're ready to
+- // officially decommit from VJ++. [Edited comment from
+- // jkesselm]
+- BufferedReader rd;
+- try {
+- rd = new BufferedReader(new InputStreamReader(is, "UTF-8"));
+- } catch (java.io.UnsupportedEncodingException e) {
+- rd = new BufferedReader(new InputStreamReader(is));
+- }
+-
+- String factoryClassName = null;
+- try {
+- // XXX Does not handle all possible input as specified by the
+- // Jar Service Provider specification
+- factoryClassName = rd.readLine();
+- } catch (IOException x) {
+- // No provider found
+- return null;
+- }
+- finally {
+- try {
+- // try to close the reader.
+- rd.close();
+- }
+- // Ignore the exception.
+- catch (IOException exc) {}
+- }
+-
+- if (factoryClassName != null &&
+- ! "".equals(factoryClassName)) {
+- if (DEBUG) debugPrintln("found in resource, value="
+- + factoryClassName);
+-
+- // Note: here we do not want to fall back to the current
+- // ClassLoader because we want to avoid the case where the
+- // resource file was found using one ClassLoader and the
+- // provider class was instantiated using a different one.
+- return factoryClassName;
+- }
+-
+- // No provider found
+- return null;
+- }
+-
+- //
+- // Classes
+- //
+-
+- /**
+- * A configuration error.
+- */
+- static class ConfigurationError
+- extends Error {
+- static final long serialVersionUID = 8859254254255146542L;
+- //
+- // Data
+- //
+-
+- /** Exception. */
+- private Exception exception;
+-
+- //
+- // Constructors
+- //
+-
+- /**
+- * Construct a new instance with the specified detail string and
+- * exception.
+- */
+- ConfigurationError(String msg, Exception x) {
+- super(msg);
+- this.exception = x;
+- } // (String,Exception)
+-
+- //
+- // Public methods
+- //
+-
+- /** Returns the exception associated to this error. */
+- Exception getException() {
+- return exception;
+- } // getException():Exception
+-
+- } // class ConfigurationError
+-
+-} // class ObjectFactory
+--- src/com/sun/org/apache/xml/internal/serializer/OutputPropertiesFactory.java 2013-04-16 14:28:09.688155906 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/OutputPropertiesFactory.java 2013-04-16 14:29:26.561394576 +0100
+@@ -22,6 +22,7 @@
+ */
+ package com.sun.org.apache.xml.internal.serializer;
+
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+ import java.io.BufferedInputStream;
+ import java.io.IOException;
+ import java.io.InputStream;
+@@ -451,7 +452,7 @@
+ String value = null;
+ try
+ {
+- value = System.getProperty(key);
++ value = SecuritySupport.getSystemProperty(key);
+ }
+ catch (SecurityException se)
+ {
+@@ -464,7 +465,7 @@
+ String newValue = null;
+ try
+ {
+- newValue = System.getProperty(newKey);
++ newValue = SecuritySupport.getSystemProperty(newKey);
+ }
+ catch (SecurityException se)
+ {
+--- src/com/sun/org/apache/xml/internal/serializer/SecuritySupport12.java 2013-04-16 14:28:09.688155906 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/SecuritySupport12.java 1970-01-01 01:00:00.000000000 +0100
+@@ -1,145 +0,0 @@
+-/*
+- * reserved comment block
+- * DO NOT REMOVE OR ALTER!
+- */
+-/*
+- * Copyright 2002-2004 The Apache Software Foundation.
+- *
+- * Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- *
+- * http://www.apache.org/licenses/LICENSE-2.0
+- *
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-/*
+- * $Id: SecuritySupport12.java,v 1.2.4.1 2005/09/15 08:15:22 suresh_emailid Exp $
+- */
+-
+-package com.sun.org.apache.xml.internal.serializer;
+-
+-import java.io.File;
+-import java.io.FileInputStream;
+-import java.io.FileNotFoundException;
+-import java.io.InputStream;
+-import java.security.AccessController;
+-import java.security.PrivilegedAction;
+-import java.security.PrivilegedActionException;
+-import java.security.PrivilegedExceptionAction;
+-
+-/**
+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync.
+- * It is package private and therefore is not exposed as part of the Xalan-Java
+- * API.
+- *
+- * Security related methods that only work on J2SE 1.2 and newer.
+- */
+-class SecuritySupport12 extends SecuritySupport {
+-
+- ClassLoader getContextClassLoader() {
+- return (ClassLoader)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- ClassLoader cl = null;
+- try {
+- cl = Thread.currentThread().getContextClassLoader();
+- } catch (SecurityException ex) { }
+- return cl;
+- }
+- });
+- }
+-
+- ClassLoader getSystemClassLoader() {
+- return (ClassLoader)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- ClassLoader cl = null;
+- try {
+- cl = ClassLoader.getSystemClassLoader();
+- } catch (SecurityException ex) {}
+- return cl;
+- }
+- });
+- }
+-
+- ClassLoader getParentClassLoader(final ClassLoader cl) {
+- return (ClassLoader)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- ClassLoader parent = null;
+- try {
+- parent = cl.getParent();
+- } catch (SecurityException ex) {}
+-
+- // eliminate loops in case of the boot
+- // ClassLoader returning itself as a parent
+- return (parent == cl) ? null : parent;
+- }
+- });
+- }
+-
+- String getSystemProperty(final String propName) {
+- return (String)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- return System.getProperty(propName);
+- }
+- });
+- }
+-
+- FileInputStream getFileInputStream(final File file)
+- throws FileNotFoundException
+- {
+- try {
+- return (FileInputStream)
+- AccessController.doPrivileged(new PrivilegedExceptionAction() {
+- public Object run() throws FileNotFoundException {
+- return new FileInputStream(file);
+- }
+- });
+- } catch (PrivilegedActionException e) {
+- throw (FileNotFoundException)e.getException();
+- }
+- }
+-
+- InputStream getResourceAsStream(final ClassLoader cl,
+- final String name)
+- {
+- return (InputStream)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- InputStream ris;
+- if (cl == null) {
+- ris = ClassLoader.getSystemResourceAsStream(name);
+- } else {
+- ris = cl.getResourceAsStream(name);
+- }
+- return ris;
+- }
+- });
+- }
+-
+- boolean getFileExists(final File f) {
+- return ((Boolean)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- return new Boolean(f.exists());
+- }
+- })).booleanValue();
+- }
+-
+- long getLastModified(final File f) {
+- return ((Long)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- return new Long(f.lastModified());
+- }
+- })).longValue();
+- }
+-
+-}
+--- src/com/sun/org/apache/xml/internal/serializer/SecuritySupport.java 2013-04-16 14:28:09.688155906 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100
+@@ -1,125 +0,0 @@
+-/*
+- * reserved comment block
+- * DO NOT REMOVE OR ALTER!
+- */
+-/*
+- * Copyright 2002-2004 The Apache Software Foundation.
+- *
+- * Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- *
+- * http://www.apache.org/licenses/LICENSE-2.0
+- *
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-/*
+- * $Id: SecuritySupport.java,v 1.2.4.1 2005/09/15 08:15:21 suresh_emailid Exp $
+- */
+-
+-package com.sun.org.apache.xml.internal.serializer;
+-
+-import java.io.File;
+-import java.io.FileInputStream;
+-import java.io.FileNotFoundException;
+-import java.io.InputStream;
+-
+-/**
+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync.
+- * It is package private and therefore is not exposed as part of the Xalan-Java
+- * API.
+- *
+- * Base class with security related methods that work on JDK 1.1.
+- */
+-class SecuritySupport {
+-
+- /*
+- * Make this of type Object so that the verifier won't try to
+- * prove its type, thus possibly trying to load the SecuritySupport12
+- * class.
+- */
+- private static final Object securitySupport;
+-
+- static {
+- SecuritySupport ss = null;
+- try {
+- Class c = Class.forName("java.security.AccessController");
+- // if that worked, we're on 1.2.
+- /*
+- // don't reference the class explicitly so it doesn't
+- // get dragged in accidentally.
+- c = Class.forName("javax.mail.SecuritySupport12");
+- Constructor cons = c.getConstructor(new Class[] { });
+- ss = (SecuritySupport)cons.newInstance(new Object[] { });
+- */
+- /*
+- * Unfortunately, we can't load the class using reflection
+- * because the class is package private. And the class has
+- * to be package private so the APIs aren't exposed to other
+- * code that could use them to circumvent security. Thus,
+- * we accept the risk that the direct reference might fail
+- * on some JDK 1.1 JVMs, even though we would never execute
+- * this code in such a case. Sigh...
+- */
+- ss = new SecuritySupport12();
+- } catch (Exception ex) {
+- // ignore it
+- } finally {
+- if (ss == null)
+- ss = new SecuritySupport();
+- securitySupport = ss;
+- }
+- }
+-
+- /**
+- * Return an appropriate instance of this class, depending on whether
+- * we're on a JDK 1.1 or J2SE 1.2 (or later) system.
+- */
+- static SecuritySupport getInstance() {
+- return (SecuritySupport)securitySupport;
+- }
+-
+- ClassLoader getContextClassLoader() {
+- return null;
+- }
+-
+- ClassLoader getSystemClassLoader() {
+- return null;
+- }
+-
+- ClassLoader getParentClassLoader(ClassLoader cl) {
+- return null;
+- }
+-
+- String getSystemProperty(String propName) {
+- return System.getProperty(propName);
+- }
+-
+- FileInputStream getFileInputStream(File file)
+- throws FileNotFoundException
+- {
+- return new FileInputStream(file);
+- }
+-
+- InputStream getResourceAsStream(ClassLoader cl, String name) {
+- InputStream ris;
+- if (cl == null) {
+- ris = ClassLoader.getSystemResourceAsStream(name);
+- } else {
+- ris = cl.getResourceAsStream(name);
+- }
+- return ris;
+- }
+-
+- boolean getFileExists(File f) {
+- return f.exists();
+- }
+-
+- long getLastModified(File f) {
+- return f.lastModified();
+- }
+-}
+--- src/com/sun/org/apache/xml/internal/serializer/ToStream.java 2013-04-16 14:28:09.700156100 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/ToStream.java 2013-04-16 14:29:26.565394640 +0100
+@@ -22,6 +22,7 @@
+ */
+ package com.sun.org.apache.xml.internal.serializer;
+
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+ import java.io.IOException;
+ import java.io.OutputStream;
+ import java.io.UnsupportedEncodingException;
+@@ -140,7 +141,7 @@
+ * extension attribute xalan:line-separator.
+ */
+ protected char[] m_lineSep =
+- System.getProperty("line.separator").toCharArray();
++ SecuritySupport.getSystemProperty("line.separator").toCharArray();
+
+ /**
+ * True if the the system line separator is to be used.
+--- src/com/sun/org/apache/xml/internal/serializer/TreeWalker.java 2013-04-16 14:28:09.704156164 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/TreeWalker.java 2013-04-16 14:29:26.565394640 +0100
+@@ -22,6 +22,7 @@
+ */
+ package com.sun.org.apache.xml.internal.serializer;
+
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+ import java.io.File;
+
+ import com.sun.org.apache.xml.internal.serializer.utils.AttList;
+@@ -104,7 +105,7 @@
+ else {
+ try {
+ // Bug see Bugzilla 26741
+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
+ }
+ catch (SecurityException se) {// user.dir not accessible from applet
+ }
+@@ -115,7 +116,7 @@
+ m_contentHandler.setDocumentLocator(m_locator);
+ try {
+ // Bug see Bugzilla 26741
+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
+ }
+ catch (SecurityException se){// user.dir not accessible from applet
+
+--- src/com/sun/org/apache/xml/internal/serializer/utils/Messages.java 2013-04-16 14:28:09.708156229 +0100
++++ src/com/sun/org/apache/xml/internal/serializer/utils/Messages.java 2013-04-16 14:29:26.565394640 +0100
+@@ -22,6 +22,7 @@
+ */
+ package com.sun.org.apache.xml.internal.serializer.utils;
+
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+ import java.util.ListResourceBundle;
+ import java.util.Locale;
+ import java.util.MissingResourceException;
+@@ -87,9 +88,6 @@
+ * can have the Message strings translated in an alternate language
+ * in a errorResourceClass with a language suffix.
