src/share/jaxws_classes/com/sun/tools/internal/xjc/ModelLoader.java

@@ -1,7 +1,7 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this

@@ -45,16 +45,15 @@
 import com.sun.tools.internal.xjc.reader.xmlschema.parser.CustomizationContextChecker;
 import com.sun.tools.internal.xjc.reader.xmlschema.parser.IncorrectNamespaceURIChecker;
 import com.sun.tools.internal.xjc.reader.xmlschema.parser.SchemaConstraintChecker;
 import com.sun.tools.internal.xjc.reader.xmlschema.parser.XMLSchemaInternalizationLogic;
 import com.sun.tools.internal.xjc.util.ErrorReceiverFilter;
+import com.sun.xml.internal.bind.v2.util.XmlFactory;
 import com.sun.xml.internal.xsom.XSSchemaSet;
 import com.sun.xml.internal.xsom.parser.JAXPParser;
 import com.sun.xml.internal.xsom.parser.XMLParser;
 import com.sun.xml.internal.xsom.parser.XSOMParser;
-import java.net.URI;
-import java.net.URISyntaxException;
 import javax.xml.XMLConstants;
 
 import com.sun.xml.internal.rngom.ast.builder.SchemaBuilder;
 import com.sun.xml.internal.rngom.ast.util.CheckingSchemaBuilder;
 import com.sun.xml.internal.rngom.digested.DPattern;

@@ -296,11 +295,11 @@
      */
     public DOMForest buildDOMForest( InternalizationLogic logic )
         throws SAXException {
 
         // parse into DOM forest
-        DOMForest forest = new DOMForest(logic);
+        DOMForest forest = new DOMForest(logic, opt);
 
         forest.setErrorHandler(errorReceiver);
         if(opt.entityResolver!=null)
         forest.setEntityResolver(opt.entityResolver);
 

@@ -341,21 +340,21 @@
     /**
      * Parses a set of XML Schema files into an annotated grammar.
      */
     public XSSchemaSet loadXMLSchema() throws SAXException {
 
-        if( opt.strictCheck && !SchemaConstraintChecker.check(opt.getGrammars(),errorReceiver,opt.entityResolver)) {
+        if( opt.strictCheck && !SchemaConstraintChecker.check(opt.getGrammars(),errorReceiver,opt.entityResolver, opt.disableXmlSecurity)) {
             // schema error. error should have been reported
             return null;
         }
 
         if(opt.getBindFiles().length==0) {
             // no external binding. try the speculative no DOMForest execution,
             // which is faster if the speculation succeeds.
             try {
                 return createXSOMSpeculative();
-            } catch( SpeculationFailure _ ) {
+            } catch( SpeculationFailure e) {
                 // failed. go the slow way
             }
         }
 
         // the default slower way is to parse everything into DOM first.

@@ -409,10 +408,17 @@
         if (xs == null)
             return null;
         return BGMBuilder.build(xs, codeModel, errorReceiver, opt);
     }
 
+    /**
+     * Potentially problematic - make sure the parser instance passed is initialized
+     * with proper security feature.
+     *
+     * @param parser
+     * @return
+     */
     public XSOMParser createXSOMParser(XMLParser parser) {
         // set up other parameters to XSOMParser
         XSOMParser reader = new XSOMParser(new XMLSchemaParser(parser));
         reader.setAnnotationParser(new AnnotationParserFactoryImpl(opt));
         reader.setErrorHandler(errorReceiver);

@@ -463,11 +469,11 @@
     private XSSchemaSet createXSOMSpeculative() throws SAXException, SpeculationFailure {
 
         // check if the schema contains external binding files. If so, speculation is a failure.
 
         XMLParser parser = new XMLParser() {
-            private final JAXPParser base = new JAXPParser();
+            private final JAXPParser base = new JAXPParser(XmlFactory.createParserFactory(opt.disableXmlSecurity));
 
             public void parse(InputSource source, ContentHandler handler,
                 ErrorHandler errorHandler, EntityResolver entityResolver ) throws SAXException, IOException {
                 // set up the chain of handlers.
                 handler = wrapBy( new SpeculationChecker(), handler );