changeset 523:38d4d23d167c jdk7u21-b03

6657673: Issues with JAXP Reviewed-by: alanb, lancea, ahgross, mullan
author joehw
date Sat, 16 Feb 2013 18:03:23 -0800
parents 06a2338c0fb7
children acde12ee462d
files src/com/sun/org/apache/bcel/internal/classfile/JavaClass.java src/com/sun/org/apache/bcel/internal/util/Class2HTML.java src/com/sun/org/apache/bcel/internal/util/ClassPath.java src/com/sun/org/apache/bcel/internal/util/JavaWrapper.java src/com/sun/org/apache/bcel/internal/util/SecuritySupport.java src/com/sun/org/apache/xalan/internal/res/XSLMessages.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_de.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_es.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_fr.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_it.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ja.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ko.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_pt_BR.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_sv.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_CN.java src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_TW.java src/com/sun/org/apache/xalan/internal/utils/ObjectFactory.java src/com/sun/org/apache/xalan/internal/utils/SecuritySupport.java src/com/sun/org/apache/xalan/internal/xslt/EnvironmentCheck.java src/com/sun/org/apache/xalan/internal/xslt/Process.java src/com/sun/org/apache/xalan/internal/xsltc/compiler/Parser.java src/com/sun/org/apache/xalan/internal/xsltc/compiler/XSLTC.java src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMessages.java src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMsg.java src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/Util.java src/com/sun/org/apache/xalan/internal/xsltc/dom/NodeSortRecord.java src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java src/com/sun/org/apache/xalan/internal/xsltc/runtime/output/WriterOutputBuffer.java src/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java src/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java src/com/sun/org/apache/xerces/internal/dom/DOMMessageFormatter.java src/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java src/com/sun/org/apache/xerces/internal/impl/dv/DatatypeException.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_de.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_es.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_fr.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_it.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_ja.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_ko.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_pt_BR.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_sv.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_zh_CN.java src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_zh_TW.java src/com/sun/org/apache/xerces/internal/impl/xpath/regex/RegexParser.java src/com/sun/org/apache/xerces/internal/impl/xs/XSMessageFormatter.java src/com/sun/org/apache/xerces/internal/jaxp/validation/JAXPValidationMessageFormatter.java src/com/sun/org/apache/xerces/internal/util/DatatypeMessageFormatter.java src/com/sun/org/apache/xerces/internal/util/SAXMessageFormatter.java src/com/sun/org/apache/xerces/internal/util/SecurityManager.java src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java src/com/sun/org/apache/xerces/internal/utils/SecuritySupport.java src/com/sun/org/apache/xerces/internal/xinclude/XIncludeMessageFormatter.java src/com/sun/org/apache/xerces/internal/xpointer/XPointerMessageFormatter.java src/com/sun/org/apache/xml/internal/dtm/DTMManager.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ca.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_cs.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_de.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_es.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_fr.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_it.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ja.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ko.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_pt_BR.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sk.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sv.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_tr.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_CN.java src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_TW.java src/com/sun/org/apache/xml/internal/res/XMLMessages.java src/com/sun/org/apache/xml/internal/resolver/Catalog.java src/com/sun/org/apache/xml/internal/resolver/CatalogManager.java src/com/sun/org/apache/xml/internal/resolver/Resolver.java src/com/sun/org/apache/xml/internal/serialize/SerializerFactory.java src/com/sun/org/apache/xml/internal/serializer/Encodings.java src/com/sun/org/apache/xml/internal/serializer/OutputPropertiesFactory.java src/com/sun/org/apache/xml/internal/serializer/ToStream.java src/com/sun/org/apache/xml/internal/serializer/TreeWalker.java src/com/sun/org/apache/xml/internal/serializer/utils/Messages.java src/com/sun/org/apache/xml/internal/utils/TreeWalker.java src/com/sun/org/apache/xml/internal/utils/res/XResourceBundle.java src/com/sun/org/apache/xpath/internal/functions/FuncSystemProperty.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_de.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_es.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_fr.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_it.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ja.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ko.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_pt_BR.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_sv.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_CN.java src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_TW.java src/com/sun/org/apache/xpath/internal/res/XPATHMessages.java src/com/sun/xml/internal/stream/XMLEntityStorage.java src/com/sun/xml/internal/stream/writers/WriterUtility.java src/com/sun/xml/internal/stream/writers/XMLStreamWriterImpl.java src/javax/xml/datatype/FactoryFinder.java src/javax/xml/parsers/FactoryFinder.java src/javax/xml/stream/FactoryFinder.java src/javax/xml/transform/FactoryFinder.java src/javax/xml/validation/SchemaFactoryFinder.java src/javax/xml/xpath/XPathFactoryFinder.java src/org/w3c/dom/bootstrap/DOMImplementationRegistry.java src/org/xml/sax/helpers/NewInstance.java src/org/xml/sax/helpers/ParserAdapter.java src/org/xml/sax/helpers/ParserFactory.java src/org/xml/sax/helpers/SecuritySupport.java src/org/xml/sax/helpers/XMLReaderFactory.java
diffstat 111 files changed, 1139 insertions(+), 3262 deletions(-) [+]
line wrap: on
line diff
--- a/src/com/sun/org/apache/bcel/internal/classfile/JavaClass.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/bcel/internal/classfile/JavaClass.java	Sat Feb 16 18:03:23 2013 -0800
@@ -63,6 +63,7 @@
 import  com.sun.org.apache.bcel.internal.util.ClassVector;
 import  com.sun.org.apache.bcel.internal.util.ClassQueue;
 import  com.sun.org.apache.bcel.internal.generic.Type;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 
 import  java.io.*;
 import  java.util.StringTokenizer;
@@ -77,6 +78,7 @@
  * class file.  Those interested in programatically generating classes
  * should see the <a href="../generic/ClassGen.html">ClassGen</a> class.
 
+ * @version $Id: JavaClass.java,v 1.4 2007-07-19 04:34:42 ofung Exp $
  * @see com.sun.org.apache.bcel.internal.generic.ClassGen
  * @author  <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A>
  */
@@ -451,9 +453,9 @@
     String debug = null, sep = null;
 
     try {
-      debug = System.getProperty("JavaClass.debug");
+      debug = SecuritySupport.getSystemProperty("JavaClass.debug");
       // Get path separator either / or \ usually
-      sep = System.getProperty("file.separator");
+      sep = SecuritySupport.getSystemProperty("file.separator");
     }
     catch (SecurityException e) {
         // falls through
--- a/src/com/sun/org/apache/bcel/internal/util/Class2HTML.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/bcel/internal/util/Class2HTML.java	Sat Feb 16 18:03:23 2013 -0800
@@ -82,6 +82,7 @@
  * method in the Method's frame will jump to the appropiate method in
  * the Code frame.
  *
+ * @version $Id: Class2HTML.java,v 1.3 2007-07-19 04:34:52 ofung Exp $
  * @author <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A>
 */
 public class Class2HTML implements Constants
@@ -137,7 +138,7 @@
     ClassParser parser=null;
     JavaClass   java_class=null;
     String      zip_file = null;
-    char        sep = System.getProperty("file.separator").toCharArray()[0];
+    char        sep = SecuritySupport.getSystemProperty("file.separator").toCharArray()[0];
     String      dir = "." + sep; // Where to store HTML files
 
     try {
--- a/src/com/sun/org/apache/bcel/internal/util/ClassPath.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/bcel/internal/util/ClassPath.java	Sat Feb 16 18:03:23 2013 -0800
@@ -66,6 +66,7 @@
  * Responsible for loading (class) files from the CLASSPATH. Inspired by
  * sun.tools.ClassPath.
  *
+ * @version $Id: ClassPath.java,v 1.4 2007-07-19 04:34:52 ofung Exp $
  * @author  <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A>
  */
 public class ClassPath implements Serializable {
@@ -83,7 +84,7 @@
     ArrayList vec = new ArrayList();
 
     for(StringTokenizer tok=new StringTokenizer(class_path,
-                                                System.getProperty("path.separator"));
+                            SecuritySupport.getSystemProperty("path.separator"));
         tok.hasMoreTokens();)
     {
       String path = tok.nextToken();
@@ -92,7 +93,7 @@
         File file = new File(path);
 
         try {
-          if(file.exists()) {
+          if(SecuritySupport.getFileExists(file)) {
             if(file.isDirectory())
               vec.add(new Dir(path));
             else
@@ -143,8 +144,9 @@
         String name = tok.nextToken();
         File   file = new File(name);
 
-        if(file.exists())
+        if(SecuritySupport.getFileExists(file)) {
           list.add(name);
+        }
       }
     }
   }
@@ -159,9 +161,9 @@
     String class_path, boot_path, ext_path;
 
     try {
-      class_path = System.getProperty("java.class.path");
-      boot_path  = System.getProperty("sun.boot.class.path");
-      ext_path   = System.getProperty("java.ext.dirs");
+      class_path = SecuritySupport.getSystemProperty("java.class.path");
+      boot_path  = SecuritySupport.getSystemProperty("sun.boot.class.path");
+      ext_path   = SecuritySupport.getSystemProperty("java.ext.dirs");
     }
     catch (SecurityException e) {
         return "";
@@ -176,8 +178,8 @@
     getPathComponents(ext_path, dirs);
 
     for(Iterator e = dirs.iterator(); e.hasNext(); ) {
-      File     ext_dir    = new File((String)e.next());
-      String[] extensions = ext_dir.list(new FilenameFilter() {
+      File ext_dir = new File((String)e.next());
+      String[] extensions = SecuritySupport.getFileList(ext_dir, new FilenameFilter() {
         public boolean accept(File dir, String name) {
           name = name.toLowerCase();
           return name.endsWith(".zip") || name.endsWith(".jar");
@@ -342,7 +344,7 @@
       final File file = new File(dir + File.separatorChar +
                                  name.replace('.', File.separatorChar) + suffix);
 
-      return file.exists()? new ClassFile() {
+      return SecuritySupport.getFileExists(file)? new ClassFile() {
         public InputStream getInputStream() throws IOException { return new FileInputStream(file); }
 
         public String      getPath()        { try {
--- a/src/com/sun/org/apache/bcel/internal/util/JavaWrapper.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/bcel/internal/util/JavaWrapper.java	Sat Feb 16 18:03:23 2013 -0800
@@ -72,6 +72,7 @@
  * <pre>java com.sun.org.apache.bcel.internal.util.JavaWrapper -Dbcel.classloader=foo.MyLoader &lt;real.class.name&gt; [arguments]</pre>
  * </p>
  *
+ * @version $Id: JavaWrapper.java,v 1.3 2007-07-19 04:34:52 ofung Exp $
  * @author  <A HREF="mailto:markus.dahm@berlin.de">M. Dahm</A>
  * @see ClassLoader
  */
@@ -79,7 +80,7 @@
   private java.lang.ClassLoader loader;
 
   private static java.lang.ClassLoader getClassLoader() {
-    String s = System.getProperty("bcel.classloader");
+    String s = SecuritySupport.getSystemProperty("bcel.classloader");
 