+ *
+- * More sophisticated use of this class would be to pass null
+- * when contructing it, but then call loadResourceBundle()
+- * before creating any messages.
+ *
+ * This class is not a public API, it is only public because it is
+ * used in com.sun.org.apache.xml.internal.serializer.
+@@ -126,18 +124,6 @@
+ m_resourceBundleName = resourceBundle;
+ }
+
+- /*
+- * Set the Locale object to use. If this method is not called the
+- * default locale is used. This method needs to be called before
+- * loadResourceBundle().
+- *
+- * @param locale non-null reference to Locale object.
+- * @xsl.usage internal
+- */
+-// public void setLocale(Locale locale)
+-// {
+-// m_locale = locale;
+-// }
+
+ /**
+ * Get the Locale object that is being used.
+@@ -151,16 +137,6 @@
+ }
+
+ /**
+- * Get the ListResourceBundle being used by this Messages instance which was
+- * previously set by a call to loadResourceBundle(className)
+- * @xsl.usage internal
+- */
+- private ListResourceBundle getResourceBundle()
+- {
+- return m_resourceBundle;
+- }
+-
+- /**
+ * Creates a message from the specified key and replacement
+ * arguments, localized to the given locale.
+ *
+@@ -174,7 +150,7 @@
+ public final String createMessage(String msgKey, Object args[])
+ {
+ if (m_resourceBundle == null)
+- m_resourceBundle = loadResourceBundle(m_resourceBundleName);
++ m_resourceBundle = SecuritySupport.getResourceBundle(m_resourceBundleName);
+
+ if (m_resourceBundle != null)
+ {
+@@ -293,76 +269,4 @@
+ return fmsg;
+ }
+
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className the name of the class that implements ListResourceBundle,
+- * without language suffix.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- * @xsl.usage internal
+- */
+- private ListResourceBundle loadResourceBundle(String resourceBundle)
+- throws MissingResourceException
+- {
+- m_resourceBundleName = resourceBundle;
+- Locale locale = getLocale();
+-
+- ListResourceBundle lrb;
+-
+- try
+- {
+-
+- ResourceBundle rb =
+- ResourceBundle.getBundle(m_resourceBundleName, locale);
+- lrb = (ListResourceBundle) rb;
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- lrb =
+- (ListResourceBundle) ResourceBundle.getBundle(
+- m_resourceBundleName,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles." + m_resourceBundleName,
+- m_resourceBundleName,
+- "");
+- }
+- }
+- m_resourceBundle = lrb;
+- return lrb;
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which can be appended to a resource name
+- * @xsl.usage internal
+- */
+- private static String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+ }
+--- src/com/sun/org/apache/xml/internal/utils/res/XResourceBundle.java 2013-04-16 14:28:09.728156552 +0100
++++ src/com/sun/org/apache/xml/internal/utils/res/XResourceBundle.java 2013-04-16 14:29:26.565394640 +0100
+@@ -22,6 +22,8 @@
+ */
+ package com.sun.org.apache.xml.internal.utils.res;
+
++import java.security.AccessController;
++import java.security.PrivilegedAction;
+ import java.util.ListResourceBundle;
+ import java.util.Locale;
+ import java.util.MissingResourceException;
+@@ -29,114 +31,45 @@
+
+ /**
+ * The default (english) resource bundle.
++ *
+ * @xsl.usage internal
+ */
+-public class XResourceBundle extends ListResourceBundle
+-{
++public class XResourceBundle extends ListResourceBundle {
+
+- /** Error resource constants */
+- public static final String ERROR_RESOURCES =
+- "com.sun.org.apache.xalan.internal.res.XSLTErrorResources", XSLT_RESOURCE =
+- "com.sun.org.apache.xml.internal.utils.res.XResourceBundle", LANG_BUNDLE_NAME =
+- "com.sun.org.apache.xml.internal.utils.res.XResources", MULT_ORDER =
+- "multiplierOrder", MULT_PRECEDES = "precedes", MULT_FOLLOWS =
+- "follows", LANG_ORIENTATION = "orientation", LANG_RIGHTTOLEFT =
+- "rightToLeft", LANG_LEFTTORIGHT = "leftToRight", LANG_NUMBERING =
+- "numbering", LANG_ADDITIVE = "additive", LANG_MULT_ADD =
+- "multiplicative-additive", LANG_MULTIPLIER =
+- "multiplier", LANG_MULTIPLIER_CHAR =
+- "multiplierChar", LANG_NUMBERGROUPS = "numberGroups", LANG_NUM_TABLES =
+- "tables", LANG_ALPHABET = "alphabet", LANG_TRAD_ALPHABET = "tradAlphabet";
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @param locale the locale to prefer when searching for the bundle
+- */
+- public static final XResourceBundle loadResourceBundle(
+- String className, Locale locale) throws MissingResourceException
+- {
+-
+- String suffix = getResourceSuffix(locale);
+-
+- //System.out.println("resource " + className + suffix);
+- try
+- {
+-
+- // first try with the given locale
+- String resourceName = className + suffix;
+- return (XResourceBundle) ResourceBundle.getBundle(resourceName, locale);
++ /**
++ * Error resource constants
++ */
++ public static final String ERROR_RESOURCES =
++ "com.sun.org.apache.xalan.internal.res.XSLTErrorResources", XSLT_RESOURCE =
++ "com.sun.org.apache.xml.internal.utils.res.XResourceBundle", LANG_BUNDLE_NAME =
++ "com.sun.org.apache.xml.internal.utils.res.XResources", MULT_ORDER =
++ "multiplierOrder", MULT_PRECEDES = "precedes", MULT_FOLLOWS =
++ "follows", LANG_ORIENTATION = "orientation", LANG_RIGHTTOLEFT =
++ "rightToLeft", LANG_LEFTTORIGHT = "leftToRight", LANG_NUMBERING =
++ "numbering", LANG_ADDITIVE = "additive", LANG_MULT_ADD =
++ "multiplicative-additive", LANG_MULTIPLIER =
++ "multiplier", LANG_MULTIPLIER_CHAR =
++ "multiplierChar", LANG_NUMBERGROUPS = "numberGroups", LANG_NUM_TABLES =
++ "tables", LANG_ALPHABET = "alphabet", LANG_TRAD_ALPHABET = "tradAlphabet";
++
++
++ /**
++ * Get the association list.
++ *
++ * @return The association list.
++ */
++ public Object[][] getContents() {
++ return new Object[][]{
++ {"ui_language", "en"}, {"help_language", "en"}, {"language", "en"},
++ {"alphabet", new CharArrayWrapper(new char[]{'A', 'B', 'C', 'D', 'E', 'F', 'G',
++ 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U',
++ 'V', 'W', 'X', 'Y', 'Z'})},
++ {"tradAlphabet", new CharArrayWrapper(new char[]{'A', 'B', 'C', 'D', 'E', 'F',
++ 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',
++ 'U', 'V', 'W', 'X', 'Y', 'Z'})},
++ //language orientation
++ {"orientation", "LeftToRight"},
++ //language numbering
++ {"numbering", "additive"},};
+ }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XResourceBundle) ResourceBundle.getBundle(
+- XSLT_RESOURCE, new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String lang = locale.getLanguage();
+- String country = locale.getCountry();
+- String variant = locale.getVariant();
+- String suffix = "_" + locale.getLanguage();
+-
+- if (lang.equals("zh"))
+- suffix += "_" + country;
+-
+- if (country.equals("JP"))
+- suffix += "_" + country + "_" + variant;
+-
+- return suffix;
+- }
+-
+- /**
+- * Get the association list.
+- *
+- * @return The association list.
+- */
+- public Object[][] getContents()
+- {
+- return new Object[][]
+- {
+- { "ui_language", "en" }, { "help_language", "en" }, { "language", "en" },
+- { "alphabet", new CharArrayWrapper(new char[]{ 'A', 'B', 'C', 'D', 'E', 'F', 'G',
+- 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U',
+- 'V', 'W', 'X', 'Y', 'Z' })},
+- { "tradAlphabet", new CharArrayWrapper(new char[]{ 'A', 'B', 'C', 'D', 'E', 'F',
+- 'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',
+- 'U', 'V', 'W', 'X', 'Y', 'Z' }) },
+-
+- //language orientation
+- { "orientation", "LeftToRight" },
+-
+- //language numbering
+- { "numbering", "additive" },
+- };
+- }
+ }
+--- src/com/sun/org/apache/xml/internal/utils/TreeWalker.java 2013-04-16 14:28:09.720156422 +0100
++++ src/com/sun/org/apache/xml/internal/utils/TreeWalker.java 2013-04-16 14:29:26.565394640 +0100
+@@ -22,6 +22,7 @@
+ */
+ package com.sun.org.apache.xml.internal.utils;
+
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+ import java.io.File;
+
+ import org.w3c.dom.Comment;
+@@ -93,7 +94,7 @@
+ else {
+ try {
+ // Bug see Bugzilla 26741
+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
+ }
+ catch (SecurityException se) {// user.dir not accessible from applet
+ }
+@@ -112,7 +113,7 @@
+ m_contentHandler.setDocumentLocator(m_locator);
+ try {
+ // Bug see Bugzilla 26741
+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
+ }
+ catch (SecurityException se){// user.dir not accessible from applet
+ }
+@@ -131,7 +132,7 @@
+ m_contentHandler.setDocumentLocator(m_locator);
+ try {
+ // Bug see Bugzilla 26741
+- m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
++ m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
+ }
+ catch (SecurityException se){// user.dir not accessible from applet
+
+--- src/com/sun/org/apache/xpath/internal/functions/FuncSystemProperty.java 2013-04-16 14:28:09.752156937 +0100
++++ src/com/sun/org/apache/xpath/internal/functions/FuncSystemProperty.java 2013-04-16 14:29:26.565394640 +0100
+@@ -31,6 +31,8 @@
+ import com.sun.org.apache.xpath.internal.objects.XObject;
+ import com.sun.org.apache.xpath.internal.objects.XString;
+ import com.sun.org.apache.xpath.internal.res.XPATHErrorResources;
++import com.sun.org.apache.xalan.internal.utils.ObjectFactory;
++import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
+
+ /**
+ * Execute the SystemProperty() function.
+@@ -100,7 +102,7 @@
+
+ try
+ {
+- result = System.getProperty(propName);
++ result = SecuritySupport.getSystemProperty(propName);
+
+ if (null == result)
+ {
+@@ -122,7 +124,7 @@
+ {
+ try
+ {
+- result = System.getProperty(fullName);
++ result = SecuritySupport.getSystemProperty(fullName);
+
+ if (null == result)
+ {
+@@ -163,14 +165,12 @@
+ * should already be fully qualified as path/filename
+ * @param target The target property bag the file will be placed into.
+ */
+- private void loadPropertyFile(String file, Properties target)
++ public void loadPropertyFile(String file, Properties target)
+ {
+ try
+ {
+ // Use SecuritySupport class to provide priveleged access to property file
+- SecuritySupport ss = SecuritySupport.getInstance();
+-
+- InputStream is = ss.getResourceAsStream(ObjectFactory.findClassLoader(),
++ InputStream is = SecuritySupport.getResourceAsStream(ObjectFactory.findClassLoader(),
+ file);
+
+ // get a buffered version
+--- src/com/sun/org/apache/xpath/internal/functions/ObjectFactory.java 2013-04-16 14:28:09.752156937 +0100
++++ src/com/sun/org/apache/xpath/internal/functions/ObjectFactory.java 1970-01-01 01:00:00.000000000 +0100
+@@ -1,663 +0,0 @@
+-/*
+- * reserved comment block
+- * DO NOT REMOVE OR ALTER!
+- */
+-/*
+- * Copyright 2001-2004 The Apache Software Foundation.
