src/share/jaxws_classes/com/sun/tools/internal/xjc/SchemaCache.java

@@ -1,7 +1,7 @@
 /*
- * Copyright (c) 1997, 2011, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2012, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
  * under the terms of the GNU General Public License version 2 only, as
  * published by the Free Software Foundation.  Oracle designates this

@@ -29,12 +29,12 @@
 
 import javax.xml.validation.Schema;
 import javax.xml.validation.SchemaFactory;
 import javax.xml.validation.ValidatorHandler;
 
-import com.sun.xml.internal.bind.v2.WellKnownNamespace;
-
+import com.sun.xml.internal.bind.v2.util.XmlFactory;
+import javax.xml.XMLConstants;
 import org.xml.sax.SAXException;
 
 /**
  * Wraps a JAXP {@link Schema} object and lazily instantiate it.
  *

@@ -55,11 +55,13 @@
 
     public ValidatorHandler newValidator() {
         synchronized(this) {
             if(schema==null) {
                 try {
-                    schema = SchemaFactory.newInstance(WellKnownNamespace.XML_SCHEMA).newSchema(source);
+                    // do not disable secure processing - these are well-known schemas
+                    SchemaFactory sf = XmlFactory.createSchemaFactory(XMLConstants.W3C_XML_SCHEMA_NS_URI, false);
+                    schema = sf.newSchema(source);
                 } catch (SAXException e) {
                     // we make sure that the schema is correct before we ship.
                     throw new AssertionError(e);
                 }
             }