     if((s == null) || "".equals(s))
       s = "com.sun.org.apache.bcel.internal.util.ClassLoader";
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/com/sun/org/apache/bcel/internal/util/SecuritySupport.java	Sat Feb 16 18:03:23 2013 -0800
@@ -0,0 +1,223 @@
+/*
+ * reserved comment block
+ * DO NOT REMOVE OR ALTER!
+ */
+/*
+ * Copyright 2002-2004 The Apache Software Foundation.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package com.sun.org.apache.bcel.internal.util;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FilenameFilter;
+import java.io.InputStream;
+import java.lang.ClassLoader;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.ListResourceBundle;
+import java.util.Locale;
+import java.util.MissingResourceException;
+import java.util.ResourceBundle;
+
+/**
+ * This class is duplicated for each subpackage so keep it in sync. It is
+ * package private and therefore is not exposed as part of any API.
+ *
+ * @xerces.internal
+ */
+public final class SecuritySupport {
+
+    private static final SecuritySupport securitySupport = new SecuritySupport();
+
+    /**
+     * Return an instance of this class.
+     */
+    public static SecuritySupport getInstance() {
+        return securitySupport;
+    }
+
+    static ClassLoader getContextClassLoader() {
+        return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                ClassLoader cl = null;
+                try {
+                    cl = Thread.currentThread().getContextClassLoader();
+                } catch (SecurityException ex) {
+                }
+                return cl;
+            }
+        });
+    }
+
+    static ClassLoader getSystemClassLoader() {
+        return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                ClassLoader cl = null;
+                try {
+                    cl = ClassLoader.getSystemClassLoader();
+                } catch (SecurityException ex) {
+                }
+                return cl;
+            }
+        });
+    }
+
+    static ClassLoader getParentClassLoader(final ClassLoader cl) {
+        return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                ClassLoader parent = null;
+                try {
+                    parent = cl.getParent();
+                } catch (SecurityException ex) {
+                }
+
+                // eliminate loops in case of the boot
+                // ClassLoader returning itself as a parent
+                return (parent == cl) ? null : parent;
+            }
+        });
+    }
+
+    public static String getSystemProperty(final String propName) {
+        return (String) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                return System.getProperty(propName);
+            }
+        });
+    }
+
+    static FileInputStream getFileInputStream(final File file)
+            throws FileNotFoundException {
+        try {
+            return (FileInputStream) AccessController.doPrivileged(new PrivilegedExceptionAction() {
+                public Object run() throws FileNotFoundException {
+                    return new FileInputStream(file);
+                }
+            });
+        } catch (PrivilegedActionException e) {
+            throw (FileNotFoundException) e.getException();
+        }
+    }
+
+    /**
+     * Return resource using the same classloader for the ObjectFactory by
+     * default or bootclassloader when Security Manager is in place
+     */
+    public static InputStream getResourceAsStream(final String name) {
+        if (System.getSecurityManager() != null) {
+            return getResourceAsStream(null, name);
+        } else {
+            return getResourceAsStream(findClassLoader(), name);
+        }
+    }
+
+    public static InputStream getResourceAsStream(final ClassLoader cl,
+            final String name) {
+        return (InputStream) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                InputStream ris;
+                if (cl == null) {
+                    ris = Object.class.getResourceAsStream("/" + name);
+                } else {
+                    ris = cl.getResourceAsStream(name);
+                }
+                return ris;
+            }
+        });
+    }
+
+    /**
+     * Gets a resource bundle using the specified base name, the default locale,
+     * and the caller's class loader.
+     *
+     * @param bundle the base name of the resource bundle, a fully qualified
+     * class name
+     * @return a resource bundle for the given base name and the default locale
+     */
+    public static ListResourceBundle getResourceBundle(String bundle) {
+        return getResourceBundle(bundle, Locale.getDefault());
+    }
+
+    /**
+     * Gets a resource bundle using the specified base name and locale, and the
+     * caller's class loader.
+     *
+     * @param bundle the base name of the resource bundle, a fully qualified
+     * class name
+     * @param locale the locale for which a resource bundle is desired
+     * @return a resource bundle for the given base name and locale
+     */
+    public static ListResourceBundle getResourceBundle(final String bundle, final Locale locale) {
+        return AccessController.doPrivileged(new PrivilegedAction<ListResourceBundle>() {
+            public ListResourceBundle run() {
+                try {
+                    return (ListResourceBundle) ResourceBundle.getBundle(bundle, locale);
+                } catch (MissingResourceException e) {
+                    try {
+                        return (ListResourceBundle) ResourceBundle.getBundle(bundle, new Locale("en", "US"));
+                    } catch (MissingResourceException e2) {
+                        throw new MissingResourceException(
+                                "Could not load any resource bundle by " + bundle, bundle, "");
+                    }
+                }
+            }
+        });
+    }
+
+    public static String[] getFileList(final File f, final FilenameFilter filter) {
+        return ((String[]) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                return f.list(filter);
+            }
+        }));
+    }
+
+    public static boolean getFileExists(final File f) {
+        return ((Boolean) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                return f.exists() ? Boolean.TRUE : Boolean.FALSE;
+            }
+        })).booleanValue();
+    }
+
+    static long getLastModified(final File f) {
+        return ((Long) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                return new Long(f.lastModified());
+            }
+        })).longValue();
+    }
+
+
+    /**
+     * Figure out which ClassLoader to use.
+     */
+    public static ClassLoader findClassLoader()
+    {
+        if (System.getSecurityManager()!=null) {
+            //this will ensure bootclassloader is used
+            return null;
+        } else {
+            return SecuritySupport.class.getClassLoader();
+        }
+    } // findClassLoader():ClassLoader
+
+    private SecuritySupport() {
+    }
+}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLMessages.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLMessages.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,68 +22,72 @@
  */
 package com.sun.org.apache.xalan.internal.res;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.util.ListResourceBundle;
 
 import com.sun.org.apache.xpath.internal.res.XPATHMessages;
 
 /**
- * Sets things up for issuing error messages.  This class is misnamed, and
- * should be called XalanMessages, or some such.
+ * Sets things up for issuing error messages. This class is misnamed, and should
+ * be called XalanMessages, or some such.
+ *
  * @xsl.usage internal
  */
-public class XSLMessages extends XPATHMessages
-{
+public class XSLMessages extends XPATHMessages {
 
-  /** The language specific resource object for Xalan messages.  */
-  private static ListResourceBundle XSLTBundle = null;
+    /**
+     * The language specific resource object for Xalan messages.
+     */
+    private static ListResourceBundle XSLTBundle = null;
+    /**
+     * The class name of the Xalan error message string table.
+     */
+    private static final String XSLT_ERROR_RESOURCES =
+            "com.sun.org.apache.xalan.internal.res.XSLTErrorResources";
 
-  /** The class name of the Xalan error message string table.    */
-  private static final String XSLT_ERROR_RESOURCES =
-    "com.sun.org.apache.xalan.internal.res.XSLTErrorResources";
+    /**
+     * Creates a message from the specified key and replacement arguments,
+     * localized to the given locale.
+     *
+     * @param msgKey The key for the message text.
+     * @param args The arguments to be used as replacement text in the message
+     * created.
+     *
+     * @return The formatted message string.
+     */
+    public static String createMessage(String msgKey, Object args[]) //throws Exception
+    {
+        if (XSLTBundle == null) {
+            XSLTBundle = SecuritySupport.getResourceBundle(XSLT_ERROR_RESOURCES);
+        }
 
-  /**
-   * Creates a message from the specified key and replacement
-   * arguments, localized to the given locale.
-   *
-   * @param msgKey    The key for the message text.
-   * @param args      The arguments to be used as replacement text
-   *                  in the message created.
-   *
-   * @return The formatted message string.
-   */
-  public static final String createMessage(String msgKey, Object args[])  //throws Exception
-  {
-    if (XSLTBundle == null)
-      XSLTBundle = loadResourceBundle(XSLT_ERROR_RESOURCES);
+        if (XSLTBundle != null) {
+            return createMsg(XSLTBundle, msgKey, args);
+        } else {
+            return "Could not load any resource bundles.";
+        }
+    }
 
-    if (XSLTBundle != null)
+    /**
+     * Creates a message from the specified key and replacement arguments,
+     * localized to the given locale.
+     *
+     * @param msgKey The key for the message text.
+     * @param args The arguments to be used as replacement text in the message
+     * created.
+     *
+     * @return The formatted warning string.
+     */
+    public static String createWarning(String msgKey, Object args[]) //throws Exception
     {
-      return createMsg(XSLTBundle, msgKey, args);
+        if (XSLTBundle == null) {
+            XSLTBundle = SecuritySupport.getResourceBundle(XSLT_ERROR_RESOURCES);
+        }
+
+        if (XSLTBundle != null) {
+            return createMsg(XSLTBundle, msgKey, args);
+        } else {
+            return "Could not load any resource bundles.";
+        }
     }
-    else
-      return "Could not load any resource bundles.";
-  }
-
-  /**
-   * Creates a message from the specified key and replacement
-   * arguments, localized to the given locale.
-   *
-   * @param msgKey    The key for the message text.
-   * @param args      The arguments to be used as replacement text
-   *                  in the message created.
-   *
-   * @return The formatted warning string.
-   */
-  public static final String createWarning(String msgKey, Object args[])  //throws Exception
-  {
-    if (XSLTBundle == null)
-      XSLTBundle = loadResourceBundle(XSLT_ERROR_RESOURCES);
-
-    if (XSLTBundle != null)
-    {
-      return createMsg(XSLTBundle, msgKey, args);
-    }
-    else
-      return "Could not load any resource bundles.";
-  }
 }
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_de.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_de.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_es.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_es.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_fr.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_fr.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_it.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_it.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ja.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ja.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ko.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_ko.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_pt_BR.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_pt_BR.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1449,68 +1449,5 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 
 }
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_sv.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_sv.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_CN.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_CN.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_TW.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/res/XSLTErrorResources_zh_TW.java	Sat Feb 16 18:03:23 2013 -0800
@@ -1448,68 +1448,4 @@
   public static final String QUERY_HEADER = "PATTERN ";
 
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XSLTErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XSLTErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XSLTErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
-
-}
--- a/src/com/sun/org/apache/xalan/internal/utils/ObjectFactory.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/utils/ObjectFactory.java	Sat Feb 16 18:03:23 2013 -0800
@@ -54,6 +54,8 @@
     //
     // Constants
     //
+     private static final String XALAN_INTERNAL = "com.sun.org.apache.xalan.internal";
+     private static final String XERCES_INTERNAL = "com.sun.org.apache.xerces.internal";
 
     // name of default properties file to look for in JDK's jre/lib directory
     private static final String DEFAULT_PROPERTIES_FILENAME =
@@ -514,12 +516,17 @@
         //class. Restrict the access to the package classes as specified in java.security policy.
         SecurityManager security = System.getSecurityManager();
         try{
-                if (security != null){
+            if (security != null){
+                if (className.startsWith(XALAN_INTERNAL) ||
+                    className.startsWith(XERCES_INTERNAL)) {
+                    cl = null;
+                } else {
                     final int lastDot = className.lastIndexOf(".");
                     String packageName = className;
                     if (lastDot != -1) packageName = className.substring(0, lastDot);
                     security.checkPackageAccess(packageName);
-                 }
+                }
+             }
         }catch(SecurityException e){
             throw e;
         }
--- a/src/com/sun/org/apache/xalan/internal/utils/SecuritySupport.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/utils/SecuritySupport.java	Sat Feb 16 18:03:23 2013 -0800
@@ -32,10 +32,14 @@
 import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
+import java.util.ListResourceBundle;
+import java.util.Locale;
+import java.util.MissingResourceException;
+import java.util.ResourceBundle;
 
 /**
- * This class is duplicated for each subpackage so keep it in sync.
- * It is package private and therefore is not exposed as part of any API.
+ * This class is duplicated for each subpackage so keep it in sync. It is
+ * package private and therefore is not exposed as part of any API.
  *
  * @xerces.internal
  */
@@ -51,39 +55,39 @@
     }
 
     static ClassLoader getContextClassLoader() {
-        return (ClassLoader)
-        AccessController.doPrivileged(new PrivilegedAction() {
+        return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() {
             public Object run() {
                 ClassLoader cl = null;
                 try {
                     cl = Thread.currentThread().getContextClassLoader();
-                } catch (SecurityException ex) { }
+                } catch (SecurityException ex) {
+                }
                 return cl;
             }
         });
     }
 
     static ClassLoader getSystemClassLoader() {
-        return (ClassLoader)
-        AccessController.doPrivileged(new PrivilegedAction() {
+        return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() {
             public Object run() {
                 ClassLoader cl = null;
                 try {
                     cl = ClassLoader.getSystemClassLoader();
-                } catch (SecurityException ex) {}
+                } catch (SecurityException ex) {
+                }
                 return cl;
             }
         });
     }
 
     static ClassLoader getParentClassLoader(final ClassLoader cl) {
-        return (ClassLoader)
-        AccessController.doPrivileged(new PrivilegedAction() {
+        return (ClassLoader) AccessController.doPrivileged(new PrivilegedAction() {
             public Object run() {
                 ClassLoader parent = null;
                 try {
                     parent = cl.getParent();
-                } catch (SecurityException ex) {}
+                } catch (SecurityException ex) {
+                }
 