+- *
+- * Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- *
+- * http://www.apache.org/licenses/LICENSE-2.0
+- *
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-/*
+- * $Id: ObjectFactory.java,v 1.2.4.1 2005/09/14 20:25:54 jeffsuttor Exp $
+- */
+-
+-package com.sun.org.apache.xpath.internal.functions;
+-
+-import java.io.InputStream;
+-import java.io.IOException;
+-import java.io.File;
+-import java.io.FileInputStream;
+-
+-import java.util.Properties;
+-import java.io.BufferedReader;
+-import java.io.InputStreamReader;
+-
+-/**
+- * This class is duplicated for each JAXP subpackage so keep it in sync.
+- * It is package private and therefore is not exposed as part of the JAXP
+- * API.
+- *
+- * This code is designed to implement the JAXP 1.1 spec pluggability
+- * feature and is designed to run on JDK version 1.1 and
+- * later, and to compile on JDK 1.2 and onward.
+- * The code also runs both as part of an unbundled jar file and
+- * when bundled as part of the JDK.
+- *
+- * This class was moved from the javax.xml.parsers.ObjectFactory
+- * class and modified to be used as a general utility for creating objects
+- * dynamically.
+- *
+- * @version $Id: ObjectFactory.java,v 1.7 2008/04/02 00:40:59 joehw Exp $
+- */
+-class ObjectFactory {
+-
+- //
+- // Constants
+- //
+-
+- // name of default properties file to look for in JDK's jre/lib directory
+- private static final String DEFAULT_PROPERTIES_FILENAME =
+- "xalan.properties";
+-
+- private static final String SERVICES_PATH = "META-INF/services/";
+-
+- /** Set to true for debugging */
+- private static final boolean DEBUG = false;
+-
+- /** cache the contents of the xalan.properties file.
+- * Until an attempt has been made to read this file, this will
+- * be null; if the file does not exist or we encounter some other error
+- * during the read, this will be empty.
+- */
+- private static Properties fXalanProperties = null;
+-
+- /***
+- * Cache the time stamp of the xalan.properties file so
+- * that we know if it's been modified and can invalidate
+- * the cache when necessary.
+- */
+- private static long fLastModified = -1;
+-
+- //
+- // Public static methods
+- //
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return instance of factory, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Object createObject(String factoryId, String fallbackClassName)
+- throws ConfigurationError {
+- return createObject(factoryId, null, fallbackClassName);
+- } // createObject(String,String):Object
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return instance of factory, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Object createObject(String factoryId,
+- String propertiesFilename,
+- String fallbackClassName)
+- throws ConfigurationError
+- {
+- Class factoryClass = lookUpFactoryClass(factoryId,
+- propertiesFilename,
+- fallbackClassName);
+-
+- if (factoryClass == null) {
+- throw new ConfigurationError(
+- "Provider for " + factoryId + " cannot be found", null);
+- }
+-
+- try{
+- Object instance = factoryClass.newInstance();
+- if (DEBUG) debugPrintln("created new instance of factory " + factoryId);
+- return instance;
+- } catch (Exception x) {
+- throw new ConfigurationError(
+- "Provider for factory " + factoryId
+- + " could not be instantiated: " + x, x);
+- }
+- } // createObject(String,String,String):Object
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return Class object of factory, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Class lookUpFactoryClass(String factoryId)
+- throws ConfigurationError
+- {
+- return lookUpFactoryClass(factoryId, null, null);
+- } // lookUpFactoryClass(String):Class
+-
+- /**
+- * Finds the implementation Class object in the specified order. The
+- * specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return Class object that provides factory service, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static Class lookUpFactoryClass(String factoryId,
+- String propertiesFilename,
+- String fallbackClassName)
+- throws ConfigurationError
+- {
+- String factoryClassName = lookUpFactoryClassName(factoryId,
+- propertiesFilename,
+- fallbackClassName);
+- ClassLoader cl = findClassLoader();
+-
+- if (factoryClassName == null) {
+- factoryClassName = fallbackClassName;
+- }
+-
+- // assert(className != null);
+- try{
+- Class providerClass = findProviderClass(factoryClassName,
+- cl,
+- true);
+- if (DEBUG) debugPrintln("created new instance of " + providerClass +
+- " using ClassLoader: " + cl);
+- return providerClass;
+- } catch (ClassNotFoundException x) {
+- throw new ConfigurationError(
+- "Provider " + factoryClassName + " not found", x);
+- } catch (Exception x) {
+- throw new ConfigurationError(
+- "Provider "+factoryClassName+" could not be instantiated: "+x,
+- x);
+- }
+- } // lookUpFactoryClass(String,String,String):Class
+-
+- /**
+- * Finds the name of the required implementation class in the specified
+- * order. The specified order is the following:
+- *
+- * - query the system property using
System.getProperty
+- * - read
$java.home/lib/propertiesFilename file
+- * - read
META-INF/services/factoryId file
+- * - use fallback classname
+- *
+- *
+- * @return name of class that provides factory service, never null
+- *
+- * @param factoryId Name of the factory to find, same as
+- * a property name
+- * @param propertiesFilename The filename in the $java.home/lib directory
+- * of the properties file. If none specified,
+- * ${java.home}/lib/xalan.properties will be used.
+- * @param fallbackClassName Implementation class name, if nothing else
+- * is found. Use null to mean no fallback.
+- *
+- * @exception ObjectFactory.ConfigurationError
+- */
+- static String lookUpFactoryClassName(String factoryId,
+- String propertiesFilename,
+- String fallbackClassName)
+- {
+- SecuritySupport ss = SecuritySupport.getInstance();
+-
+- // Use the system property first
+- try {
+- String systemProp = ss.getSystemProperty(factoryId);
+- if (systemProp != null) {
+- if (DEBUG) debugPrintln("found system property, value=" + systemProp);
+- return systemProp;
+- }
+- } catch (SecurityException se) {
+- // Ignore and continue w/ next location
+- }
+-
+- // Try to read from propertiesFilename, or
+- // $java.home/lib/xalan.properties
+- String factoryClassName = null;
+- // no properties file name specified; use
+- // $JAVA_HOME/lib/xalan.properties:
+- if (propertiesFilename == null) {
+- File propertiesFile = null;
+- boolean propertiesFileExists = false;
+- try {
+- String javah = ss.getSystemProperty("java.home");
+- propertiesFilename = javah + File.separator +
+- "lib" + File.separator + DEFAULT_PROPERTIES_FILENAME;
+- propertiesFile = new File(propertiesFilename);
+- propertiesFileExists = ss.getFileExists(propertiesFile);
+- } catch (SecurityException e) {
+- // try again...
+- fLastModified = -1;
+- fXalanProperties = null;
+- }
+-
+- synchronized (ObjectFactory.class) {
+- boolean loadProperties = false;
+- FileInputStream fis = null;
+- try {
+- // file existed last time
+- if(fLastModified >= 0) {
+- if(propertiesFileExists &&
+- (fLastModified < (fLastModified = ss.getLastModified(propertiesFile)))) {
+- loadProperties = true;
+- } else {
+- // file has stopped existing...
+- if(!propertiesFileExists) {
+- fLastModified = -1;
+- fXalanProperties = null;
+- } // else, file wasn't modified!
+- }
+- } else {
+- // file has started to exist:
+- if(propertiesFileExists) {
+- loadProperties = true;
+- fLastModified = ss.getLastModified(propertiesFile);
+- } // else, nothing's changed
+- }
+- if(loadProperties) {
+- // must never have attempted to read xalan.properties
+- // before (or it's outdeated)
+- fXalanProperties = new Properties();
+- fis = ss.getFileInputStream(propertiesFile);
+- fXalanProperties.load(fis);
+- }
+- } catch (Exception x) {
+- fXalanProperties = null;
+- fLastModified = -1;
+- // assert(x instanceof FileNotFoundException
+- // || x instanceof SecurityException)
+- // In both cases, ignore and continue w/ next location
+- }
+- finally {
+- // try to close the input stream if one was opened.
+- if (fis != null) {
+- try {
+- fis.close();
+- }
+- // Ignore the exception.
+- catch (IOException exc) {}
+- }
+- }
+- }
+- if(fXalanProperties != null) {
+- factoryClassName = fXalanProperties.getProperty(factoryId);
+- }
+- } else {
+- FileInputStream fis = null;
+- try {
+- fis = ss.getFileInputStream(new File(propertiesFilename));
+- Properties props = new Properties();
+- props.load(fis);
+- factoryClassName = props.getProperty(factoryId);
+- } catch (Exception x) {
+- // assert(x instanceof FileNotFoundException
+- // || x instanceof SecurityException)
+- // In both cases, ignore and continue w/ next location
+- }
+- finally {
+- // try to close the input stream if one was opened.
+- if (fis != null) {
+- try {
+- fis.close();
+- }
+- // Ignore the exception.
+- catch (IOException exc) {}
+- }
+- }
+- }
+- if (factoryClassName != null) {
+- if (DEBUG) debugPrintln("found in " + propertiesFilename + ", value="
+- + factoryClassName);
+- return factoryClassName;
+- }
+-
+- // Try Jar Service Provider Mechanism
+- return findJarServiceProviderName(factoryId);
+- } // lookUpFactoryClass(String,String):String
+-
+- //
+- // Private static methods
+- //
+-
+- /** Prints a message to standard error if debugging is enabled. */
+- private static void debugPrintln(String msg) {
+- if (DEBUG) {
+- System.err.println("JAXP: " + msg);
+- }
+- } // debugPrintln(String)
+-
+- /**
+- * Figure out which ClassLoader to use. For JDK 1.2 and later use
+- * the context ClassLoader.
+- */
+- static ClassLoader findClassLoader()
+- throws ConfigurationError
+- {
+- SecuritySupport ss = SecuritySupport.getInstance();
+-
+- // Figure out which ClassLoader to use for loading the provider
+- // class. If there is a Context ClassLoader then use it.
+- ClassLoader context = ss.getContextClassLoader();
+- ClassLoader system = ss.getSystemClassLoader();
+-
+- ClassLoader chain = system;
+- while (true) {
+- if (context == chain) {
+- // Assert: we are on JDK 1.1 or we have no Context ClassLoader
+- // or any Context ClassLoader in chain of system classloader
+- // (including extension ClassLoader) so extend to widest
+- // ClassLoader (always look in system ClassLoader if Xalan
+- // is in boot/extension/system classpath and in current
+- // ClassLoader otherwise); normal classloaders delegate
+- // back to system ClassLoader first so this widening doesn't
+- // change the fact that context ClassLoader will be consulted
+- ClassLoader current = ObjectFactory.class.getClassLoader();
+-
+- chain = system;
+- while (true) {
+- if (current == chain) {
+- // Assert: Current ClassLoader in chain of
+- // boot/extension/system ClassLoaders
+- return system;
+- }
+- if (chain == null) {
+- break;
+- }
+- chain = ss.getParentClassLoader(chain);
+- }
+-
+- // Assert: Current ClassLoader not in chain of
+- // boot/extension/system ClassLoaders
+- return current;
+- }
+-
+- if (chain == null) {
+- // boot ClassLoader reached
+- break;
+- }
+-
+- // Check for any extension ClassLoaders in chain up to
+- // boot ClassLoader
+- chain = ss.getParentClassLoader(chain);
+- };
+-
+- // Assert: Context ClassLoader not in chain of
+- // boot/extension/system ClassLoaders
+- return context;
+- } // findClassLoader():ClassLoader
+-
+- /**
+- * Create an instance of a class using the specified ClassLoader
+- */
+- static Object newInstance(String className, ClassLoader cl,
+- boolean doFallback)
+- throws ConfigurationError
+- {
+- // assert(className != null);
+- try{
+- Class providerClass = findProviderClass(className, cl, doFallback);
+- Object instance = providerClass.newInstance();
+- if (DEBUG) debugPrintln("created new instance of " + providerClass +
+- " using ClassLoader: " + cl);
+- return instance;
+- } catch (ClassNotFoundException x) {
+- throw new ConfigurationError(
+- "Provider " + className + " not found", x);
+- } catch (Exception x) {
+- throw new ConfigurationError(
+- "Provider " + className + " could not be instantiated: " + x,
+- x);
+- }
+- }
+-
+- /**
+- * Find a Class using the specified ClassLoader
+- */
+- static Class findProviderClass(String className, ClassLoader cl,
+- boolean doFallback)
+- throws ClassNotFoundException, ConfigurationError
+- {
+- //throw security exception if the calling thread is not allowed to access the
+- //class. Restrict the access to the package classes as specified in java.security policy.
