src/com/sun/org/apache/xerces/internal/jaxp/validation/XMLSchemaFactory.java

*** 362,375 ****
              if (System.getSecurityManager() != null && (!value)) {
                  throw new SAXNotSupportedException(
                          SAXMessageFormatter.formatMessage(null,
                          "jaxp-secureprocessing-feature", null));
              }
!             fSecurityManager = value ? new SecurityManager() : null;
!             fXMLSchemaLoader.setProperty(SECURITY_MANAGER, fSecurityManager);
              fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_DTD, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
              fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_SCHEMA, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
              return;
          } else if (name.equals(Constants.ORACLE_FEATURE_SERVICE_MECHANISM)) {
              //in secure mode, let _useServicesMechanism be determined by the constructor
              if (System.getSecurityManager() != null)
                  return;
--- 362,380 ----
              if (System.getSecurityManager() != null && (!value)) {
                  throw new SAXNotSupportedException(
                          SAXMessageFormatter.formatMessage(null,
                          "jaxp-secureprocessing-feature", null));
              }
!             if (value) {
!                 fSecurityManager = new SecurityManager();
                  fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_DTD, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
                  fXMLSchemaLoader.setProperty(ACCESS_EXTERNAL_SCHEMA, Constants.EXTERNAL_ACCESS_DEFAULT_FSP);
+             } else {
+                 fSecurityManager = null;
+             }
+ 
+             fXMLSchemaLoader.setProperty(SECURITY_MANAGER, fSecurityManager);
              return;
          } else if (name.equals(Constants.ORACLE_FEATURE_SERVICE_MECHANISM)) {
              //in secure mode, let _useServicesMechanism be determined by the constructor
              if (System.getSecurityManager() != null)
                  return;