                 // eliminate loops in case of the boot
                 // ClassLoader returning itself as a parent
@@ -93,20 +97,25 @@
     }
 
     public static String getSystemProperty(final String propName) {
-        return (String)
-        AccessController.doPrivileged(new PrivilegedAction() {
+        return (String) AccessController.doPrivileged(new PrivilegedAction() {
             public Object run() {
                 return System.getProperty(propName);
             }
         });
     }
 
+    public static String getSystemProperty(final String propName, final String def) {
+        return (String) AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                return System.getProperty(propName, def);
+            }
+        });
+    }
+
     static FileInputStream getFileInputStream(final File file)
-    throws FileNotFoundException
-    {
+            throws FileNotFoundException {
         try {
-            return (FileInputStream)
-            AccessController.doPrivileged(new PrivilegedExceptionAction() {
+            return (FileInputStream) AccessController.doPrivileged(new PrivilegedExceptionAction() {
                 public Object run() throws FileNotFoundException {
                     return new FileInputStream(file);
                 }
@@ -115,9 +124,10 @@
             throw (FileNotFoundException)e.getException();
         }
     }
+
     /**
-     * Return resource using the same classloader for the ObjectFactory by default
-     * or bootclassloader when Security Manager is in place
+     * Return resource using the same classloader for the ObjectFactory by
+     * default or bootclassloader when Security Manager is in place
      */
     public static InputStream getResourceAsStream(final String name) {
         if (System.getSecurityManager()!=null) {
@@ -128,10 +138,8 @@
     }
 
     public static InputStream getResourceAsStream(final ClassLoader cl,
-            final String name)
-    {
-        return (InputStream)
-        AccessController.doPrivileged(new PrivilegedAction() {
+            final String name) {
+        return (InputStream) AccessController.doPrivileged(new PrivilegedAction() {
             public Object run() {
                 InputStream ris;
                 if (cl == null) {
@@ -144,9 +152,40 @@
         });
     }
 
-    static boolean getFileExists(final File f) {
-        return ((Boolean)
-                AccessController.doPrivileged(new PrivilegedAction() {
+    /**
+     * Gets a resource bundle using the specified base name, the default locale, and the caller's class loader.
+     * @param bundle the base name of the resource bundle, a fully qualified class name
+     * @return a resource bundle for the given base name and the default locale
+     */
+    public static ListResourceBundle getResourceBundle(String bundle) {
+        return getResourceBundle(bundle, Locale.getDefault());
+    }
+
+    /**
+     * Gets a resource bundle using the specified base name and locale, and the caller's class loader.
+     * @param bundle the base name of the resource bundle, a fully qualified class name
+     * @param locale the locale for which a resource bundle is desired
+     * @return a resource bundle for the given base name and locale
+     */
+    public static ListResourceBundle getResourceBundle(final String bundle, final Locale locale) {
+        return AccessController.doPrivileged(new PrivilegedAction<ListResourceBundle>() {
+            public ListResourceBundle run() {
+                try {
+                    return (ListResourceBundle)ResourceBundle.getBundle(bundle, locale);
+                } catch (MissingResourceException e) {
+                    try {
+                        return (ListResourceBundle)ResourceBundle.getBundle(bundle, new Locale("en", "US"));
+                    } catch (MissingResourceException e2) {
+                        throw new MissingResourceException(
+                                "Could not load any resource bundle by " + bundle, bundle, "");
+                    }
+                }
+            }
+        });
+    }
+
+    public static boolean getFileExists(final File f) {
+        return ((Boolean) AccessController.doPrivileged(new PrivilegedAction() {
                     public Object run() {
                         return f.exists() ? Boolean.TRUE : Boolean.FALSE;
                     }
@@ -154,13 +193,14 @@
     }
 
     static long getLastModified(final File f) {
-        return ((Long)
-                AccessController.doPrivileged(new PrivilegedAction() {
+        return ((Long) AccessController.doPrivileged(new PrivilegedAction() {
                     public Object run() {
                         return new Long(f.lastModified());
                     }
                 })).longValue();
     }
 
-    private SecuritySupport () {}
+
+    private SecuritySupport() {
+    }
 }
--- a/src/com/sun/org/apache/xalan/internal/xslt/EnvironmentCheck.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xslt/EnvironmentCheck.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,6 +23,7 @@
 package com.sun.org.apache.xalan.internal.xslt;
 
 import com.sun.org.apache.xalan.internal.utils.ObjectFactory;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 
 import java.io.File;
 import java.io.FileWriter;
@@ -574,7 +575,7 @@
     // Grab java version for later use
     try
     {
-      String javaVersion = System.getProperty("java.version");
+      String javaVersion = SecuritySupport.getSystemProperty("java.version");
 
       h.put("java.version", javaVersion);
     }
@@ -593,7 +594,7 @@
     {
 
       // This is present in all JVM's
-      String cp = System.getProperty("java.class.path");
+      String cp = SecuritySupport.getSystemProperty("java.class.path");
 
       h.put("java.class.path", cp);
 
@@ -603,7 +604,7 @@
         h.put(FOUNDCLASSES + "java.class.path", classpathJars);
 
       // Also check for JDK 1.2+ type classpaths
-      String othercp = System.getProperty("sun.boot.class.path");
+      String othercp = SecuritySupport.getSystemProperty("sun.boot.class.path");
 
       if (null != othercp)
       {
@@ -617,7 +618,7 @@
 
       //@todo NOTE: We don't actually search java.ext.dirs for
       //  *.jar files therein! This should be updated
-      othercp = System.getProperty("java.ext.dirs");
+      othercp = SecuritySupport.getSystemProperty("java.ext.dirs");
 
       if (null != othercp)
       {
@@ -1005,7 +1006,7 @@
     {
       Class clazz = ObjectFactory.findProviderClass(DOM_CLASS, true);
 
-      Method method = clazz.getMethod(DOM_LEVEL3_METHOD, null);
+      Method method = clazz.getMethod(DOM_LEVEL3_METHOD, (Class<?>[])null);
 
       // If we succeeded, we have loaded interfaces from a
       //  level 3 DOM somewhere
--- a/src/com/sun/org/apache/xalan/internal/xslt/Process.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xslt/Process.java	Sat Feb 16 18:03:23 2013 -0800
@@ -57,6 +57,7 @@
 import com.sun.org.apache.xalan.internal.res.XSLTErrorResources;
 import com.sun.org.apache.xalan.internal.utils.ObjectFactory;
 import com.sun.org.apache.xalan.internal.utils.ConfigurationError;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 
 //J2SE does not support Xalan interpretive
 /*
@@ -180,7 +181,7 @@
     java.io.PrintWriter diagnosticsWriter = new PrintWriter(System.err, true);
     java.io.PrintWriter dumpWriter = diagnosticsWriter;
     ResourceBundle resbundle =
-      (XSLMessages.loadResourceBundle(
+      (SecuritySupport.getResourceBundle(
         com.sun.org.apache.xml.internal.utils.res.XResourceBundle.ERROR_RESOURCES));
     String flavor = "s2s";
 
--- a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/Parser.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/Parser.java	Sat Feb 16 18:03:23 2013 -0800
@@ -410,7 +410,7 @@
             }
         }
         catch (TypeCheckError e) {
-            reportError(ERROR, new ErrorMsg(e));
+            reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
         }
     }
 
@@ -430,7 +430,7 @@
         }
         catch (IOException e) {
             if (_xsltc.debug()) e.printStackTrace();
-            reportError(ERROR,new ErrorMsg(e));
+            reportError(ERROR,new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
         }
         catch (SAXException e) {
             Throwable ex = e.getException();
@@ -438,15 +438,15 @@
                 e.printStackTrace();
                 if (ex != null) ex.printStackTrace();
             }
-            reportError(ERROR, new ErrorMsg(e));
+            reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
         }
         catch (CompilerException e) {
             if (_xsltc.debug()) e.printStackTrace();
-            reportError(ERROR, new ErrorMsg(e));
+            reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
         }
         catch (Exception e) {
             if (_xsltc.debug()) e.printStackTrace();
-            reportError(ERROR, new ErrorMsg(e));
+            reportError(ERROR, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
         }
         return null;
     }
--- a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/XSLTC.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/XSLTC.java	Sat Feb 16 18:03:23 2013 -0800
@@ -41,10 +41,12 @@
 import java.util.jar.Manifest;
 
 import com.sun.org.apache.bcel.internal.classfile.JavaClass;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import com.sun.org.apache.xalan.internal.xsltc.compiler.util.ErrorMsg;
 import com.sun.org.apache.xalan.internal.xsltc.compiler.util.Util;
 import com.sun.org.apache.xml.internal.dtm.DTM;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import org.xml.sax.InputSource;
 import org.xml.sax.XMLReader;
 
@@ -278,7 +280,7 @@
             return compile(input, _className);
         }
         catch (IOException e) {
-            _parser.reportError(Constants.FATAL, new ErrorMsg(e));
+            _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
             return false;
         }
     }
@@ -297,7 +299,7 @@
             return compile(input, name);
         }
         catch (IOException e) {
-            _parser.reportError(Constants.FATAL, new ErrorMsg(e));
+            _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
             return false;
         }
     }
@@ -382,11 +384,11 @@
         }
         catch (Exception e) {
             /*if (_debug)*/ e.printStackTrace();
-            _parser.reportError(Constants.FATAL, new ErrorMsg(e));
+            _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
         }
         catch (Error e) {
             if (_debug) e.printStackTrace();
-            _parser.reportError(Constants.FATAL, new ErrorMsg(e));
+            _parser.reportError(Constants.FATAL, new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR, e));
         }
         finally {
             _reader = null; // reset this here to be sure it is not re-used
@@ -594,7 +596,7 @@
      */
     public boolean setDestDirectory(String dstDirName) {
         final File dir = new File(dstDirName);
-        if (dir.exists() || dir.mkdirs()) {
+        if (SecuritySupport.getFileExists(dir) || dir.mkdirs()) {
             _destDir = dir;
             return true;
         }
@@ -767,7 +769,7 @@
             String parentDir = outFile.getParent();
             if (parentDir != null) {
                 File parentFile = new File(parentDir);
-                if (!parentFile.exists())
+                if (!SecuritySupport.getFileExists(parentFile))
                     parentFile.mkdirs();
             }
         }
--- a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMessages.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMessages.java	Sat Feb 16 18:03:23 2013 -0800
@@ -997,7 +997,12 @@
          "kilobytes.  This is usually caused by templates in a stylesheet " +
          "that are very large.  Try restructuring your stylesheet to use " +
          "smaller templates."
-        }
+        },
+
+         {ErrorMsg.DESERIALIZE_TRANSLET_ERR, "When Java security is enabled, " +
+                        "support for deserializing TemplatesImpl is disabled." +
+                        "This can be overridden by setting the jdk.xml.enableTemplatesImplDeserialization" +
+                        " system property to true."}
 
     };
 
--- a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMsg.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/ErrorMsg.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,6 +23,7 @@
 
 package com.sun.org.apache.xalan.internal.xsltc.compiler.util;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.text.MessageFormat;
 import java.util.Locale;
 import java.util.ResourceBundle;
@@ -46,6 +47,8 @@
     Object[] _params = null;
     private boolean _isWarningError;
 
