src/com/sun/org/apache/xalan/internal/utils/SecuritySupport.java

*** 227,237 ****
       * @param allowedProtocols a list of allowed protocols separated by comma
       * @param accessAny keyword to indicate allowing any protocol
       * @return the name of the protocol if rejected, null otherwise
       */
      public static String checkAccess(String systemId, String allowedProtocols, String accessAny) throws IOException {
!         if (systemId == null || allowedProtocols.equalsIgnoreCase(accessAny)) {
              return null;
          }
  
          String protocol;
          if (systemId.indexOf(":")==-1) {
--- 227,238 ----
       * @param allowedProtocols a list of allowed protocols separated by comma
       * @param accessAny keyword to indicate allowing any protocol
       * @return the name of the protocol if rejected, null otherwise
       */
      public static String checkAccess(String systemId, String allowedProtocols, String accessAny) throws IOException {
!         if (systemId == null || (allowedProtocols != null && 
!                 allowedProtocols.equalsIgnoreCase(accessAny))) {
              return null;
          }
  
          String protocol;
          if (systemId.indexOf(":")==-1) {
*** 260,269 ****
--- 261,273 ----
       * @param protocol a protocol
       * @param allowedProtocols a list of allowed protocols
       * @return true if the protocol is in the list
       */
      private static boolean isProtocolAllowed(String protocol, String allowedProtocols) {
+          if (allowedProtocols == null) {
+              return false;
+          }
           String temp[] = allowedProtocols.split(",");
           for (String t : temp) {
               t = t.trim();
               if (t.equalsIgnoreCase(protocol)) {
                   return true;
*** 271,293 ****
           }
           return false;
       }
  
      /**
!      * Read from $java.home/lib/jaxp.properties for the specified property
       *
       * @param propertyId the Id of the property
       * @return the value of the property
       */
!     public static String getDefaultAccessProperty(String sysPropertyId, String defaultVal) {
!         String accessExternal = SecuritySupport.getSystemProperty(sysPropertyId);
          if (accessExternal == null) {
              accessExternal = readJAXPProperty(sysPropertyId);
-             if (accessExternal == null) {
-                 accessExternal = defaultVal;
              }
-         }
          return accessExternal;
      }
  
      /**
       * Read from $java.home/lib/jaxp.properties for the specified property
--- 275,295 ----
           }
           return false;
       }
  
      /**
!      * Read JAXP system property in this order: system property,
!      * $java.home/lib/jaxp.properties if the system property is not specified
       *
       * @param propertyId the Id of the property
       * @return the value of the property
       */
!     public static String getJAXPSystemProperty(String sysPropertyId) {
!         String accessExternal = getSystemProperty(sysPropertyId);
          if (accessExternal == null) {
              accessExternal = readJAXPProperty(sysPropertyId);
          }
          return accessExternal;
      }
  
      /**
       * Read from $java.home/lib/jaxp.properties for the specified property