+- SecurityManager security = System.getSecurityManager();
+- try{
+- if (security != null){
+- final int lastDot = className.lastIndexOf(".");
+- String packageName = className;
+- if (lastDot != -1) packageName = className.substring(0, lastDot);
+- security.checkPackageAccess(packageName);
+- }
+- }catch(SecurityException e){
+- throw e;
+- }
+-
+- Class providerClass;
+- if (cl == null) {
+- // XXX Use the bootstrap ClassLoader. There is no way to
+- // load a class using the bootstrap ClassLoader that works
+- // in both JDK 1.1 and Java 2. However, this should still
+- // work b/c the following should be true:
+- //
+- // (cl == null) iff current ClassLoader == null
+- //
+- // Thus Class.forName(String) will use the current
+- // ClassLoader which will be the bootstrap ClassLoader.
+- providerClass = Class.forName(className);
+- } else {
+- try {
+- providerClass = cl.loadClass(className);
+- } catch (ClassNotFoundException x) {
+- if (doFallback) {
+- // Fall back to current classloader
+- ClassLoader current = ObjectFactory.class.getClassLoader();
+- if (current == null) {
+- providerClass = Class.forName(className);
+- } else if (cl != current) {
+- cl = current;
+- providerClass = cl.loadClass(className);
+- } else {
+- throw x;
+- }
+- } else {
+- throw x;
+- }
+- }
+- }
+-
+- return providerClass;
+- }
+-
+- /**
+- * Find the name of service provider using Jar Service Provider Mechanism
+- *
+- * @return instance of provider class if found or null
+- */
+- private static String findJarServiceProviderName(String factoryId)
+- {
+- SecuritySupport ss = SecuritySupport.getInstance();
+- String serviceId = SERVICES_PATH + factoryId;
+- InputStream is = null;
+-
+- // First try the Context ClassLoader
+- ClassLoader cl = findClassLoader();
+-
+- is = ss.getResourceAsStream(cl, serviceId);
+-
+- // If no provider found then try the current ClassLoader
+- if (is == null) {
+- ClassLoader current = ObjectFactory.class.getClassLoader();
+- if (cl != current) {
+- cl = current;
+- is = ss.getResourceAsStream(cl, serviceId);
+- }
+- }
+-
+- if (is == null) {
+- // No provider found
+- return null;
+- }
+-
+- if (DEBUG) debugPrintln("found jar resource=" + serviceId +
+- " using ClassLoader: " + cl);
+-
+- // Read the service provider name in UTF-8 as specified in
+- // the jar spec. Unfortunately this fails in Microsoft
+- // VJ++, which does not implement the UTF-8
+- // encoding. Theoretically, we should simply let it fail in
+- // that case, since the JVM is obviously broken if it
+- // doesn't support such a basic standard. But since there
+- // are still some users attempting to use VJ++ for
+- // development, we have dropped in a fallback which makes a
+- // second attempt using the platform's default encoding. In
+- // VJ++ this is apparently ASCII, which is a subset of
+- // UTF-8... and since the strings we'll be reading here are
+- // also primarily limited to the 7-bit ASCII range (at
+- // least, in English versions), this should work well
+- // enough to keep us on the air until we're ready to
+- // officially decommit from VJ++. [Edited comment from
+- // jkesselm]
+- BufferedReader rd;
+- try {
+- rd = new BufferedReader(new InputStreamReader(is, "UTF-8"));
+- } catch (java.io.UnsupportedEncodingException e) {
+- rd = new BufferedReader(new InputStreamReader(is));
+- }
+-
+- String factoryClassName = null;
+- try {
+- // XXX Does not handle all possible input as specified by the
+- // Jar Service Provider specification
+- factoryClassName = rd.readLine();
+- } catch (IOException x) {
+- // No provider found
+- return null;
+- }
+- finally {
+- try {
+- // try to close the reader.
+- rd.close();
+- }
+- // Ignore the exception.
+- catch (IOException exc) {}
+- }
+-
+- if (factoryClassName != null &&
+- ! "".equals(factoryClassName)) {
+- if (DEBUG) debugPrintln("found in resource, value="
+- + factoryClassName);
+-
+- // Note: here we do not want to fall back to the current
+- // ClassLoader because we want to avoid the case where the
+- // resource file was found using one ClassLoader and the
+- // provider class was instantiated using a different one.
+- return factoryClassName;
+- }
+-
+- // No provider found
+- return null;
+- }
+-
+- //
+- // Classes
+- //
+-
+- /**
+- * A configuration error.
+- */
+- static class ConfigurationError
+- extends Error {
+- static final long serialVersionUID = -5782303800588797207L;
+- //
+- // Data
+- //
+-
+- /** Exception. */
+- private Exception exception;
+-
+- //
+- // Constructors
+- //
+-
+- /**
+- * Construct a new instance with the specified detail string and
+- * exception.
+- */
+- ConfigurationError(String msg, Exception x) {
+- super(msg);
+- this.exception = x;
+- } // (String,Exception)
+-
+- //
+- // Public methods
+- //
+-
+- /** Returns the exception associated to this error. */
+- Exception getException() {
+- return exception;
+- } // getException():Exception
+-
+- } // class ConfigurationError
+-
+-} // class ObjectFactory
+--- src/com/sun/org/apache/xpath/internal/functions/SecuritySupport12.java 2013-04-16 14:28:09.752156937 +0100
++++ src/com/sun/org/apache/xpath/internal/functions/SecuritySupport12.java 1970-01-01 01:00:00.000000000 +0100
+@@ -1,148 +0,0 @@
+-/*
+- * reserved comment block
+- * DO NOT REMOVE OR ALTER!
+- */
+-/*
+- * Copyright 2002-2004 The Apache Software Foundation.
+- *
+- * Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- *
+- * http://www.apache.org/licenses/LICENSE-2.0
+- *
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-/*
+- * $Id: SecuritySupport12.java,v 1.1.2.1 2005/08/01 01:29:45 jeffsuttor Exp $
+- */
+-
+-package com.sun.org.apache.xpath.internal.functions;
+-
+-import java.io.File;
+-import java.io.FileInputStream;
+-import java.io.FileNotFoundException;
+-import java.io.InputStream;
+-
+-import java.security.AccessController;
+-import java.security.PrivilegedAction;
+-import java.security.PrivilegedActionException;
+-import java.security.PrivilegedExceptionAction;
+-
+-import java.util.Properties;
+-
+-/**
+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync.
+- * It is package private and therefore is not exposed as part of the Xalan-Java
+- * API.
+- *
+- * Security related methods that only work on J2SE 1.2 and newer.
+- */
+-class SecuritySupport12 extends SecuritySupport {
+-
+- ClassLoader getContextClassLoader() {
+- return (ClassLoader)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- ClassLoader cl = null;
+- try {
+- cl = Thread.currentThread().getContextClassLoader();
+- } catch (SecurityException ex) { }
+- return cl;
+- }
+- });
+- }
+-
+- ClassLoader getSystemClassLoader() {
+- return (ClassLoader)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- ClassLoader cl = null;
+- try {
+- cl = ClassLoader.getSystemClassLoader();
+- } catch (SecurityException ex) {}
+- return cl;
+- }
+- });
+- }
+-
+- ClassLoader getParentClassLoader(final ClassLoader cl) {
+- return (ClassLoader)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- ClassLoader parent = null;
+- try {
+- parent = cl.getParent();
+- } catch (SecurityException ex) {}
+-
+- // eliminate loops in case of the boot
+- // ClassLoader returning itself as a parent
+- return (parent == cl) ? null : parent;
+- }
+- });
+- }
+-
+- String getSystemProperty(final String propName) {
+- return (String)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- return System.getProperty(propName);
+- }
+- });
+- }
+-
+- FileInputStream getFileInputStream(final File file)
+- throws FileNotFoundException
+- {
+- try {
+- return (FileInputStream)
+- AccessController.doPrivileged(new PrivilegedExceptionAction() {
+- public Object run() throws FileNotFoundException {
+- return new FileInputStream(file);
+- }
+- });
+- } catch (PrivilegedActionException e) {
+- throw (FileNotFoundException)e.getException();
+- }
+- }
+-
+- InputStream getResourceAsStream(final ClassLoader cl,
+- final String name)
+- {
+- return (InputStream)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- InputStream ris;
+- if (cl == null) {
+- ris = ClassLoader.getSystemResourceAsStream(name);
+- } else {
+- ris = cl.getResourceAsStream(name);
+- }
+- return ris;
+- }
+- });
+- }
+-
+- boolean getFileExists(final File f) {
+- return ((Boolean)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- return new Boolean(f.exists());
+- }
+- })).booleanValue();
+- }
+-
+- long getLastModified(final File f) {
+- return ((Long)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- return new Long(f.lastModified());
+- }
+- })).longValue();
+- }
+-
+-}
+--- src/com/sun/org/apache/xpath/internal/functions/SecuritySupport.java 2013-04-16 14:28:09.752156937 +0100
++++ src/com/sun/org/apache/xpath/internal/functions/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100
+@@ -1,127 +0,0 @@
+-/*
+- * reserved comment block
+- * DO NOT REMOVE OR ALTER!
+- */
+-/*
+- * Copyright 2002-2004 The Apache Software Foundation.
+- *
+- * Licensed under the Apache License, Version 2.0 (the "License");
+- * you may not use this file except in compliance with the License.
+- * You may obtain a copy of the License at
+- *
+- * http://www.apache.org/licenses/LICENSE-2.0
+- *
+- * Unless required by applicable law or agreed to in writing, software
+- * distributed under the License is distributed on an "AS IS" BASIS,
+- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+- * See the License for the specific language governing permissions and
+- * limitations under the License.
+- */
+-/*
+- * $Id: SecuritySupport.java,v 1.1.2.1 2005/08/01 01:29:39 jeffsuttor Exp $
+- */
+-
+-package com.sun.org.apache.xpath.internal.functions;
+-
+-import java.io.File;
+-import java.io.FileInputStream;
+-import java.io.FileNotFoundException;
+-import java.io.InputStream;
+-
+-import java.util.Properties;
+-
+-/**
+- * This class is duplicated for each Xalan-Java subpackage so keep it in sync.
+- * It is package private and therefore is not exposed as part of the Xalan-Java
+- * API.
+- *
+- * Base class with security related methods that work on JDK 1.1.
+- */
+-class SecuritySupport {
+-
+- /*
+- * Make this of type Object so that the verifier won't try to
+- * prove its type, thus possibly trying to load the SecuritySupport12
+- * class.
+- */
+- private static final Object securitySupport;
+-
+- static {
+- SecuritySupport ss = null;
+- try {
+- Class c = Class.forName("java.security.AccessController");
+- // if that worked, we're on 1.2.
+- /*
+- // don't reference the class explicitly so it doesn't
+- // get dragged in accidentally.
+- c = Class.forName("javax.mail.SecuritySupport12");
+- Constructor cons = c.getConstructor(new Class[] { });
+- ss = (SecuritySupport)cons.newInstance(new Object[] { });
+- */
+- /*
+- * Unfortunately, we can't load the class using reflection
+- * because the class is package private. And the class has
+- * to be package private so the APIs aren't exposed to other
+- * code that could use them to circumvent security. Thus,
+- * we accept the risk that the direct reference might fail
+- * on some JDK 1.1 JVMs, even though we would never execute
+- * this code in such a case. Sigh...
+- */
+- ss = new SecuritySupport12();
+- } catch (Exception ex) {
+- // ignore it
+- } finally {
+- if (ss == null)
+- ss = new SecuritySupport();
+- securitySupport = ss;
+- }
+- }
+-
+- /**
+- * Return an appropriate instance of this class, depending on whether
+- * we're on a JDK 1.1 or J2SE 1.2 (or later) system.