+    Throwable _cause;
+
     // Compiler error messages
     public static final String MULTIPLE_STYLESHEET_ERR = "MULTIPLE_STYLESHEET_ERR";
     public static final String TEMPLATE_REDEF_ERR = "TEMPLATE_REDEF_ERR";
@@ -165,6 +168,8 @@
     public static final String OUTLINE_ERR_METHOD_TOO_BIG =
                                             "OUTLINE_ERR_METHOD_TOO_BIG";
 
+    public static final String DESERIALIZE_TRANSLET_ERR = "DESERIALIZE_TEMPLATES_ERR";
+
     // All error messages are localized and are stored in resource bundles.
     // This array and the following 4 strings are read from that bundle.
     private static ResourceBundle _bundle;
@@ -175,7 +180,7 @@
     public final static String RUNTIME_ERROR_KEY    = "RUNTIME_ERROR_KEY";
 
     static {
-        _bundle = ResourceBundle.getBundle(
+        _bundle = SecuritySupport.getResourceBundle(
                           "com.sun.org.apache.xalan.internal.xsltc.compiler.util.ErrorMessages",
                           Locale.getDefault());
     }
@@ -185,10 +190,11 @@
         _line = 0;
     }
 
-    public ErrorMsg(Throwable e) {
-        _code = null;
+    public ErrorMsg(String code, Throwable e) {
+        _code = code;
         _message = e.getMessage();
         _line = 0;
+        _cause = e;
     }
 
     public ErrorMsg(String message, int line) {
@@ -240,6 +246,10 @@
         _params[1] = param2;
     }
 
+    public Throwable getCause() {
+        return _cause;
+    }
+
     private String getFileName(SyntaxTreeNode node) {
         Stylesheet stylesheet = node.getStylesheet();
         if (stylesheet != null)
--- a/src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/Util.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/compiler/util/Util.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.StringTokenizer;
 
 import com.sun.org.apache.bcel.internal.generic.Type;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import com.sun.org.apache.xalan.internal.xsltc.compiler.Constants;
 import com.sun.org.apache.xml.internal.utils.XML11Char;
 
@@ -37,7 +38,7 @@
     private static char filesep;
 
     static {
-        String temp = System.getProperty("file.separator", "/");
+        String temp = SecuritySupport.getSystemProperty("file.separator", "/");
         filesep = temp.charAt(0);
     }
 
--- a/src/com/sun/org/apache/xalan/internal/xsltc/dom/NodeSortRecord.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/dom/NodeSortRecord.java	Sat Feb 16 18:03:23 2013 -0800
@@ -33,6 +33,7 @@
 import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
 import com.sun.org.apache.xml.internal.utils.StringComparable;
 import com.sun.org.apache.xalan.internal.utils.ObjectFactory;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 
 /**
  * Base class for sort records containing application specific sort keys
@@ -112,7 +113,7 @@
         try {
             // -- W. Eliot Kimber (eliot@isogen.com)
             colFactClassname =
-                System.getProperty("com.sun.org.apache.xalan.internal.xsltc.COLLATOR_FACTORY");
+                SecuritySupport.getSystemProperty("com.sun.org.apache.xalan.internal.xsltc.COLLATOR_FACTORY");
         }
         catch (SecurityException e) {
             // If we can't read the propery, just use default collator
--- a/src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/runtime/BasisLibrary.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,6 +23,7 @@
 
 package com.sun.org.apache.xalan.internal.xsltc.runtime;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.text.DecimalFormat;
 import java.text.DecimalFormatSymbols;
 import java.text.FieldPosition;
@@ -1583,7 +1584,7 @@
 
     static {
         String resource = "com.sun.org.apache.xalan.internal.xsltc.runtime.ErrorMessages";
-        m_bundle = ResourceBundle.getBundle(resource);
+        m_bundle = SecuritySupport.getResourceBundle(resource);
     }
 
     /**
--- a/src/com/sun/org/apache/xalan/internal/xsltc/runtime/output/WriterOutputBuffer.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/runtime/output/WriterOutputBuffer.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,6 +23,7 @@
 
 package com.sun.org.apache.xalan.internal.xsltc.runtime.output;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.io.BufferedWriter;
 import java.io.IOException;
 import java.io.Writer;
@@ -36,7 +37,7 @@
 
     static {
         // Set a larger buffer size for Solaris
-        final String osName = System.getProperty("os.name");
+        final String osName = SecuritySupport.getSystemProperty("os.name");
         if (osName.equalsIgnoreCase("solaris")) {
             BUFFER_SIZE = 32 * KB;
         }
--- a/src/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/trax/TemplatesImpl.java	Sat Feb 16 18:03:23 2013 -0800
@@ -43,6 +43,7 @@
 import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet;
 import com.sun.org.apache.xalan.internal.xsltc.runtime.Hashtable;
 import com.sun.org.apache.xalan.internal.utils.ObjectFactory;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 
 /**
  * @author Morten Jorgensen
@@ -52,6 +53,8 @@
  */
 public final class TemplatesImpl implements Templates, Serializable {
     static final long serialVersionUID = 673094361519270707L;
+    public final static String DESERIALIZE_TRANSLET = "jdk.xml.enableTemplatesImplDeserialization";
+
     /**
      * Name of the superclass of all translets. This is needed to
      * determine which, among all classes comprising a translet,
@@ -186,6 +189,15 @@
     private void  readObject(ObjectInputStream is)
       throws IOException, ClassNotFoundException
     {
+        SecurityManager security = System.getSecurityManager();
+        if (security != null){
+            String temp = SecuritySupport.getSystemProperty(DESERIALIZE_TRANSLET);
+            if (temp == null || !(temp.length()==0 || temp.equalsIgnoreCase("true"))) {
+                ErrorMsg err = new ErrorMsg(ErrorMsg.DESERIALIZE_TRANSLET_ERR);
+                throw new UnsupportedOperationException(err.toString());
+            }
+        }
+
         is.defaultReadObject();
         if (is.readBoolean()) {
             _uriResolver = (URIResolver) is.readObject();
--- a/src/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xalan/internal/xsltc/trax/TransformerFactoryImpl.java	Sat Feb 16 18:03:23 2013 -0800
@@ -73,7 +73,7 @@
 import com.sun.org.apache.xalan.internal.xsltc.dom.XSLTCDTMManager;
 import com.sun.org.apache.xalan.internal.utils.ObjectFactory;
 import com.sun.org.apache.xalan.internal.utils.FactoryImpl;
-
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 
 import org.xml.sax.InputSource;
 import org.xml.sax.XMLFilter;
@@ -881,8 +881,14 @@
         // Check that the transformation went well before returning
     if (bytecodes == null) {
 
-        ErrorMsg err = new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR);
-        TransformerConfigurationException exc =  new TransformerConfigurationException(err.toString());
+        Vector errs = xsltc.getErrors();
+        ErrorMsg err = null;
+        if (errs != null) {
+            err = (ErrorMsg)errs.get(errs.size()-1);
+        } else {
+            err = new ErrorMsg(ErrorMsg.JAXP_COMPILE_ERR);
+        }
+        TransformerConfigurationException exc =  new TransformerConfigurationException(err.toString(), err.getCause());
 
         // Pass compiler errors to the error listener
         if (_errorListener != null) {
@@ -1229,7 +1235,7 @@
         // Find the parent directory of the translet.
         String transletParentDir = transletFile.getParent();
         if (transletParentDir == null)
-            transletParentDir = System.getProperty("user.dir");
+            transletParentDir = SecuritySupport.getSystemProperty("user.dir");
 
         File transletParentFile = new File(transletParentDir);
 
--- a/src/com/sun/org/apache/xerces/internal/dom/DOMMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/dom/DOMMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,10 +20,10 @@
 
 
 package com.sun.org.apache.xerces.internal.dom;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-import java.util.PropertyResourceBundle;
 
 /**
  * Used to format DOM error messages, using the system locale.
@@ -31,6 +31,7 @@
  * @xerces.internal
  *
  * @author Sandy Gao, IBM
+ * @version $Id: DOMMessageFormatter.java,v 1.6 2010-11-01 04:39:38 joehw Exp $
  */
 public class DOMMessageFormatter {
     public static final String DOM_DOMAIN = "http://www.w3.org/dom/DOMTR";
@@ -122,13 +123,13 @@
      */
     public static void init(){
         if (locale != null) {
-            domResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages", locale);
-            serResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages", locale);
-            xmlResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+            domResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages", locale);
+            serResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages", locale);
+            xmlResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
         }else{
-            domResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages");
-            serResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages");
-            xmlResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+            domResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.DOMMessages");
+            serResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSerializerMessages");
+            xmlResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
     }
 
--- a/src/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/XMLEntityManager.java	Sat Feb 16 18:03:23 2013 -0800
@@ -51,6 +51,7 @@
 import com.sun.org.apache.xerces.internal.xni.XNIException;
 import com.sun.org.apache.xerces.internal.xni.parser.*;
 import com.sun.org.apache.xerces.internal.impl.Constants;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import com.sun.xml.internal.stream.Entity;
 import com.sun.org.apache.xerces.internal.xni.Augmentations;
 
@@ -602,7 +603,7 @@
         if (reader == null) {
             stream = xmlInputSource.getByteStream();
             if (stream == null) {
-                URL location = new URL(escapeNonUSAscii(expandedSystemId));
+                URL location = new URL(expandedSystemId);
                 URLConnection connect = location.openConnection();
                 if (!(connect instanceof HttpURLConnection)) {
                     stream = connect.getInputStream();
@@ -1727,7 +1728,7 @@
         // get the user.dir property
         String userDir = "";
         try {
-            userDir = System.getProperty("user.dir");
+            userDir = SecuritySupport.getSystemProperty("user.dir");
         }
         catch (SecurityException se) {
         }
@@ -2586,64 +2587,6 @@
 
     } // fixURI(String):String
 
-    /**
-     * Escape invalid URI characters.
-     *
-     * Passed a URI that contains invalid characters (like spaces, non-ASCII Unicode characters, and the like),
-     * this function percent encodes the invalid characters per the URI specification (i.e., as a sequence of
-     * %-encoded UTF-8 octets).
-     *
-     * N.B. There are two problems. If the URI contains a '%' character, that might be an indication that
-     * the URI has already been escaped by the author, or it might be an invalid '%'. In the former case,
-     * it's important not to escape it, or we'll wind up with invalid, doubly-escaped '%'s. In the latter,
-     * the URI is broken if we don't encode it. Similarly, a '#' character might be the start of a fragment
-     * identifier or it might be an invalid '#'.
-     *
-     * Given that the former is vastly more likely than the latter in each case (most users are familiar with
-     * the magic status of '%' and '#' and they occur relatively infrequently in filenames, and if the user parses
-     * a proper Java File, we will already have %-escaped the URI), we simply assume that %'s and #'s are legit.
-     *
-     * Very rarely, we may be wrong. If so, tell the user to fix the clearly broken URI.
-     */
-    protected static String escapeNonUSAscii(String str) {
-        if (str == null) {
-            return str;
-        }
-
-        // get UTF-8 bytes for the string
-        StringBuffer buffer = new StringBuffer();
-        byte[] bytes = null;
-        byte b;
-        try {
-            bytes = str.getBytes("UTF-8");
-        } catch (java.io.UnsupportedEncodingException e) {
-            // should never happen
-            return str;
-        }
-        int len = bytes.length;
-        int ch;
-
-        // for each byte
-        for (int i = 0; i < len; i++) {
-            b = bytes[i];
-            // for non-ascii character: make it positive, then escape
-            if (b < 0) {
-                ch = b + 256;
-                buffer.append('%');
-                buffer.append(gHexChs[ch >> 4]);
-                buffer.append(gHexChs[ch & 0xf]);
-            }
-            else if (b != '%' && b != '#' && gNeedEscaping[b]) {
-                buffer.append('%');
-                buffer.append(gAfterEscaping1[b]);
-                buffer.append(gAfterEscaping2[b]);
-            }
-            else {
-                buffer.append((char)b);
-            }
-        }
-        return buffer.toString();
-    }
 
