Restrict access to the protocols specified for external references set by the stylesheet processing instruction, Import and Include element, and document function. If access is denied due to the restriction of this property, a runtime exception that is specific to the context is thrown. In the case of constructing new
Transformer for example,
TransformerConfigurationException will be thrown by the
Value: a list of protocols separated by comma. A protocol is the scheme portion of a
URI, or in the case of the JAR protocol, "jar" plus the scheme portion separated by colon. A scheme is defined as:
scheme = alpha *( alpha | digit | "+" | "-" | "." )
where alpha = a-z and A-Z.
And the JAR protocol:
Protocols including the keyword "jar" are case-insensitive. Any whitespaces as defined by
Character.isSpaceChar(char) in the value will be ignored. Examples of protocols are file, http, jar:file.
Default value: The default value is implementation specific and therefore not specified. The following options are provided for consideration:
- an empty string to deny all access to external references;
- a specific protocol, such as file, to give permission to only the protocol;
- the keyword "all" to grant permission to all protocols.
When FEATURE_SECURE_PROCESSING is enabled, it is recommended that implementations restrict external connections by default, though this may cause problems for applications that process XML/XSD/XSL with external references.
Granting all access: the keyword "all" grants permission to all protocols.
System Property: The value of this property can be set or overridden by system property
jaxp.properties: This configuration file is in standard
Properties format and typically located in the
conf directory of the Java installation. If the file exists and the system property is specified, its value will be used to override the default of the property.