+- */
+- static SecuritySupport getInstance() {
+- return (SecuritySupport)securitySupport;
+- }
+-
+- ClassLoader getContextClassLoader() {
+- return null;
+- }
+-
+- ClassLoader getSystemClassLoader() {
+- return null;
+- }
+-
+- ClassLoader getParentClassLoader(ClassLoader cl) {
+- return null;
+- }
+-
+- String getSystemProperty(String propName) {
+- return System.getProperty(propName);
+- }
+-
+- FileInputStream getFileInputStream(File file)
+- throws FileNotFoundException
+- {
+- return new FileInputStream(file);
+- }
+-
+- InputStream getResourceAsStream(ClassLoader cl, String name) {
+- InputStream ris;
+- if (cl == null) {
+- ris = ClassLoader.getSystemResourceAsStream(name);
+- } else {
+- ris = cl.getResourceAsStream(name);
+- }
+- return ris;
+- }
+-
+- boolean getFileExists(File f) {
+- return f.exists();
+- }
+-
+- long getLastModified(File f) {
+- return f.lastModified();
+- }
+-}
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_de.java 2013-04-16 14:28:09.764157131 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_de.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1269,68 +1266,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "MUSTER ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_es.java 2013-04-16 14:28:09.764157131 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_es.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1273,68 +1270,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "PATTERN ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("es", "ES"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_fr.java 2013-04-16 14:28:09.768157196 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_fr.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1270,68 +1267,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "PATTERN ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_it.java 2013-04-16 14:28:09.768157196 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_it.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1272,68 +1269,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "MODELLO ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("it", "IT"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ja.java 2013-04-16 14:28:09.768157196 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ja.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1269,68 +1266,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "\u30d1\u30bf\u30fc\u30f3 ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources.java 2013-04-16 14:28:09.764157131 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -938,68 +935,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "PATTERN ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("en", "US"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ko.java 2013-04-16 14:28:09.768157196 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ko.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1269,68 +1266,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "PATTERN ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("ko", "KR"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_CN.java 2013-04-16 14:28:09.772157260 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_CN.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1270,68 +1267,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "PATTERN ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("zh", "CN"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "\u65e0\u6cd5\u88c5\u5165\u4efb\u4f55\u8d44\u6e90\u5305\u3002", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_TW.java 2013-04-16 14:28:09.772157260 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_TW.java 2013-04-16 14:29:26.565394640 +0100
+@@ -23,9 +23,6 @@
+ package com.sun.org.apache.xpath.internal.res;
+
+ import java.util.ListResourceBundle;
+-import java.util.Locale;
+-import java.util.MissingResourceException;
+-import java.util.ResourceBundle;
+
+ /**
+ * Set up error messages.
+@@ -1270,68 +1267,4 @@
+ /** Field QUERY_HEADER */
+ public static final String QUERY_HEADER = "PATTERN ";
+
+-
+- /**
+- * Return a named ResourceBundle for a particular locale. This method mimics the behavior
+- * of ResourceBundle.getBundle().
+- *
+- * @param className Name of local-specific subclass.
+- * @return the ResourceBundle
+- * @throws MissingResourceException
+- */
+- public static final XPATHErrorResources loadResourceBundle(String className)
+- throws MissingResourceException
+- {
+-
+- Locale locale = Locale.getDefault();
+- String suffix = getResourceSuffix(locale);
+-
+- try
+- {
+-
+- // first try with the given locale
+- return (XPATHErrorResources) ResourceBundle.getBundle(className
+- + suffix, locale);
+- }
+- catch (MissingResourceException e)
+- {
+- try // try to fall back to en_US if we can't load
+- {
+-
+- // Since we can't find the localized property file,
+- // fall back to en_US.
+- return (XPATHErrorResources) ResourceBundle.getBundle(className,
+- new Locale("zh", "TW"));
+- }
+- catch (MissingResourceException e2)
+- {
+-
+- // Now we are really in trouble.
+- // very bad, definitely very bad...not going to get very far
+- throw new MissingResourceException(
+- "Could not load any resource bundles.", className, "");
+- }
+- }
+- }
+-
+- /**
+- * Return the resource file suffic for the indicated locale
+- * For most locales, this will be based the language code. However
+- * for Chinese, we do distinguish between Taiwan and PRC
+- *
+- * @param locale the locale
+- * @return an String suffix which canbe appended to a resource name
+- */
+- private static final String getResourceSuffix(Locale locale)
+- {
+-
+- String suffix = "_" + locale.getLanguage();
+- String country = locale.getCountry();
+-
+- if (country.equals("TW"))
+- suffix += "_" + country;
+-
+- return suffix;
+- }
+-
+ }
+--- src/com/sun/org/apache/xpath/internal/res/XPATHMessages.java 2013-04-16 14:28:09.772157260 +0100
++++ src/com/sun/org/apache/xpath/internal/res/XPATHMessages.java 2013-04-16 14:29:26.569394704 +0100
+@@ -22,130 +22,128 @@
+ */
+ package com.sun.org.apache.xpath.internal.res;
+
+-import java.util.ListResourceBundle;
+-
++import com.sun.org.apache.bcel.internal.util.SecuritySupport;
+ import com.sun.org.apache.xml.internal.res.XMLMessages;
++import java.util.ListResourceBundle;
+
+ /**
+ * A utility class for issuing XPath error messages.
++ *
+ * @xsl.usage internal
+ */
+-public class XPATHMessages extends XMLMessages
+-{
+- /** The language specific resource object for XPath messages. */
+- private static ListResourceBundle XPATHBundle = null;
+-
+- /** The class name of the XPath error message string table. */
+- private static final String XPATH_ERROR_RESOURCES =
+- "com.sun.org.apache.xpath.internal.res.XPATHErrorResources";
+-
+- /**
+- * Creates a message from the specified key and replacement
+- * arguments, localized to the given locale.
+- *
+- * @param msgKey The key for the message text.
+- * @param args The arguments to be used as replacement text
+- * in the message created.
+- *
+- * @return The formatted message string.
+- */
+- public static final String createXPATHMessage(String msgKey, Object args[]) //throws Exception
+- {
+- if (XPATHBundle == null)
+- XPATHBundle = loadResourceBundle(XPATH_ERROR_RESOURCES);
++public class XPATHMessages extends XMLMessages {
+
+- if (XPATHBundle != null)
++ /**
++ * The language specific resource object for XPath messages.
++ */
++ private static ListResourceBundle XPATHBundle = null;
++ /**
++ * The class name of the XPath error message string table.
++ */
++ private static final String XPATH_ERROR_RESOURCES =
++ "com.sun.org.apache.xpath.internal.res.XPATHErrorResources";
++
++ /**
++ * Creates a message from the specified key and replacement arguments,
++ * localized to the given locale.
++ *
++ * @param msgKey The key for the message text.
++ * @param args The arguments to be used as replacement text in the message
++ * created.
++ *
++ * @return The formatted message string.
++ */
++ public static final String createXPATHMessage(String msgKey, Object args[]) //throws Exception
+ {
+- return createXPATHMsg(XPATHBundle, msgKey, args);
+- }
+- else
+- return "Could not load any resource bundles.";
+- }
+-
+- /**
+- * Creates a message from the specified key and replacement
+- * arguments, localized to the given locale.
+- *
+- * @param msgKey The key for the message text.
+- * @param args The arguments to be used as replacement text
+- * in the message created.
+- *
+- * @return The formatted warning string.
+- */
+- public static final String createXPATHWarning(String msgKey, Object args[]) //throws Exception
+- {
+- if (XPATHBundle == null)
+- XPATHBundle = loadResourceBundle(XPATH_ERROR_RESOURCES);
++ if (XPATHBundle == null) {
++ XPATHBundle = SecuritySupport.getResourceBundle(XPATH_ERROR_RESOURCES);
++ }
+
+- if (XPATHBundle != null)
+- {
+- return createXPATHMsg(XPATHBundle, msgKey, args);
++ if (XPATHBundle != null) {
++ return createXPATHMsg(XPATHBundle, msgKey, args);
++ } else {
++ return "Could not load any resource bundles.";
++ }
+ }
+- else
+- return "Could not load any resource bundles.";
+- }
+-
+- /**
+- * Creates a message from the specified key and replacement
+- * arguments, localized to the given locale.
+- *
+- * @param fResourceBundle The resource bundle to use.
+- * @param msgKey The message key to use.
+- * @param args The arguments to be used as replacement text
+- * in the message created.
+- *
+- * @return The formatted message string.
+- */
+- public static final String createXPATHMsg(ListResourceBundle fResourceBundle,
+- String msgKey, Object args[]) //throws Exception
+- {
+-
+- String fmsg = null;
+- boolean throwex = false;
+- String msg = null;
+-
+- if (msgKey != null)
+- msg = fResourceBundle.getString(msgKey);
+
+- if (msg == null)
++ /**
++ * Creates a message from the specified key and replacement arguments,
++ * localized to the given locale.
++ *
++ * @param msgKey The key for the message text.
++ * @param args The arguments to be used as replacement text in the message
++ * created.
++ *
++ * @return The formatted warning string.
++ */
++ public static final String createXPATHWarning(String msgKey, Object args[]) //throws Exception
+ {
+- msg = fResourceBundle.getString(XPATHErrorResources.BAD_CODE);
+- throwex = true;
++ if (XPATHBundle == null) {
++ XPATHBundle = SecuritySupport.getResourceBundle(XPATH_ERROR_RESOURCES);
++ }
++
++ if (XPATHBundle != null) {
++ return createXPATHMsg(XPATHBundle, msgKey, args);
++ } else {
++ return "Could not load any resource bundles.";
++ }
+ }
+
+- if (args != null)
++ /**
++ * Creates a message from the specified key and replacement arguments,
++ * localized to the given locale.
++ *
++ * @param fResourceBundle The resource bundle to use.
++ * @param msgKey The message key to use.
++ * @param args The arguments to be used as replacement text in the message
++ * created.
++ *
++ * @return The formatted message string.
++ */
++ public static final String createXPATHMsg(ListResourceBundle fResourceBundle,
++ String msgKey, Object args[]) //throws Exception
+ {
+- try
+- {
+
+- // Do this to keep format from crying.
+- // This is better than making a bunch of conditional
+- // code all over the place.
+- int n = args.length;
+-
+- for (int i = 0; i < n; i++)
+- {
+- if (null == args[i])
+- args[i] = "";
+- }
+-
+- fmsg = java.text.MessageFormat.format(msg, args);
+- }
+- catch (Exception e)
+- {
+- fmsg = fResourceBundle.getString(XPATHErrorResources.FORMAT_FAILED);
+- fmsg += " " + msg;
+- }
+- }
+- else
+- fmsg = msg;
++ String fmsg = null;
++ boolean throwex = false;
++ String msg = null;
+
+- if (throwex)
+- {
+- throw new RuntimeException(fmsg);
+- }
++ if (msgKey != null) {
++ msg = fResourceBundle.getString(msgKey);
++ }
++
++ if (msg == null) {
++ msg = fResourceBundle.getString(XPATHErrorResources.BAD_CODE);
++ throwex = true;
++ }
+
+- return fmsg;
+- }
++ if (args != null) {
++ try {
+
++ // Do this to keep format from crying.
++ // This is better than making a bunch of conditional
++ // code all over the place.
++ int n = args.length;
++
++ for (int i = 0; i < n; i++) {
++ if (null == args[i]) {
++ args[i] = "";
++ }
++ }
++
++ fmsg = java.text.MessageFormat.format(msg, args);
++ } catch (Exception e) {
++ fmsg = fResourceBundle.getString(XPATHErrorResources.FORMAT_FAILED);
++ fmsg += " " + msg;
++ }
++ } else {
++ fmsg = msg;
++ }
++
++ if (throwex) {
++ throw new RuntimeException(fmsg);
++ }
++
++ return fmsg;
++ }
+ }
+--- src/com/sun/xml/internal/stream/writers/WriterUtility.java 2013-04-16 14:28:09.780157389 +0100
++++ src/com/sun/xml/internal/stream/writers/WriterUtility.java 2013-04-16 14:29:26.569394704 +0100
+@@ -32,6 +32,7 @@
+ import java.nio.charset.Charset;
+ import java.nio.charset.CharsetEncoder;
+ import com.sun.org.apache.xerces.internal.util.XMLChar;
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+
+ /**
+ * Implements common xml writer functions.
