Re: 7u4 Request for approval for CR 7143711 - Feature added by 7053556 should override what's set by the constructor in secure mode

[Edvard Wendelin]

I'd be happy to approve it once the change has been reviewed by someone 
with Reviewer status.

Cheers,
Edvard
On 02/08/2012 11:27 PM, Joe Wang wrote:
Hi,

I committed a patch in 7u4 b07 that contained a patch done through 
7053556.  Within the patch, I added a convenient implementation 
feature to allow users to skip service mechanism for performance. I 
realized that in secure mode, this feature should not override what's 
set by the constructor.  This change request therefore is to add 
checks so that the flag will not be overridden in secure mode.  Please 
consider this is part of the change within 7u4.

Below are the changes:
Index: 
com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java
--- 
com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java 
Base (BASE)
+++ 
com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java 
Locally Modified (Based On LOCAL)
@@ -487,6 +487,8 @@
         return;
     }
         else if 
(name.equals(XalanConstants.ORACLE_FEATURE_SERVICE_MECHANISM)) {
+            //in secure mode, let _useServicesMechanism be determined 
by the constructor
+            if (!_isSecureMode)
             _useServicesMechanism = value;
         }
     else {
Index: com/sun/org/apache/xpath/internal/jaxp/XPathFactoryImpl.java
--- com/sun/org/apache/xpath/internal/jaxp/XPathFactoryImpl.java Base 
(BASE)
+++ com/sun/org/apache/xpath/internal/jaxp/XPathFactoryImpl.java 
Locally Modified (Based On LOCAL)
@@ -226,6 +226,8 @@
                 return;
             }
             if 
(name.equals(XalanConstants.ORACLE_FEATURE_SERVICE_MECHANISM)) {
+                //in secure mode, let _useServicesMechanism be 
determined by the constructor
+                if (!_isSecureMode)
                 _useServicesMechanism = value;
                 return;
             }
Index: 
com/sun/org/apache/xerces/internal/jaxp/validation/XMLSchemaFactory.java
--- 
com/sun/org/apache/xerces/internal/jaxp/validation/XMLSchemaFactory.java 
Base (BASE)
+++ 
com/sun/org/apache/xerces/internal/jaxp/validation/XMLSchemaFactory.java 
Locally Modified (Based On LOCAL)
@@ -390,6 +390,10 @@
             fSecurityManager = value ? new SecurityManager() : null;
             fXMLSchemaLoader.setProperty(SECURITY_MANAGER, 
fSecurityManager);
             return;
+        } else if 
(name.equals(Constants.ORACLE_FEATURE_SERVICE_MECHANISM)) {
+            //in secure mode, let _useServicesMechanism be determined 
by the constructor
+            if (System.getSecurityManager() != null)
+                return;
         }
         try {
             fXMLSchemaLoader.setFeature(name, value);

Thanks,
Joe