     //
     // Package visible methods
--- a/src/com/sun/org/apache/xerces/internal/impl/dv/DatatypeException.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/dv/DatatypeException.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,6 +20,7 @@
 
 package com.sun.org.apache.xerces.internal.impl.dv;
 
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.ResourceBundle;
 import java.util.PropertyResourceBundle;
 import java.util.MissingResourceException;
@@ -34,6 +35,7 @@
  *
  * @author Sandy Gao, IBM
  *
+ * @version $Id: DatatypeException.java,v 1.6 2010-11-01 04:39:43 joehw Exp $
  */
 public class DatatypeException extends Exception {
 
@@ -84,7 +86,7 @@
      */
     public String getMessage() {
         ResourceBundle resourceBundle = null;
-        resourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages");
+        resourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages");
         if (resourceBundle == null)
             throw new MissingResourceException("Property file not found!", "com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages", key);
 
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,12 +20,11 @@
 
 package com.sun.org.apache.xerces.internal.impl.msg;
 
+import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-import java.util.PropertyResourceBundle;
-
-import com.sun.org.apache.xerces.internal.util.MessageFormatter;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +33,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter.java 3020 2011-02-28 23:51:33Z joehw $
+ * @version $Id: XMLMessageFormatter.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter implements MessageFormatter {
@@ -72,12 +71,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_de.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_de.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_de.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_de.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_de implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_es.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_es.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_es.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_es.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_es implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_fr.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_fr.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_fr.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_fr.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_fr implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_it.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_it.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_it.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_it.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_it implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_ja.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_ja.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_ja.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_ja.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_ja implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_ko.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_ko.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_ko.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_ko.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_ko implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_pt_BR.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_pt_BR.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_pt_BR.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_pt_BR.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_pt_BR implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_sv.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_sv.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_sv.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_sv.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_sv implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_zh_CN.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_zh_CN.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_zh_CN.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_zh_CN.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_zh_CN implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_zh_TW.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/msg/XMLMessageFormatter_zh_TW.java	Sat Feb 16 18:03:23 2013 -0800
@@ -26,6 +26,7 @@
 import java.util.PropertyResourceBundle;
 
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XMLMessageFormatter provides error messages for the XML 1.0 Recommendation and for
@@ -34,7 +35,7 @@
  * @xerces.internal
  *
  * @author Eric Ye, IBM
- * @version $Id: XMLMessageFormatter_zh_TW.java 3021 2011-03-01 00:12:28Z joehw $
+ * @version $Id: XMLMessageFormatter_zh_TW.java 3094 2012-03-21 05:50:01Z joehw $
  *
  */
 public class XMLMessageFormatter_zh_TW implements MessageFormatter {
@@ -72,12 +73,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/impl/xpath/regex/RegexParser.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/xpath/regex/RegexParser.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,6 +20,7 @@
 
 package com.sun.org.apache.xerces.internal.impl.xpath.regex;
 
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
@@ -95,10 +96,10 @@
     public void setLocale(Locale locale) {
         try {
             if (locale != null) {
-                this.resources = ResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message", locale);
+                this.resources = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message", locale);
             }
             else {
-                this.resources = ResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message");
+                this.resources = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.xpath.regex.message");
             }
         }
         catch (MissingResourceException mre) {
--- a/src/com/sun/org/apache/xerces/internal/impl/xs/XSMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/impl/xs/XSMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,11 +20,11 @@
 
 package com.sun.org.apache.xerces.internal.impl.xs;
 
+import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-import java.util.PropertyResourceBundle;
-import com.sun.org.apache.xerces.internal.util.MessageFormatter;
 
 
 /**
@@ -34,6 +34,7 @@
  * @xerces.internal
  *
  * @author Elena Litani, IBM
+ * @version $Id: XSMessageFormatter.java,v 1.6 2010-11-01 04:39:55 joehw Exp $
  */
 public class XSMessageFormatter implements MessageFormatter {
     /**
@@ -66,12 +67,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XMLSchemaMessages");
         }
 
         String msg = fResourceBundle.getString(key);
--- a/src/com/sun/org/apache/xerces/internal/jaxp/validation/JAXPValidationMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/jaxp/validation/JAXPValidationMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,15 +20,16 @@
 
 package com.sun.org.apache.xerces.internal.jaxp.validation;
 
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-import java.util.PropertyResourceBundle;
 
 /**
  * <p>Used to format JAXP Validation API error messages using a specified locale.</p>
  *
  * @author Michael Glavassevich, IBM
+ * @version $Id: JAXPValidationMessageFormatter.java,v 1.5 2010-11-01 04:40:08 joehw Exp $
  */
 final class JAXPValidationMessageFormatter {
 
@@ -54,11 +55,11 @@
         ResourceBundle resourceBundle = null;
         if (locale != null) {
             resourceBundle =
-                PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages", locale);
+                SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages", locale);
         }
         else {
             resourceBundle =
-                PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages");
+                SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.JAXPValidationMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/util/DatatypeMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/util/DatatypeMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,15 +20,16 @@
 
 package com.sun.org.apache.xerces.internal.util;
 
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
-import java.util.PropertyResourceBundle;
 import java.util.ResourceBundle;
 
 /**
  * <p>Used to format JAXP 1.3 Datatype API error messages using a specified locale.</p>
  *
  * @author  Neeraj Bajaj, Sun Microsystems
+ * @version $Id: DatatypeMessageFormatter.java,v 1.6 2010-11-01 04:40:14 joehw Exp $
  */
 public class DatatypeMessageFormatter {
 
@@ -56,11 +57,11 @@
         ResourceBundle resourceBundle = null;
         if (locale != null) {
             resourceBundle =
-                PropertyResourceBundle.getBundle(BASE_NAME, locale);
+                SecuritySupport.getResourceBundle(BASE_NAME, locale);
         }
         else {
             resourceBundle =
-                PropertyResourceBundle.getBundle(BASE_NAME);
+                SecuritySupport.getResourceBundle(BASE_NAME);
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/util/SAXMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/util/SAXMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -19,16 +19,17 @@
  */
 package com.sun.org.apache.xerces.internal.util;
 
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-import java.util.PropertyResourceBundle;
 
 /**
  * Used to format SAX error messages using a specified locale.
  *
  * @author Michael Glavassevich, IBM
  *
+ * @version $Id: SAXMessageFormatter.java,v 1.6 2010-11-01 04:40:14 joehw Exp $
  */
 public class SAXMessageFormatter {
 
@@ -54,11 +55,11 @@
         ResourceBundle resourceBundle = null;
         if (locale != null) {
             resourceBundle =
-                PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages", locale);
+                SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages", locale);
         }
         else {
             resourceBundle =
-                PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages");
+                SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.SAXMessages");
         }
 
         // format message
--- a/src/com/sun/org/apache/xerces/internal/util/SecurityManager.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/util/SecurityManager.java	Sat Feb 16 18:03:23 2013 -0800
@@ -61,6 +61,8 @@
 
 package com.sun.org.apache.xerces.internal.util;
 import com.sun.org.apache.xerces.internal.impl.Constants;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 /**
  * This class is a container for parser settings that relate to
  * security, or more specifically, it is intended to be used to prevent denial-of-service
@@ -77,6 +79,7 @@
  *
  * @author  Neil Graham, IBM
  *
+ * @version $Id: SecurityManager.java,v 1.5 2010-11-01 04:40:14 joehw Exp $
  */
 public final class SecurityManager {
 
@@ -176,41 +179,48 @@
 
         private void readSystemProperties(){
 
-                //TODO: also read SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT
-                try {
-                        String value = System.getProperty(Constants.ENTITY_EXPANSION_LIMIT);
-                        if(value != null && !value.equals("")){
-                                entityExpansionLimit = Integer.parseInt(value);
-                                if (entityExpansionLimit < 0)
-                                        entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT;
-                        }
-                        else
-                                entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT;
-                }catch(Exception ex){}
+            //TODO: also read SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT
+            try {
+                    String value = getSystemProperty(Constants.ENTITY_EXPANSION_LIMIT);
+                    if(value != null && !value.equals("")){
+                            entityExpansionLimit = Integer.parseInt(value);
+                            if (entityExpansionLimit < 0)
+                                    entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT;
+                    }
+                    else
+                            entityExpansionLimit = DEFAULT_ENTITY_EXPANSION_LIMIT;
+            }catch(Exception ex){}
 
-                try {
-                        String value = System.getProperty(Constants.MAX_OCCUR_LIMIT);
-                        if(value != null && !value.equals("")){
-                                maxOccurLimit = Integer.parseInt(value);
-                                if (maxOccurLimit < 0)
-                                        maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT;
-                        }
-                        else
-                                maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT;
-                }catch(Exception ex){}
+            try {
+                    String value = getSystemProperty(Constants.MAX_OCCUR_LIMIT);
+                    if(value != null && !value.equals("")){
+                            maxOccurLimit = Integer.parseInt(value);
+                            if (maxOccurLimit < 0)
+                                    maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT;
+                    }
+                    else
+                            maxOccurLimit = DEFAULT_MAX_OCCUR_NODE_LIMIT;
+            }catch(Exception ex){}
 
-                try {
-                        String value = System.getProperty(Constants.SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT);
-                        if(value != null && !value.equals("")){
-                                fElementAttributeLimit = Integer.parseInt(value);
-                                if ( fElementAttributeLimit < 0)
-                                        fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT;
-                        }
-                        else
-                                fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT;
+            try {
+                    String value = getSystemProperty(Constants.SYSTEM_PROPERTY_ELEMENT_ATTRIBUTE_LIMIT);
+                    if(value != null && !value.equals("")){
+                            fElementAttributeLimit = Integer.parseInt(value);
+                            if ( fElementAttributeLimit < 0)
+                                    fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT;
+                    }
+                    else
+                            fElementAttributeLimit = DEFAULT_ELEMENT_ATTRIBUTE_LIMIT;
 
                 }catch(Exception ex){}
 
         }
 
+    private String getSystemProperty(final String propName) {
+        return AccessController.doPrivileged(new PrivilegedAction<String>() {
+            public String run() {
+                return System.getProperty(propName);
+            }
+        });
+    }
 } // class SecurityManager
--- a/src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/utils/ObjectFactory.java	Sat Feb 16 18:03:23 2013 -0800
@@ -48,6 +48,7 @@
     //
     // Constants
     //
+    private static final String DEFAULT_INTERNAL_CLASSES = "com.sun.org.apache.";
 
     // name of default properties file to look for in JDK's jre/lib directory
     private static final String DEFAULT_PROPERTIES_FILENAME = "xerces.properties";
@@ -305,10 +306,14 @@
         //restrict the access to package as speicified in java.security policy
         SecurityManager security = System.getSecurityManager();
         if (security != null) {
-            final int lastDot = className.lastIndexOf(".");
-            String packageName = className;
-            if (lastDot != -1) packageName = className.substring(0, lastDot);
-            security.checkPackageAccess(packageName);
+            if (className.startsWith(DEFAULT_INTERNAL_CLASSES)) {
+                cl = null;
+            } else {
+                final int lastDot = className.lastIndexOf(".");
+                String packageName = className;
+                if (lastDot != -1) packageName = className.substring(0, lastDot);
+                security.checkPackageAccess(packageName);
+            }
         }
         Class providerClass;
         if (cl == null) {
--- a/src/com/sun/org/apache/xerces/internal/utils/SecuritySupport.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/utils/SecuritySupport.java	Sat Feb 16 18:03:23 2013 -0800
@@ -29,6 +29,10 @@
 import java.security.PrivilegedAction;
 import java.security.PrivilegedActionException;
 import java.security.PrivilegedExceptionAction;
+import java.util.Locale;
+import java.util.MissingResourceException;
+import java.util.PropertyResourceBundle;
+import java.util.ResourceBundle;
 
