A few weeks ago I finally figured out how to stop JaxB from
downloading DTD and XSD files, and even wrote about it on my blog
(http://iq80.com/2007/10/disable-dtd-and-xsd-downloading.html). The
funny thing is, I swear I sent an email to this list about the fix,
but David pointed out to me yesterday that it never made it here.
Anyway, the trick it to return a empty InputStream from
EntityResolver.resolveEntity() method. This is a really strange API
because the empty stream is a kind of signal return value that means
everything is ok, but there is not DTD. If you return null, it is
interpreted as a "request that the parser open a regular URI
connection to the system identifier" which mean try to download.
Very lame, but it is finally fixed :)
-dain