+@@ -240,7 +241,7 @@
+
+ private CharsetEncoder getDefaultEncoder(){
+ try{
+- String encoding = System.getProperty("file.encoding");
++ String encoding = SecuritySupport.getSystemProperty("file.encoding");
+ if(encoding != null){
+ return Charset.forName(encoding).newEncoder();
+ }
+--- src/com/sun/xml/internal/stream/writers/XMLStreamWriterImpl.java 2013-04-16 14:28:09.780157389 +0100
++++ src/com/sun/xml/internal/stream/writers/XMLStreamWriterImpl.java 2013-04-16 14:29:26.569394704 +0100
+@@ -53,6 +53,7 @@
+ import com.sun.org.apache.xerces.internal.impl.PropertyManager;
+ import com.sun.org.apache.xerces.internal.util.NamespaceSupport;
+ import com.sun.org.apache.xerces.internal.util.SymbolTable;
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+ import com.sun.org.apache.xerces.internal.xni.QName;
+
+ import com.sun.xml.internal.stream.util.ReadOnlyIterator;
+@@ -339,7 +340,7 @@
+ fEncoder = Charset.forName(encoding).newEncoder();
+ }
+ } else {
+- encoding = System.getProperty("file.encoding");
++ encoding = SecuritySupport.getSystemProperty("file.encoding");
+ if (encoding != null && encoding.equalsIgnoreCase("utf-8")) {
+ fWriter = new UTF8OutputStreamWriter(os);
+ } else {
+--- src/com/sun/xml/internal/stream/XMLEntityStorage.java 2013-04-16 14:28:09.772157260 +0100
++++ src/com/sun/xml/internal/stream/XMLEntityStorage.java 2013-04-16 14:29:26.569394704 +0100
+@@ -36,6 +36,7 @@
+ import com.sun.org.apache.xerces.internal.impl.PropertyManager;
+ import com.sun.org.apache.xerces.internal.impl.XMLErrorReporter;
+ import com.sun.org.apache.xerces.internal.impl.Constants;
++import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
+
+ /**
+ *
+@@ -410,7 +411,7 @@
+ // get the user.dir property
+ String userDir = "";
+ try {
+- userDir = System.getProperty("user.dir");
++ userDir = SecuritySupport.getSystemProperty("user.dir");
+ }
+ catch (SecurityException se) {
+ }
+--- src/javax/xml/datatype/FactoryFinder.java 2013-04-16 14:28:09.784157453 +0100
++++ src/javax/xml/datatype/FactoryFinder.java 2013-04-16 14:29:26.569394704 +0100
+@@ -44,6 +44,7 @@
+ * @author Santiago.PericasGeertsen@sun.com
+ */
+ class FactoryFinder {
++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
+
+ /**
+ * Internal debug flag.
+@@ -95,18 +96,24 @@
+ * If the class loader supplied is null, first try using the
+ * context class loader followed by the current (i.e. bootstrap) class
+ * loader.
++ *
++ * Use bootstrap classLoader if cl = null and useBSClsLoader is true
+ */
+ static private Class getProviderClass(String className, ClassLoader cl,
+- boolean doFallback) throws ClassNotFoundException
++ boolean doFallback, boolean useBSClsLoader) throws ClassNotFoundException
+ {
+ try {
+ if (cl == null) {
+- cl = ss.getContextClassLoader();
+- if (cl == null) {
+- throw new ClassNotFoundException();
+- }
+- else {
+- return cl.loadClass(className);
++ if (useBSClsLoader) {
++ return Class.forName(className, true, FactoryFinder.class.getClassLoader());
++ } else {
++ cl = ss.getContextClassLoader();
++ if (cl == null) {
++ throw new ClassNotFoundException();
++ }
++ else {
++ return cl.loadClass(className);
++ }
+ }
+ }
+ else {
+@@ -131,8 +138,8 @@
+ * @param className Name of the concrete class corresponding to the
+ * service provider
+ *
+- * @param cl ClassLoader to use to load the class, null means to use
+- * the bootstrap ClassLoader
++ * @param cl ClassLoader used to load the factory class. If null
++ * current Thread's context classLoader is used to load the factory class.
+ *
+ * @param doFallback True if the current ClassLoader should be tried as
+ * a fallback if the class is not found using cl
+@@ -140,8 +147,38 @@
+ static Object newInstance(String className, ClassLoader cl, boolean doFallback)
+ throws ConfigurationError
+ {
++ return newInstance(className, cl, doFallback, false);
++ }
++
++ /**
++ * Create an instance of a class. Delegates to method
++ * getProviderClass() in order to load the class.
++ *
++ * @param className Name of the concrete class corresponding to the
++ * service provider
++ *
++ * @param cl ClassLoader to use to load the class, null means to use
++ * the bootstrap ClassLoader
++ *
++ * @param doFallback True if the current ClassLoader should be tried as
++ * a fallback if the class is not found using cl
++ *
++ * @param useBSClsLoader True if cl=null actually meant bootstrap classLoader. This parameter
++ * is needed since DocumentBuilderFactory/SAXParserFactory defined null as context classLoader.
++ */
++ static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader)
++ throws ConfigurationError
++ {
++ // make sure we have access to restricted packages
++ if (System.getSecurityManager() != null) {
++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
++ cl = null;
++ useBSClsLoader = true;
++ }
++ }
++
+ try {
+- Class providerClass = getProviderClass(className, cl, doFallback);
++ Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
+ Object instance = providerClass.newInstance();
+ if (debug) { // Extra check to avoid computing cl strings
+ dPrint("created new instance of " + providerClass +
+@@ -244,6 +281,7 @@
+
+ // First try the Context ClassLoader
+ ClassLoader cl = ss.getContextClassLoader();
++ boolean useBSClsLoader = false;
+ if (cl != null) {
+ is = ss.getResourceAsStream(cl, serviceId);
+
+@@ -251,11 +289,13 @@
+ if (is == null) {
+ cl = FactoryFinder.class.getClassLoader();
+ is = ss.getResourceAsStream(cl, serviceId);
++ useBSClsLoader = true;
+ }
+ } else {
+ // No Context ClassLoader, try the current ClassLoader
+ cl = FactoryFinder.class.getClassLoader();
+ is = ss.getResourceAsStream(cl, serviceId);
++ useBSClsLoader = true;
+ }
+
+ if (is == null) {
+@@ -293,7 +333,7 @@
+ // ClassLoader because we want to avoid the case where the
+ // resource file was found using one ClassLoader and the
+ // provider class was instantiated using a different one.
+- return newInstance(factoryClassName, cl, false);
++ return newInstance(factoryClassName, cl, false, useBSClsLoader);
+ }
+
+ // No provider found
+--- src/javax/xml/stream/FactoryFinder.java 2013-04-16 14:28:09.788157518 +0100
++++ src/javax/xml/stream/FactoryFinder.java 2013-04-16 14:29:26.569394704 +0100
+@@ -25,14 +25,12 @@
+
+ package javax.xml.stream;
+
+-import java.io.InputStream;
+-import java.io.IOException;
+-import java.io.File;
+-import java.io.FileInputStream;
+-
+-import java.util.Properties;
+ import java.io.BufferedReader;
++import java.io.File;
++import java.io.IOException;
++import java.io.InputStream;
+ import java.io.InputStreamReader;
++import java.util.Properties;
+
+ /**
+ * Implements pluggable Datatypes.
+@@ -43,6 +41,8 @@
+ * @author Santiago.PericasGeertsen@sun.com
+ */
+ class FactoryFinder {
++ // Check we have access to package.
++ private static final String DEFAULT_PACKAGE = "com.sun.xml.internal.";
+
+ /**
+ * Internal debug flag.
+@@ -94,18 +94,24 @@
+ * If the class loader supplied is null, first try using the
+ * context class loader followed by the current (i.e. bootstrap) class
+ * loader.
++ *
++ * Use bootstrap classLoader if cl = null and useBSClsLoader is true
+ */
+ static private Class getProviderClass(String className, ClassLoader cl,
+- boolean doFallback) throws ClassNotFoundException
++ boolean doFallback, boolean useBSClsLoader) throws ClassNotFoundException
+ {
+ try {
+ if (cl == null) {
+- cl = ss.getContextClassLoader();
+- if (cl == null) {
+- throw new ClassNotFoundException();
+- }
+- else {
+- return cl.loadClass(className);
++ if (useBSClsLoader) {
++ return Class.forName(className, true, FactoryFinder.class.getClassLoader());
++ } else {
++ cl = ss.getContextClassLoader();
++ if (cl == null) {
++ throw new ClassNotFoundException();
++ }
++ else {
++ return cl.loadClass(className);
++ }
+ }
+ }
+ else {
+@@ -130,8 +136,8 @@
+ * @param className Name of the concrete class corresponding to the
+ * service provider
+ *
+- * @param cl ClassLoader to use to load the class, null means to use
+- * the bootstrap ClassLoader
++ * @param cl ClassLoader used to load the factory class. If null
++ * current Thread's context classLoader is used to load the factory class.
+ *
+ * @param doFallback True if the current ClassLoader should be tried as
+ * a fallback if the class is not found using cl
+@@ -139,8 +145,38 @@
+ static Object newInstance(String className, ClassLoader cl, boolean doFallback)
+ throws ConfigurationError
+ {
++ return newInstance(className, cl, doFallback, false);
++ }
++
++ /**
++ * Create an instance of a class. Delegates to method
++ * getProviderClass() in order to load the class.
++ *
++ * @param className Name of the concrete class corresponding to the
++ * service provider
++ *
++ * @param cl ClassLoader used to load the factory class. If null
++ * current Thread's context classLoader is used to load the factory class.
++ *
++ * @param doFallback True if the current ClassLoader should be tried as
++ * a fallback if the class is not found using cl
++ *
++ * @param useBSClsLoader True if cl=null actually meant bootstrap classLoader. This parameter
++ * is needed since DocumentBuilderFactory/SAXParserFactory defined null as context classLoader.
++ */
++ static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader)
++ throws ConfigurationError
++ {
++ // make sure we have access to restricted packages
++ if (System.getSecurityManager() != null) {
++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
++ cl = null;
++ useBSClsLoader = true;
++ }
++ }
++
+ try {
+- Class providerClass = getProviderClass(className, cl, doFallback);
++ Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
+ Object instance = providerClass.newInstance();
+ if (debug) { // Extra check to avoid computing cl strings
+ dPrint("created new instance of " + providerClass +
+@@ -233,11 +269,11 @@
+ if (ss.doesFileExist(f)) {
+ dPrint("Read properties file "+f);
+ cacheProps.load(ss.getFileInputStream(f));
+- }
+- }
+ }
+ }
+ }
++ }
++ }
+ factoryClassName = cacheProps.getProperty(factoryId);
+
+ if (factoryClassName != null) {
+@@ -276,6 +312,7 @@
+
+ // First try the Context ClassLoader
+ ClassLoader cl = ss.getContextClassLoader();
++ boolean useBSClsLoader = false;
+ if (cl != null) {
+ is = ss.getResourceAsStream(cl, serviceId);
+
+@@ -283,11 +320,13 @@
+ if (is == null) {
+ cl = FactoryFinder.class.getClassLoader();
+ is = ss.getResourceAsStream(cl, serviceId);
++ useBSClsLoader = true;
+ }
+ } else {
+ // No Context ClassLoader, try the current ClassLoader
+ cl = FactoryFinder.class.getClassLoader();
+ is = ss.getResourceAsStream(cl, serviceId);
++ useBSClsLoader = true;
+ }
+
+ if (is == null) {
+@@ -325,7 +364,7 @@
+ // ClassLoader because we want to avoid the case where the
+ // resource file was found using one ClassLoader and the
+ // provider class was instantiated using a different one.