 /**
  * This class is duplicated for each subpackage so keep it in sync.
@@ -141,6 +145,38 @@
         });
     }
 
+    /**
+     * Gets a resource bundle using the specified base name, the default locale, and the caller's class loader.
+     * @param bundle the base name of the resource bundle, a fully qualified class name
+     * @return a resource bundle for the given base name and the default locale
+     */
+    public static ResourceBundle getResourceBundle(String bundle) {
+        return getResourceBundle(bundle, Locale.getDefault());
+    }
+
+    /**
+     * Gets a resource bundle using the specified base name and locale, and the caller's class loader.
+     * @param bundle the base name of the resource bundle, a fully qualified class name
+     * @param locale the locale for which a resource bundle is desired
+     * @return a resource bundle for the given base name and locale
+     */
+    public static ResourceBundle getResourceBundle(final String bundle, final Locale locale) {
+        return AccessController.doPrivileged(new PrivilegedAction<ResourceBundle>() {
+            public ResourceBundle run() {
+                try {
+                    return PropertyResourceBundle.getBundle(bundle, locale);
+                } catch (MissingResourceException e) {
+                    try {
+                        return PropertyResourceBundle.getBundle(bundle, new Locale("en", "US"));
+                    } catch (MissingResourceException e2) {
+                        throw new MissingResourceException(
+                                "Could not load any resource bundle by " + bundle, bundle, "");
+                    }
+                }
+            }
+        });
+    }
+
     static boolean getFileExists(final File f) {
         return ((Boolean)
                 AccessController.doPrivileged(new PrivilegedAction() {
--- a/src/com/sun/org/apache/xerces/internal/xinclude/XIncludeMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/xinclude/XIncludeMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -20,11 +20,11 @@
 
 package com.sun.org.apache.xerces.internal.xinclude;
 
+import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Locale;
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
-import java.util.PropertyResourceBundle;
-import com.sun.org.apache.xerces.internal.util.MessageFormatter;
 
 // TODO: fix error messages in XIncludeMessages.properties
 /**
@@ -32,6 +32,7 @@
  *
  * @author Peter McCracken, IBM
  *
+ * @version $Id: XIncludeMessageFormatter.java,v 1.7 2010-11-01 04:40:18 joehw Exp $
  */
 public class XIncludeMessageFormatter implements MessageFormatter {
 
@@ -61,12 +62,12 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages", locale);
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle.getBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle("com.sun.org.apache.xerces.internal.impl.msg.XIncludeMessages");
         }
 
         String msg = fResourceBundle.getString(key);
--- a/src/com/sun/org/apache/xerces/internal/xpointer/XPointerMessageFormatter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xerces/internal/xpointer/XPointerMessageFormatter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,6 +24,7 @@
 import java.util.ResourceBundle;
 import java.util.PropertyResourceBundle;
 import com.sun.org.apache.xerces.internal.util.MessageFormatter;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * XPointerMessageFormatter provides error messages for the XPointer Framework
@@ -31,6 +32,7 @@
  *
  * @xerces.internal
  *
+ * @version $Id: XPointerMessageFormatter.java,v 1.5 2010-11-01 04:40:26 joehw Exp $
  */
 class XPointerMessageFormatter implements MessageFormatter {
 
@@ -64,14 +66,14 @@
 
         if (fResourceBundle == null || locale != fLocale) {
             if (locale != null) {
-                fResourceBundle = PropertyResourceBundle.getBundle(
+                fResourceBundle = SecuritySupport.getResourceBundle(
                         "com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages", locale);
                 // memorize the most-recent locale
                 fLocale = locale;
             }
             if (fResourceBundle == null)
-                fResourceBundle = PropertyResourceBundle
-                        .getBundle("com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages");
+                fResourceBundle = SecuritySupport.getResourceBundle(
+                        "com.sun.org.apache.xerces.internal.impl.msg.XPointerMessages");
         }
 
         String msg = fResourceBundle.getString(key);
--- a/src/com/sun/org/apache/xml/internal/dtm/DTMManager.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/dtm/DTMManager.java	Sat Feb 16 18:03:23 2013 -0800
@@ -27,6 +27,7 @@
 import com.sun.org.apache.xml.internal.utils.PrefixResolver;
 import com.sun.org.apache.xml.internal.utils.XMLStringFactory;
 import com.sun.org.apache.xalan.internal.utils.ObjectFactory;
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 
 /**
  * A DTMManager instance can be used to create DTM and
@@ -383,7 +384,7 @@
   {
     try
     {
-      debug = System.getProperty("dtm.debug") != null;
+      debug = SecuritySupport.getSystemProperty("dtm.debug") != null;
     }
     catch (SecurityException ex){}
   }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ca.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ca.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -443,67 +440,4 @@
     return _contents;
   }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("ca", "ES"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_cs.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_cs.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -443,67 +440,4 @@
     return _contents;
   }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("cs", "CZ"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_de.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_de.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_es.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_es.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_fr.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_fr.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_it.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_it.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ja.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ja.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ko.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_ko.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_pt_BR.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_pt_BR.java	Sat Feb 16 18:03:23 2013 -0800
@@ -25,9 +25,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -463,67 +460,4 @@
         return msgCopy;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sk.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sk.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -443,67 +440,4 @@
     return _contents;
   }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sv.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_sv.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -452,68 +449,4 @@
     protected Object[][] getContents() {
         return _contents;
     }
-
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_tr.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_tr.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -443,67 +440,4 @@
     return _contents;
   }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("tr", "TR"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_CN.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_CN.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_TW.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLErrorResources_zh_TW.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -453,67 +450,4 @@
         return _contents;
     }
 
-  /**
-   *   Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   *   of ResourceBundle.getBundle().
-   *
-   *   @param className the name of the class that implements the resource bundle.
-   *   @return the ResourceBundle
-   *   @throws MissingResourceException
-   */
-  public static final XMLErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XMLErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XMLErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xml/internal/res/XMLMessages.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/res/XMLMessages.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,10 +22,9 @@
  */
 package com.sun.org.apache.xml.internal.res;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.util.ListResourceBundle;
 import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * A utility class for issuing XML error messages.
@@ -82,8 +81,9 @@
    */
   public static final String createXMLMessage(String msgKey, Object args[])
   {
-    if (XMLBundle == null)
-      XMLBundle = loadResourceBundle(XML_ERROR_RESOURCES);
+    if (XMLBundle == null) {
+        XMLBundle = SecuritySupport.getResourceBundle(XML_ERROR_RESOURCES);
+    }
 
     if (XMLBundle != null)
     {
@@ -156,61 +156,4 @@
     return fmsg;
   }
 
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className The class name of the resource bundle.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static ListResourceBundle loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-    Locale locale = Locale.getDefault();
-
-    try
-    {
-      return (ListResourceBundle)ResourceBundle.getBundle(className, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (ListResourceBundle)ResourceBundle.getBundle(
-          className, new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles." + className, className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which can be appended to a resource name
-   */
-  protected static String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
 }
--- a/src/com/sun/org/apache/xml/internal/resolver/Catalog.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/resolver/Catalog.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,6 +24,7 @@
 package com.sun.org.apache.xml.internal.resolver;
 
 import com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.io.IOException;
 import java.io.FileNotFoundException;
 import java.io.InputStream;
@@ -821,7 +822,7 @@
       // tack on a basename because URLs point to files not dirs
       catalogCwd = FileURL.makeURL("basename");
     } catch (MalformedURLException e) {
-      String userdir = System.getProperty("user.dir");
+      String userdir = SecuritySupport.getSystemProperty("user.dir");
       userdir.replace('\\', '/');
       catalogManager.debug.message(1, "Malformed URL on cwd", userdir);
       catalogCwd = null;
@@ -1717,7 +1718,7 @@
   protected String resolveLocalSystem(String systemId)
     throws MalformedURLException, IOException {
 
-    String osname = System.getProperty("os.name");
+    String osname = SecuritySupport.getSystemProperty("os.name");
     boolean windows = (osname.indexOf("Windows") >= 0);
     Enumeration en = catalogEntries.elements();
     while (en.hasMoreElements()) {
--- a/src/com/sun/org/apache/xml/internal/resolver/CatalogManager.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/resolver/CatalogManager.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,6 +23,7 @@
 
 package com.sun.org.apache.xml.internal.resolver;
 
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.io.InputStream;
 
 import java.net.URL;
@@ -142,8 +143,8 @@
 
   /** Flag to ignore missing property files and/or properties */
   private boolean ignoreMissingProperties
-    = (System.getProperty(pIgnoreMissing) != null
-       || System.getProperty(pFiles) != null);
+    = (SecuritySupport.getSystemProperty(pIgnoreMissing) != null
+       || SecuritySupport.getSystemProperty(pFiles) != null);
 
   /** Holds the resources after they are loaded from the file. */
   private ResourceBundle resources;
@@ -338,7 +339,7 @@
   private int queryVerbosity () {
     String defaultVerbStr = Integer.toString(defaultVerbosity);
 
-    String verbStr = System.getProperty(pVerbosity);
+    String verbStr = SecuritySupport.getSystemProperty(pVerbosity);
 
     if (verbStr == null) {
       if (resources==null) readProperties();
@@ -473,7 +474,7 @@
    * @return A semicolon delimited list of catlog file URIs
    */
   private String queryCatalogFiles () {
-    String catalogList = System.getProperty(pFiles);
+    String catalogList = SecuritySupport.getSystemProperty(pFiles);
     fromPropertiesFile = false;
 
     if (catalogList == null) {
@@ -558,7 +559,7 @@
    * defaultPreferSetting.
    */
   private boolean queryPreferPublic () {
-    String prefer = System.getProperty(pPrefer);
+    String prefer = SecuritySupport.getSystemProperty(pPrefer);
 
     if (prefer == null) {
       if (resources==null) readProperties();
@@ -617,7 +618,7 @@
    * defaultUseStaticCatalog.
    */
   private boolean queryUseStaticCatalog () {
-    String staticCatalog = System.getProperty(pStatic);
+    String staticCatalog = SecuritySupport.getSystemProperty(pStatic);
 
     if (staticCatalog == null) {
       if (resources==null) readProperties();
@@ -748,7 +749,7 @@
    * defaultOasisXMLCatalogPI.
    */
   public boolean queryAllowOasisXMLCatalogPI () {
-    String allow = System.getProperty(pAllowPI);
+    String allow = SecuritySupport.getSystemProperty(pAllowPI);
 
     if (allow == null) {
       if (resources==null) readProperties();
@@ -804,7 +805,7 @@
    *
    */
   public String queryCatalogClassName () {
-    String className = System.getProperty(pClassname);
+    String className = SecuritySupport.getSystemProperty(pClassname);
 
     if (className == null) {
       if (resources==null) readProperties();
--- a/src/com/sun/org/apache/xml/internal/resolver/Resolver.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/resolver/Resolver.java	Sat Feb 16 18:03:23 2013 -0800
@@ -33,6 +33,7 @@
 import java.net.MalformedURLException;
 import javax.xml.parsers.SAXParserFactory;
 import com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import com.sun.org.apache.xml.internal.resolver.readers.SAXCatalogReader;
 import com.sun.org.apache.xml.internal.resolver.readers.OASISXMLCatalogReader;
 import com.sun.org.apache.xml.internal.resolver.readers.TR9401CatalogReader;
@@ -524,7 +525,7 @@
      */
     private Vector resolveAllLocalSystem(String systemId) {
         Vector map = new Vector();
-        String osname = System.getProperty("os.name");
+        String osname = SecuritySupport.getSystemProperty("os.name");
         boolean windows = (osname.indexOf("Windows") >= 0);
         Enumeration en = catalogEntries.elements();
         while (en.hasMoreElements()) {
@@ -552,7 +553,7 @@
      */
     private Vector resolveLocalSystemReverse(String systemId) {
         Vector map = new Vector();
-        String osname = System.getProperty("os.name");
+        String osname = SecuritySupport.getSystemProperty("os.name");
         boolean windows = (osname.indexOf("Windows") >= 0);
         Enumeration en = catalogEntries.elements();
         while (en.hasMoreElements()) {
--- a/src/com/sun/org/apache/xml/internal/serialize/SerializerFactory.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/serialize/SerializerFactory.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,6 +22,7 @@
 package com.sun.org.apache.xml.internal.serialize;
 
 import com.sun.org.apache.xerces.internal.utils.ObjectFactory;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.io.OutputStream;
 import java.io.Writer;
 import java.io.UnsupportedEncodingException;
@@ -64,7 +65,7 @@
         factory =  new SerializerFactoryImpl( Method.TEXT );
         registerSerializerFactory( factory );
 