+- return newInstance(factoryClassName, cl, false);
++ return newInstance(factoryClassName, cl, false, useBSClsLoader);
+ }
+
+ // No provider found
+--- src/javax/xml/validation/SchemaFactoryFinder.java 2013-04-16 14:28:09.800157711 +0100
++++ src/javax/xml/validation/SchemaFactoryFinder.java 2013-04-16 14:29:26.569394704 +0100
+@@ -53,6 +53,7 @@
+ * Take care of restrictions imposed by java security model
+ */
+ private static SecuritySupport ss = new SecuritySupport();
++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
+ /**
+ * Cache properties for performance.
+ */
+@@ -212,28 +213,6 @@
+ }
+ }
+
+- /**
+- // try to read from $java.home/lib/jaxp.properties
+- try {
+- String javah = ss.getSystemProperty( "java.home" );
+- String configFile = javah + File.separator +
+- "lib" + File.separator + "jaxp.properties";
+- File f = new File( configFile );
+- if( ss.doesFileExist(f)) {
+- sf = loadFromProperty(
+- propertyName,f.getAbsolutePath(), new FileInputStream(f));
+- if(sf!=null) return sf;
+- } else {
+- debugPrintln("Tried to read "+ f.getAbsolutePath()+", but it doesn't exist.");
+- }
+- } catch(Throwable e) {
+- if( debug ) {
+- debugPrintln("failed to read $java.home/lib/jaxp.properties");
+- e.printStackTrace();
+- }
+- }
+- */
+-
+ // try META-INF/services files
+ Iterator sitr = createServiceFileIterator();
+ while(sitr.hasNext()) {
+@@ -268,14 +247,20 @@
+ */
+ private Class createClass(String className) {
+ Class clazz;
++ // make sure we have access to restricted packages
++ boolean internal = false;
++ if (System.getSecurityManager() != null) {
++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
++ internal = true;
++ }
++ }
+
+- // use approprite ClassLoader
+ try {
+- if (classLoader != null) {
+- clazz = classLoader.loadClass(className);
+- } else {
+- clazz = Class.forName(className);
+- }
++ if (classLoader != null && !internal) {
++ clazz = classLoader.loadClass(className);
++ } else {
++ clazz = Class.forName(className);
++ }
+ } catch (Throwable t) {
+ if(debug) t.printStackTrace();
+ return null;
+--- src/javax/xml/xpath/XPathFactoryFinder.java 2013-04-16 14:28:09.800157711 +0100
++++ src/javax/xml/xpath/XPathFactoryFinder.java 2013-04-16 14:29:26.569394704 +0100
+@@ -47,6 +47,7 @@
+ * @since 1.5
+ */
+ class XPathFactoryFinder {
++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xpath.internal";
+
+ private static SecuritySupport ss = new SecuritySupport() ;
+ /** debug support code. */
+@@ -245,18 +246,25 @@
+ */
+ private Class createClass(String className) {
+ Class clazz;
+-
+- // use approprite ClassLoader
+- try {
+- if (classLoader != null) {
+- clazz = classLoader.loadClass(className);
+- } else {
+- clazz = Class.forName(className);
+- }
+- } catch (Throwable t) {
+- if(debug) t.printStackTrace();
+- return null;
++ // make sure we have access to restricted packages
++ boolean internal = false;
++ if (System.getSecurityManager() != null) {
++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
++ internal = true;
+ }
++ }
++
++ // use approprite ClassLoader
++ try {
++ if (classLoader != null && !internal) {
++ clazz = classLoader.loadClass(className);
++ } else {
++ clazz = Class.forName(className);
++ }
++ } catch (Throwable t) {
++ if(debug) t.printStackTrace();
++ return null;
++ }
+
+ return clazz;
+ }
+--- src/org/w3c/dom/bootstrap/DOMImplementationRegistry.java 2013-04-16 14:28:09.808157841 +0100
++++ src/org/w3c/dom/bootstrap/DOMImplementationRegistry.java 2013-04-16 14:29:26.569394704 +0100
+@@ -104,6 +104,8 @@
+ */
+ private static final String FALLBACK_CLASS =
+ "com.sun.org.apache.xerces.internal.dom.DOMXSImplementationSourceImpl";
++ private static final String DEFAULT_PACKAGE =
++ "com.sun.org.apache.xerces.internal.dom";
+ /**
+ * Private constructor.
+ * @param srcs Vector List of DOMImplementationSources
+@@ -168,10 +170,15 @@
+ StringTokenizer st = new StringTokenizer(p);
+ while (st.hasMoreTokens()) {
+ String sourceName = st.nextToken();
+- // Use context class loader, falling back to Class.forName
+- // if and only if this fails...
++ // make sure we have access to restricted packages
++ boolean internal = false;
++ if (System.getSecurityManager() != null) {
++ if (sourceName != null && sourceName.startsWith(DEFAULT_PACKAGE)) {
++ internal = true;
++ }
++ }
+ Class sourceClass = null;
+- if (classLoader != null) {
++ if (classLoader != null && !internal) {
+ sourceClass = classLoader.loadClass(sourceName);
+ } else {
+ sourceClass = Class.forName(sourceName);
+--- src/org/xml/sax/helpers/NewInstance.java 2013-04-16 14:28:09.832158226 +0100
++++ src/org/xml/sax/helpers/NewInstance.java 2013-04-16 14:29:26.569394704 +0100
+@@ -54,9 +54,10 @@
+ * including versions of Java 2.
+ *
+ * @author Edwin Goei, David Brownell
++ * @version 2.0.1 (sax2r2)
+ */
+ class NewInstance {
+-
++ private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
+ /**
+ * Creates a new instance of the specified class name
+ *
+@@ -66,8 +67,16 @@
+ throws ClassNotFoundException, IllegalAccessException,
+ InstantiationException
+ {
++ // make sure we have access to restricted packages
++ boolean internal = false;
++ if (System.getSecurityManager() != null) {
++ if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
++ internal = true;
++ }
++ }
++
+ Class driverClass;
+- if (classLoader == null) {
++ if (classLoader == null || internal) {
+ driverClass = Class.forName(className);
+ } else {
+ driverClass = classLoader.loadClass(className);
+@@ -75,29 +84,4 @@
+ return driverClass.newInstance();
+ }
+
+- /**
+- * Figure out which ClassLoader to use. For JDK 1.2 and later use
+- * the context ClassLoader.
+- */
+- static ClassLoader getClassLoader ()
+- {
+- Method m = null;
+-
+- try {
+- m = Thread.class.getMethod("getContextClassLoader", (Class[]) null);
+- } catch (NoSuchMethodException e) {
+- // Assume that we are running JDK 1.1, use the current ClassLoader
+- return NewInstance.class.getClassLoader();
+- }
+-
+- try {
+- return (ClassLoader) m.invoke(Thread.currentThread(), (Object[]) null);
+- } catch (IllegalAccessException e) {
+- // assert(false)
+- throw new UnknownError(e.getMessage());
+- } catch (InvocationTargetException e) {
+- // assert(e.getTargetException() instanceof SecurityException)
+- throw new UnknownError(e.getMessage());
+- }
+- }
+ }
+--- src/org/xml/sax/helpers/ParserAdapter.java 2013-04-16 14:28:09.836158291 +0100
++++ src/org/xml/sax/helpers/ParserAdapter.java 2013-04-16 14:29:26.569394704 +0100
+@@ -74,13 +74,14 @@
+ *
+ * @since SAX 2.0
+ * @author David Megginson
++ * @version 2.0.1 (sax2r2)
+ * @see org.xml.sax.helpers.XMLReaderAdapter
+ * @see org.xml.sax.XMLReader
+ * @see org.xml.sax.Parser
+ */
+ public class ParserAdapter implements XMLReader, DocumentHandler
+ {
+-
++ private static SecuritySupport ss = new SecuritySupport();
+
+ ////////////////////////////////////////////////////////////////////
+ // Constructors.
+@@ -102,7 +103,7 @@
+ {
+ super();
+
+- String driver = System.getProperty("org.xml.sax.parser");
++ String driver = ss.getSystemProperty("org.xml.sax.parser");
+
+ try {
+ setup(ParserFactory.makeParser());
+--- src/org/xml/sax/helpers/ParserFactory.java 2013-04-16 14:28:09.836158291 +0100
++++ src/org/xml/sax/helpers/ParserFactory.java 2013-04-16 14:29:26.569394704 +0100
+@@ -30,12 +30,6 @@
+
+ package org.xml.sax.helpers;
+
+-import java.lang.ClassNotFoundException;
+-import java.lang.IllegalAccessException;
+-import java.lang.InstantiationException;
+-import java.lang.SecurityException;
+-import java.lang.ClassCastException;
+-
+ import org.xml.sax.Parser;
+
+
+@@ -69,9 +63,10 @@
+ * interface.
+ * @since SAX 1.0
+ * @author David Megginson
++ * @version 2.0.1 (sax2r2)
+ */
+ public class ParserFactory {
+-
++ private static SecuritySupport ss = new SecuritySupport();
+
+ /**
+ * Private null constructor.
+@@ -109,7 +104,7 @@
+ NullPointerException,
+ ClassCastException
+ {
+- String className = System.getProperty("org.xml.sax.parser");
++ String className = ss.getSystemProperty("org.xml.sax.parser");
+ if (className == null) {
+ throw new NullPointerException("No value for sax.parser property");
+ } else {
+@@ -146,7 +141,7 @@
+ ClassCastException
+ {
+ return (Parser) NewInstance.newInstance (
+- NewInstance.getClassLoader (), className);
++ ss.getContextClassLoader(), className);
+ }
+
+ }
+--- src/org/xml/sax/helpers/SecuritySupport.java 1970-01-01 01:00:00.000000000 +0100
++++ src/org/xml/sax/helpers/SecuritySupport.java 2013-04-16 14:29:26.569394704 +0100
+@@ -0,0 +1,108 @@
++/*
++ * Copyright (c) 2004, 2006, Oracle and/or its affiliates. All rights reserved.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package org.xml.sax.helpers;
++
++import java.io.*;
++import java.security.*;
++
++/**
++ * This class is duplicated for each JAXP subpackage so keep it in sync.
++ * It is package private and therefore is not exposed as part of the JAXP
++ * API.
++ *
++ * Security related methods that only work on J2SE 1.2 and newer.
++ */
++class SecuritySupport {
++
++
++ ClassLoader getContextClassLoader() throws SecurityException{
++ return (ClassLoader)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ ClassLoader cl = null;
++ //try {
++ cl = Thread.currentThread().getContextClassLoader();
++ //} catch (SecurityException ex) { }
++
++ if (cl == null)
++ cl = ClassLoader.getSystemClassLoader();
++
++ return cl;
++ }
++ });
++ }
++
++ String getSystemProperty(final String propName) {
++ return (String)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ return System.getProperty(propName);
++ }
++ });
++ }
++
++ FileInputStream getFileInputStream(final File file)
++ throws FileNotFoundException
++ {
++ try {
++ return (FileInputStream)
++ AccessController.doPrivileged(new PrivilegedExceptionAction() {
++ public Object run() throws FileNotFoundException {
++ return new FileInputStream(file);
++ }
++ });
++ } catch (PrivilegedActionException e) {
++ throw (FileNotFoundException)e.getException();
++ }
++ }
++
++ InputStream getResourceAsStream(final ClassLoader cl,
++ final String name)
++ {
++ return (InputStream)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ InputStream ris;
++ if (cl == null) {
++ ris = Object.class.getResourceAsStream(name);
++ } else {
++ ris = cl.getResourceAsStream(name);
++ }
++ return ris;
++ }
++ });
++ }
++
++ boolean doesFileExist(final File f) {
++ return ((Boolean)
++ AccessController.doPrivileged(new PrivilegedAction() {
++ public Object run() {
++ return new Boolean(f.exists());
++ }
++ })).booleanValue();
++ }
++
++}
+--- src/org/xml/sax/helpers/XMLReaderFactory.java 2013-04-16 14:28:09.836158291 +0100
++++ src/org/xml/sax/helpers/XMLReaderFactory.java 2013-04-16 14:29:26.569394704 +0100
+@@ -34,8 +34,6 @@
+ import java.io.BufferedReader;
+ import java.io.InputStream;
+ import java.io.InputStreamReader;
+-import java.security.AccessController;
+-import java.security.PrivilegedAction;
+ import org.xml.sax.XMLReader;
+ import org.xml.sax.SAXException;
+
+@@ -85,8 +83,8 @@
+ }
+
+ private static final String property = "org.xml.sax.driver";
++ private static SecuritySupport ss = new SecuritySupport();
+
+- private static String _clsFromJar = null;
+ private static boolean _jarread = false;
+ /**
+ * Attempt to create an XMLReader from system defaults.
+@@ -134,43 +132,45 @@
+ throws SAXException
+ {
+ String className = null;
+- ClassLoader loader = NewInstance.getClassLoader ();
++ ClassLoader cl = ss.getContextClassLoader();
+
+ // 1. try the JVM-instance-wide system property
+- try { className = System.getProperty (property); }
+- catch (RuntimeException e) { /* normally fails for applets */ }
++ try {
++ className = ss.getSystemProperty(property);
++ }
++ catch (RuntimeException e) { /* continue searching */ }
+
+ // 2. if that fails, try META-INF/services/
+ if (className == null) {
+ if (!_jarread) {
+- final ClassLoader loader1 = loader;
+ _jarread = true;
+- _clsFromJar = (String)
+- AccessController.doPrivileged(new PrivilegedAction() {
+- public Object run() {
+- String clsName = null;
+- try {
+- String service = "META-INF/services/" + property;
+- InputStream in;
+- BufferedReader reader;
+- if (loader1 == null)
+- in = ClassLoader.getSystemResourceAsStream (service);
+- else
+- in = loader1.getResourceAsStream (service);
+-
+- if (in != null) {
+- reader = new BufferedReader (
+- new InputStreamReader (in, "UTF8"));
+- clsName = reader.readLine ();
+- in.close ();
+- }
+- } catch (Exception e) {
++ String service = "META-INF/services/" + property;
++ InputStream in;
++ BufferedReader reader;
++
++ try {
++ if (cl != null) {
++ in = ss.getResourceAsStream(cl, service);
++
++ // If no provider found then try the current ClassLoader
++ if (in == null) {
++ cl = null;
++ in = ss.getResourceAsStream(cl, service);
+ }
+- return clsName;
++ } else {
++ // No Context ClassLoader, try the current ClassLoader
++ in = ss.getResourceAsStream(cl, service);
+ }
+- });
++
++ if (in != null) {
++ reader = new BufferedReader (
++ new InputStreamReader (in, "UTF8"));
++ className = reader.readLine ();
++ in.close ();
++ }
++ } catch (Exception e) {
++ }
+ }
+- className = _clsFromJar;
+ }
+
+ // 3. Distro-specific fallback
+@@ -187,7 +187,7 @@
+
+ // do we know the XMLReader implementation class yet?
+ if (className != null)
+- return loadClass (loader, className);
++ return loadClass (cl, className);
+
+ // 4. panic -- adapt any SAX1 parser
+ try {
+@@ -217,7 +217,7 @@
+ public static XMLReader createXMLReader (String className)
+ throws SAXException
+ {
+- return loadClass (NewInstance.getClassLoader (), className);
++ return loadClass (ss.getContextClassLoader(), className);
+ }
+
+ private static XMLReader loadClass (ClassLoader loader, String className)
--- jdk/src/share/lib/security/java.security 2013-04-16 14:28:12.392199476 +0100
+++ jdk/src/share/lib/security/java.security 2013-04-16 14:29:26.545394318 +0100
@@ -130,10 +130,27 @@
package.access=sun.,\
com.sun.xml.internal.bind.,\
com.sun.xml.internal.org.jvnet.staxex.,\
+ com.sun.xml.internal.stream.,\
com.sun.xml.internal.ws.,\
com.sun.imageio.,\
com.sun.istack.internal.,\
- com.sun.jmx.
+ com.sun.jmx.,\
+ com.sun.org.apache.bcel.internal.,\
+ com.sun.org.apache.regexp.internal.,\
+ com.sun.org.apache.xerces.internal.,\
+ com.sun.org.apache.xpath.internal.,\
+ com.sun.org.apache.xalan.internal.extensions.,\
+ com.sun.org.apache.xalan.internal.lib.,\
+ com.sun.org.apache.xalan.internal.res.,\
+ com.sun.org.apache.xalan.internal.templates.,\
+ com.sun.org.apache.xalan.internal.xslt.,\
+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\
+ com.sun.org.apache.xalan.internal.xsltc.trax.,\
+ com.sun.org.apache.xalan.internal.xsltc.util.,\
+ com.sun.org.apache.xml.internal.res.,\
+ com.sun.org.apache.xml.internal.serializer.utils.,\
+ com.sun.org.apache.xml.internal.utils.
#
# List of comma-separated packages that start with or equal this string
@@ -148,10 +165,27 @@
package.definition=sun.,\
com.sun.xml.internal.bind.,\
com.sun.xml.internal.org.jvnet.staxex.,\
+ com.sun.xml.internal.stream.,\
com.sun.xml.internal.ws.,\
com.sun.imageio.,\
com.sun.istack.internal.,\
- com.sun.jmx.
+ com.sun.jmx.,\
+ com.sun.org.apache.bcel.internal.,\
+ com.sun.org.apache.regexp.internal.,\
+ com.sun.org.apache.xerces.internal.,\
+ com.sun.org.apache.xpath.internal.,\
+ com.sun.org.apache.xalan.internal.extensions.,\
+ com.sun.org.apache.xalan.internal.lib.,\
+ com.sun.org.apache.xalan.internal.res.,\
+ com.sun.org.apache.xalan.internal.templates.,\
+ com.sun.org.apache.xalan.internal.xslt.,\
+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\
+ com.sun.org.apache.xalan.internal.xsltc.trax.,\
+ com.sun.org.apache.xalan.internal.xsltc.util.,\
+ com.sun.org.apache.xml.internal.res.,\
+ com.sun.org.apache.xml.internal.serializer.utils.,\
+ com.sun.org.apache.xml.internal.utils.
#
# Determines whether this properties file can be appended to
--- jdk/src/share/lib/security/java.security-solaris 2013-04-16 14:28:12.396199540 +0100
+++ jdk/src/share/lib/security/java.security-solaris 2013-04-16 14:30:42.026610629 +0100
@@ -131,10 +131,27 @@
package.access=sun.,\
com.sun.xml.internal.bind.,\
com.sun.xml.internal.org.jvnet.staxex.,\
+ com.sun.xml.internal.stream.,\
com.sun.xml.internal.ws.,\
com.sun.imageio.
com.sun.istack.internal.,\
- com.sun.jmx.
+ com.sun.jmx.,\
+ com.sun.org.apache.bcel.internal.,\
+ com.sun.org.apache.regexp.internal.,\
+ com.sun.org.apache.xerces.internal.,\
+ com.sun.org.apache.xpath.internal.,\
+ com.sun.org.apache.xalan.internal.extensions.,\
+ com.sun.org.apache.xalan.internal.lib.,\
+ com.sun.org.apache.xalan.internal.res.,\
+ com.sun.org.apache.xalan.internal.templates.,\
+ com.sun.org.apache.xalan.internal.xslt.,\
+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\
+ com.sun.org.apache.xalan.internal.xsltc.trax.,\
+ com.sun.org.apache.xalan.internal.xsltc.util.,\
+ com.sun.org.apache.xml.internal.res.,\
+ com.sun.org.apache.xml.internal.serializer.utils.,\
+ com.sun.org.apache.xml.internal.utils.
#
# List of comma-separated packages that start with or equal this string
@@ -149,10 +166,27 @@
package.definition=sun.,\
com.sun.xml.internal.bind.,\
com.sun.xml.internal.org.jvnet.staxex.,\
+ com.sun.xml.internal.stream.,\
com.sun.xml.internal.ws.,\
com.sun.imageio.
com.sun.istack.internal.,\
- com.sun.jmx.
+ com.sun.jmx.,\
+ com.sun.org.apache.bcel.internal.,\
+ com.sun.org.apache.regexp.internal.,\
+ com.sun.org.apache.xerces.internal.,\
+ com.sun.org.apache.xpath.internal.,\
+ com.sun.org.apache.xalan.internal.extensions.,\
+ com.sun.org.apache.xalan.internal.lib.,\
+ com.sun.org.apache.xalan.internal.res.,\
+ com.sun.org.apache.xalan.internal.templates.,\
+ com.sun.org.apache.xalan.internal.xslt.,\
+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\
+ com.sun.org.apache.xalan.internal.xsltc.trax.,\
+ com.sun.org.apache.xalan.internal.xsltc.util.,\
+ com.sun.org.apache.xml.internal.res.,\
+ com.sun.org.apache.xml.internal.serializer.utils.,\
+ com.sun.org.apache.xml.internal.utils.
#
# Determines whether this properties file can be appended to
--- jdk/src/share/lib/security/java.security-windows 2013-04-16 14:28:12.396199540 +0100
+++ jdk/src/share/lib/security/java.security-windows 2013-04-16 14:31:35.027464728 +0100
@@ -131,10 +131,27 @@
package.access=sun.,\
com.sun.xml.internal.bind.,\
com.sun.xml.internal.org.jvnet.staxex.,\
+ com.sun.xml.internal.stream.,\
com.sun.xml.internal.ws.,\
com.sun.imageio.
com.sun.istack.internal.,\
- com.sun.jmx.
+ com.sun.jmx.,\
+ com.sun.org.apache.bcel.internal.,\
+ com.sun.org.apache.regexp.internal.,\
+ com.sun.org.apache.xerces.internal.,\
+ com.sun.org.apache.xpath.internal.,\
+ com.sun.org.apache.xalan.internal.extensions.,\
+ com.sun.org.apache.xalan.internal.lib.,\
+ com.sun.org.apache.xalan.internal.res.,\
+ com.sun.org.apache.xalan.internal.templates.,\
+ com.sun.org.apache.xalan.internal.xslt.,\
+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\
+ com.sun.org.apache.xalan.internal.xsltc.trax.,\
+ com.sun.org.apache.xalan.internal.xsltc.util.,\
+ com.sun.org.apache.xml.internal.res.,\
+ com.sun.org.apache.xml.internal.serializer.utils.,\
+ com.sun.org.apache.xml.internal.utils.
#
# List of comma-separated packages that start with or equal this string
@@ -149,10 +166,27 @@
package.definition=sun.,\
com.sun.xml.internal.bind.,\
com.sun.xml.internal.org.jvnet.staxex.,\
+ com.sun.xml.internal.stream.,\
com.sun.xml.internal.ws.,\
com.sun.imageio.
com.sun.istack.internal.,\
- com.sun.jmx.
+ com.sun.jmx.,\
+ com.sun.org.apache.bcel.internal.,\
+ com.sun.org.apache.regexp.internal.,\
+ com.sun.org.apache.xerces.internal.,\
+ com.sun.org.apache.xpath.internal.,\
+ com.sun.org.apache.xalan.internal.extensions.,\
+ com.sun.org.apache.xalan.internal.lib.,\
+ com.sun.org.apache.xalan.internal.res.,\
+ com.sun.org.apache.xalan.internal.templates.,\
+ com.sun.org.apache.xalan.internal.xslt.,\
+ com.sun.org.apache.xalan.internal.xsltc.cmdline.,\
+ com.sun.org.apache.xalan.internal.xsltc.compiler.,\
+ com.sun.org.apache.xalan.internal.xsltc.trax.,\
+ com.sun.org.apache.xalan.internal.xsltc.util.,\
+ com.sun.org.apache.xml.internal.res.,\
+ com.sun.org.apache.xml.internal.serializer.utils.,\
+ com.sun.org.apache.xml.internal.utils.
#
# Determines whether this properties file can be appended to