-        list = System.getProperty( FactoriesProperty );
+        list = SecuritySupport.getSystemProperty( FactoriesProperty );
         if ( list != null ) {
             token = new StringTokenizer( list, " ;,:" );
             while ( token.hasMoreTokens() ) {
--- a/src/com/sun/org/apache/xml/internal/serializer/Encodings.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/serializer/Encodings.java	Sat Feb 16 18:03:23 2013 -0800
@@ -219,7 +219,7 @@
                 // Get the default system character encoding.  This may be
                 // incorrect if they passed in a writer, but right now there
                 // seems to be no way to get the encoding from a writer.
-                encoding = System.getProperty("file.encoding", "UTF8");
+                encoding = SecuritySupport.getSystemProperty("file.encoding", "UTF8");
 
                 if (null != encoding)
                 {
@@ -313,7 +313,7 @@
 
             try
             {
-                urlString = System.getProperty(ENCODINGS_PROP, "");
+                urlString = SecuritySupport.getSystemProperty(ENCODINGS_PROP, "");
             }
             catch (SecurityException e)
             {
--- a/src/com/sun/org/apache/xml/internal/serializer/OutputPropertiesFactory.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/serializer/OutputPropertiesFactory.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,6 +22,7 @@
  */
 package com.sun.org.apache.xml.internal.serializer;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.io.BufferedInputStream;
 import java.io.IOException;
 import java.io.InputStream;
@@ -471,7 +472,7 @@
             String value = null;
             try
             {
-                value = System.getProperty(key);
+                value = SecuritySupport.getSystemProperty(key);
             }
             catch (SecurityException se)
             {
@@ -484,7 +485,7 @@
             String newValue = null;
             try
             {
-                newValue = System.getProperty(newKey);
+                newValue = SecuritySupport.getSystemProperty(newKey);
             }
             catch (SecurityException se)
             {
--- a/src/com/sun/org/apache/xml/internal/serializer/ToStream.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/serializer/ToStream.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,6 +22,7 @@
  */
 package com.sun.org.apache.xml.internal.serializer;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.io.IOException;
 import java.io.OutputStream;
 import java.io.UnsupportedEncodingException;
@@ -140,7 +141,7 @@
      * extension attribute xalan:line-separator.
      */
     protected char[] m_lineSep =
-        System.getProperty("line.separator").toCharArray();
+        SecuritySupport.getSystemProperty("line.separator").toCharArray();
 
     /**
      * True if the the system line separator is to be used.
--- a/src/com/sun/org/apache/xml/internal/serializer/TreeWalker.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/serializer/TreeWalker.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,6 +22,7 @@
  */
 package com.sun.org.apache.xml.internal.serializer;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.io.File;
 
 import com.sun.org.apache.xml.internal.serializer.utils.AttList;
@@ -104,7 +105,7 @@
       else {
           try {
             // Bug see Bugzilla  26741
-            m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
+            m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
            }
            catch (SecurityException se) {// user.dir not accessible from applet
            }
@@ -115,7 +116,7 @@
                         m_contentHandler.setDocumentLocator(m_locator);
                 try {
                    // Bug see Bugzilla  26741
-                  m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
+                  m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
                 }
                 catch (SecurityException se){// user.dir not accessible from applet
 
--- a/src/com/sun/org/apache/xml/internal/serializer/utils/Messages.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/serializer/utils/Messages.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,6 +22,7 @@
  */
 package com.sun.org.apache.xml.internal.serializer.utils;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.util.ListResourceBundle;
 import java.util.Locale;
 import java.util.MissingResourceException;
@@ -87,9 +88,6 @@
  * can have the Message strings translated in an alternate language
  * in a errorResourceClass with a language suffix.
  *
- * More sophisticated use of this class would be to pass null
- * when contructing it, but then call loadResourceBundle()
- * before creating any messages.
  *
  * This class is not a public API, it is only public because it is
  * used in com.sun.org.apache.xml.internal.serializer.
@@ -126,18 +124,6 @@
         m_resourceBundleName = resourceBundle;
     }
 
-    /*
-     * Set the Locale object to use. If this method is not called the
-     * default locale is used. This method needs to be called before
-     * loadResourceBundle().
-     *
-     * @param locale non-null reference to Locale object.
-     * @xsl.usage internal
-     */
-//    public void setLocale(Locale locale)
-//    {
-//        m_locale = locale;
-//    }
 
     /**
      * Get the Locale object that is being used.
@@ -151,16 +137,6 @@
     }
 
     /**
-     * Get the ListResourceBundle being used by this Messages instance which was
-     * previously set by a call to loadResourceBundle(className)
-     * @xsl.usage internal
-     */
-    private ListResourceBundle getResourceBundle()
-    {
-        return m_resourceBundle;
-    }
-
-    /**
      * Creates a message from the specified key and replacement
      * arguments, localized to the given locale.
      *
@@ -174,7 +150,7 @@
     public final String createMessage(String msgKey, Object args[])
     {
         if (m_resourceBundle == null)
-            m_resourceBundle = loadResourceBundle(m_resourceBundleName);
+            m_resourceBundle = SecuritySupport.getResourceBundle(m_resourceBundleName);
 
         if (m_resourceBundle != null)
         {
@@ -293,76 +269,4 @@
         return fmsg;
     }
 
-    /**
-     * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-     * of ResourceBundle.getBundle().
-     *
-     * @param className the name of the class that implements ListResourceBundle,
-     * without language suffix.
-     * @return the ResourceBundle
-     * @throws MissingResourceException
-     * @xsl.usage internal
-     */
-    private ListResourceBundle loadResourceBundle(String resourceBundle)
-        throws MissingResourceException
-    {
-        m_resourceBundleName = resourceBundle;
-        Locale locale = getLocale();
-
-        ListResourceBundle lrb;
-
-        try
-        {
-
-            ResourceBundle rb =
-                ResourceBundle.getBundle(m_resourceBundleName, locale);
-            lrb = (ListResourceBundle) rb;
-        }
-        catch (MissingResourceException e)
-        {
-            try // try to fall back to en_US if we can't load
-                {
-
-                // Since we can't find the localized property file,
-                // fall back to en_US.
-                lrb =
-                    (ListResourceBundle) ResourceBundle.getBundle(
-                        m_resourceBundleName,
-                        new Locale("en", "US"));
-            }
-            catch (MissingResourceException e2)
-            {
-
-                // Now we are really in trouble.
-                // very bad, definitely very bad...not going to get very far
-                throw new MissingResourceException(
-                    "Could not load any resource bundles." + m_resourceBundleName,
-                    m_resourceBundleName,
-                    "");
-            }
-        }
-        m_resourceBundle = lrb;
-        return lrb;
-    }
-
-    /**
-     * Return the resource file suffic for the indicated locale
-     * For most locales, this will be based the language code.  However
-     * for Chinese, we do distinguish between Taiwan and PRC
-     *
-     * @param locale the locale
-     * @return an String suffix which can be appended to a resource name
-     * @xsl.usage internal
-     */
-    private static String getResourceSuffix(Locale locale)
-    {
-
-        String suffix = "_" + locale.getLanguage();
-        String country = locale.getCountry();
-
-        if (country.equals("TW"))
-            suffix += "_" + country;
-
-        return suffix;
-    }
 }
--- a/src/com/sun/org/apache/xml/internal/utils/TreeWalker.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/utils/TreeWalker.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,6 +22,7 @@
  */
 package com.sun.org.apache.xml.internal.utils;
 
+import com.sun.org.apache.xalan.internal.utils.SecuritySupport;
 import java.io.File;
 
 import org.w3c.dom.Comment;
@@ -93,7 +94,7 @@
     else {
         try {
           // Bug see Bugzilla  26741
-          m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
+          m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
          }
          catch (SecurityException se) {// user.dir not accessible from applet
          }
@@ -112,7 +113,7 @@
     m_contentHandler.setDocumentLocator(m_locator);
     try {
        // Bug see Bugzilla  26741
-      m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
+      m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
     }
     catch (SecurityException se){// user.dir not accessible from applet
     }
@@ -131,7 +132,7 @@
                         m_contentHandler.setDocumentLocator(m_locator);
                 try {
                    // Bug see Bugzilla  26741
-                  m_locator.setSystemId(System.getProperty("user.dir") + File.separator + "dummy.xsl");
+                  m_locator.setSystemId(SecuritySupport.getSystemProperty("user.dir") + File.separator + "dummy.xsl");
                 }
                 catch (SecurityException se){// user.dir not accessible from applet
 
--- a/src/com/sun/org/apache/xml/internal/utils/res/XResourceBundle.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xml/internal/utils/res/XResourceBundle.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,6 +22,8 @@
  */
 package com.sun.org.apache.xml.internal.utils.res;
 
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.ListResourceBundle;
 import java.util.Locale;
 import java.util.MissingResourceException;
@@ -29,114 +31,45 @@
 
 /**
  * The default (english) resource bundle.
+ *
  * @xsl.usage internal
  */
-public class XResourceBundle extends ListResourceBundle
-{
+public class XResourceBundle extends ListResourceBundle {
 
-  /** Error resource constants */
-  public static final String ERROR_RESOURCES =
-    "com.sun.org.apache.xalan.internal.res.XSLTErrorResources", XSLT_RESOURCE =
-    "com.sun.org.apache.xml.internal.utils.res.XResourceBundle", LANG_BUNDLE_NAME =
-    "com.sun.org.apache.xml.internal.utils.res.XResources", MULT_ORDER =
-    "multiplierOrder", MULT_PRECEDES = "precedes", MULT_FOLLOWS =
-    "follows", LANG_ORIENTATION = "orientation", LANG_RIGHTTOLEFT =
-    "rightToLeft", LANG_LEFTTORIGHT = "leftToRight", LANG_NUMBERING =
-    "numbering", LANG_ADDITIVE = "additive", LANG_MULT_ADD =
-    "multiplicative-additive", LANG_MULTIPLIER =
-    "multiplier", LANG_MULTIPLIER_CHAR =
-    "multiplierChar", LANG_NUMBERGROUPS = "numberGroups", LANG_NUM_TABLES =
-    "tables", LANG_ALPHABET = "alphabet", LANG_TRAD_ALPHABET = "tradAlphabet";
+    /**
+     * Error resource constants
+     */
+    public static final String ERROR_RESOURCES =
+            "com.sun.org.apache.xalan.internal.res.XSLTErrorResources", XSLT_RESOURCE =
+            "com.sun.org.apache.xml.internal.utils.res.XResourceBundle", LANG_BUNDLE_NAME =
+            "com.sun.org.apache.xml.internal.utils.res.XResources", MULT_ORDER =
+            "multiplierOrder", MULT_PRECEDES = "precedes", MULT_FOLLOWS =
+            "follows", LANG_ORIENTATION = "orientation", LANG_RIGHTTOLEFT =
+            "rightToLeft", LANG_LEFTTORIGHT = "leftToRight", LANG_NUMBERING =
+            "numbering", LANG_ADDITIVE = "additive", LANG_MULT_ADD =
+            "multiplicative-additive", LANG_MULTIPLIER =
+            "multiplier", LANG_MULTIPLIER_CHAR =
+            "multiplierChar", LANG_NUMBERGROUPS = "numberGroups", LANG_NUM_TABLES =
+            "tables", LANG_ALPHABET = "alphabet", LANG_TRAD_ALPHABET = "tradAlphabet";
 
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @param locale the locale to prefer when searching for the bundle
-   */
-  public static final XResourceBundle loadResourceBundle(
-          String className, Locale locale) throws MissingResourceException
-  {
 
-    String suffix = getResourceSuffix(locale);
-
-    //System.out.println("resource " + className + suffix);
-    try
-    {
-
-      // first try with the given locale
-      String resourceName = className + suffix;
-      return (XResourceBundle) ResourceBundle.getBundle(resourceName, locale);
+    /**
+     * Get the association list.
+     *
+     * @return The association list.
+     */
+    public Object[][] getContents() {
+        return new Object[][]{
+                    {"ui_language", "en"}, {"help_language", "en"}, {"language", "en"},
+                    {"alphabet", new CharArrayWrapper(new char[]{'A', 'B', 'C', 'D', 'E', 'F', 'G',
+                            'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U',
+                            'V', 'W', 'X', 'Y', 'Z'})},
+                    {"tradAlphabet", new CharArrayWrapper(new char[]{'A', 'B', 'C', 'D', 'E', 'F',
+                            'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',
+                            'U', 'V', 'W', 'X', 'Y', 'Z'})},
+                    //language orientation
+                    {"orientation", "LeftToRight"},
+                    //language numbering
+                    {"numbering", "additive"},};
     }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XResourceBundle) ResourceBundle.getBundle(
-          XSLT_RESOURCE, new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String lang = locale.getLanguage();
-    String country = locale.getCountry();
-    String variant = locale.getVariant();
-    String suffix = "_" + locale.getLanguage();
-
-    if (lang.equals("zh"))
-      suffix += "_" + country;
-
-    if (country.equals("JP"))
-      suffix += "_" + country + "_" + variant;
-
-    return suffix;
-  }
-
-  /**
-   * Get the association list.
-   *
-   * @return The association list.
-   */
-  public Object[][] getContents()
-  {
-    return new Object[][]
-  {
-    { "ui_language", "en" }, { "help_language", "en" }, { "language", "en" },
-    { "alphabet", new CharArrayWrapper(new char[]{ 'A', 'B', 'C', 'D', 'E', 'F', 'G',
-         'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T', 'U',
-         'V', 'W', 'X', 'Y', 'Z' })},
-    { "tradAlphabet", new CharArrayWrapper(new char[]{ 'A', 'B', 'C', 'D', 'E', 'F',
-         'G', 'H', 'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',
-         'U', 'V', 'W', 'X', 'Y', 'Z' }) },
-
-    //language orientation
-    { "orientation", "LeftToRight" },
-
-    //language numbering
-    { "numbering", "additive" },
-  };
-  }
 }
--- a/src/com/sun/org/apache/xpath/internal/functions/FuncSystemProperty.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/functions/FuncSystemProperty.java	Sat Feb 16 18:03:23 2013 -0800
@@ -102,7 +102,7 @@
 
         try
         {
-          result = System.getProperty(propName);
+          result = SecuritySupport.getSystemProperty(propName);
 
           if (null == result)
           {
@@ -124,7 +124,7 @@
     {
       try
       {
-        result = System.getProperty(fullName);
+        result = SecuritySupport.getSystemProperty(fullName);
 
         if (null == result)
         {
@@ -165,12 +165,11 @@
    * should already be fully qualified as path/filename
    * @param target The target property bag the file will be placed into.
    */
-  private void loadPropertyFile(String file, Properties target)
+  public void loadPropertyFile(String file, Properties target)
   {
     try
     {
       // Use SecuritySupport class to provide priveleged access to property file
-
       InputStream is = SecuritySupport.getResourceAsStream(ObjectFactory.findClassLoader(),
                                               file);
 
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_de.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_de.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_es.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_es.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_fr.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_fr.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_it.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_it.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ja.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ja.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ko.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_ko.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_pt_BR.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_pt_BR.java	Sat Feb 16 18:03:23 2013 -0800
@@ -24,9 +24,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -940,68 +937,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_sv.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_sv.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_CN.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_CN.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_TW.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHErrorResources_zh_TW.java	Sat Feb 16 18:03:23 2013 -0800
@@ -23,9 +23,6 @@
 package com.sun.org.apache.xpath.internal.res;
 
 import java.util.ListResourceBundle;
-import java.util.Locale;
-import java.util.MissingResourceException;
-import java.util.ResourceBundle;
 
 /**
  * Set up error messages.
@@ -939,68 +936,4 @@
   /** Field QUERY_HEADER          */
   public static final String QUERY_HEADER = "PATTERN ";
 
-
-  /**
-   * Return a named ResourceBundle for a particular locale.  This method mimics the behavior
-   * of ResourceBundle.getBundle().
-   *
-   * @param className Name of local-specific subclass.
-   * @return the ResourceBundle
-   * @throws MissingResourceException
-   */
-  public static final XPATHErrorResources loadResourceBundle(String className)
-          throws MissingResourceException
-  {
-
-    Locale locale = Locale.getDefault();
-    String suffix = getResourceSuffix(locale);
-
-    try
-    {
-
-      // first try with the given locale
-      return (XPATHErrorResources) ResourceBundle.getBundle(className
-              + suffix, locale);
-    }
-    catch (MissingResourceException e)
-    {
-      try  // try to fall back to en_US if we can't load
-      {
-
-        // Since we can't find the localized property file,
-        // fall back to en_US.
-        return (XPATHErrorResources) ResourceBundle.getBundle(className,
-                new Locale("en", "US"));
-      }
-      catch (MissingResourceException e2)
-      {
-
-        // Now we are really in trouble.
-        // very bad, definitely very bad...not going to get very far
-        throw new MissingResourceException(
-          "Could not load any resource bundles.", className, "");
-      }
-    }
-  }
-
-  /**
-   * Return the resource file suffic for the indicated locale
-   * For most locales, this will be based the language code.  However
-   * for Chinese, we do distinguish between Taiwan and PRC
-   *
-   * @param locale the locale
-   * @return an String suffix which canbe appended to a resource name
-   */
-  private static final String getResourceSuffix(Locale locale)
-  {
-
-    String suffix = "_" + locale.getLanguage();
-    String country = locale.getCountry();
-
-    if (country.equals("TW"))
-      suffix += "_" + country;
-
-    return suffix;
-  }
-
 }
--- a/src/com/sun/org/apache/xpath/internal/res/XPATHMessages.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/org/apache/xpath/internal/res/XPATHMessages.java	Sat Feb 16 18:03:23 2013 -0800
@@ -22,130 +22,128 @@
  */
 package com.sun.org.apache.xpath.internal.res;
 
+import com.sun.org.apache.bcel.internal.util.SecuritySupport;
+import com.sun.org.apache.xml.internal.res.XMLMessages;
 import java.util.ListResourceBundle;
 
-import com.sun.org.apache.xml.internal.res.XMLMessages;
-
 /**
  * A utility class for issuing XPath error messages.
+ *
  * @xsl.usage internal
  */
-public class XPATHMessages extends XMLMessages
-{
-  /** The language specific resource object for XPath messages.  */
-  private static ListResourceBundle XPATHBundle = null;
+public class XPATHMessages extends XMLMessages {
 
-  /** The class name of the XPath error message string table.     */
-  private static final String XPATH_ERROR_RESOURCES =
-    "com.sun.org.apache.xpath.internal.res.XPATHErrorResources";
+    /**
+     * The language specific resource object for XPath messages.
+     */
+    private static ListResourceBundle XPATHBundle = null;
+    /**
+     * The class name of the XPath error message string table.
+     */
+    private static final String XPATH_ERROR_RESOURCES =
+            "com.sun.org.apache.xpath.internal.res.XPATHErrorResources";
 
-  /**
-   * Creates a message from the specified key and replacement
-   * arguments, localized to the given locale.
-   *
-   * @param msgKey    The key for the message text.
-   * @param args      The arguments to be used as replacement text
-   *                  in the message created.
-   *
-   * @return The formatted message string.
-   */
-  public static final String createXPATHMessage(String msgKey, Object args[])  //throws Exception
-  {
-    if (XPATHBundle == null)
-      XPATHBundle = loadResourceBundle(XPATH_ERROR_RESOURCES);
+    /**
+     * Creates a message from the specified key and replacement arguments,
+     * localized to the given locale.
+     *
+     * @param msgKey The key for the message text.
+     * @param args The arguments to be used as replacement text in the message
+     * created.
+     *
+     * @return The formatted message string.
+     */
+    public static final String createXPATHMessage(String msgKey, Object args[]) //throws Exception
+    {
+        if (XPATHBundle == null) {
+            XPATHBundle = SecuritySupport.getResourceBundle(XPATH_ERROR_RESOURCES);
+        }
 
-    if (XPATHBundle != null)
-    {
-      return createXPATHMsg(XPATHBundle, msgKey, args);
-    }
-    else
-      return "Could not load any resource bundles.";
-  }
-
-  /**
-   * Creates a message from the specified key and replacement
-   * arguments, localized to the given locale.
-   *
-   * @param msgKey The key for the message text.
-   * @param args      The arguments to be used as replacement text
-   *                  in the message created.
-   *
-   * @return The formatted warning string.
-   */
-  public static final String createXPATHWarning(String msgKey, Object args[])  //throws Exception
-  {
-    if (XPATHBundle == null)
-      XPATHBundle = loadResourceBundle(XPATH_ERROR_RESOURCES);
-
-    if (XPATHBundle != null)
-    {
-      return createXPATHMsg(XPATHBundle, msgKey, args);
-    }
-    else
-      return "Could not load any resource bundles.";
-  }
-
-  /**
-   * Creates a message from the specified key and replacement
-   * arguments, localized to the given locale.
-   *
-   * @param fResourceBundle The resource bundle to use.
-   * @param msgKey  The message key to use.
-   * @param args      The arguments to be used as replacement text
-   *                  in the message created.
-   *
-   * @return The formatted message string.
-   */
-  public static final String createXPATHMsg(ListResourceBundle fResourceBundle,
-                                            String msgKey, Object args[])  //throws Exception
-  {
-
-    String fmsg = null;
-    boolean throwex = false;
-    String msg = null;
-
-    if (msgKey != null)
-      msg = fResourceBundle.getString(msgKey);
-
-    if (msg == null)
-    {
-      msg = fResourceBundle.getString(XPATHErrorResources.BAD_CODE);
-      throwex = true;
+        if (XPATHBundle != null) {
+            return createXPATHMsg(XPATHBundle, msgKey, args);
+        } else {
+            return "Could not load any resource bundles.";
+        }
     }
 
-    if (args != null)
+    /**
+     * Creates a message from the specified key and replacement arguments,
+     * localized to the given locale.
+     *
+     * @param msgKey The key for the message text.
+     * @param args The arguments to be used as replacement text in the message
+     * created.
+     *
+     * @return The formatted warning string.
+     */
+    public static final String createXPATHWarning(String msgKey, Object args[]) //throws Exception
     {
-      try
-      {
-
-        // Do this to keep format from crying.
-        // This is better than making a bunch of conditional
-        // code all over the place.
-        int n = args.length;
-
-        for (int i = 0; i < n; i++)
-        {
-          if (null == args[i])
-            args[i] = "";
+        if (XPATHBundle == null) {
+            XPATHBundle = SecuritySupport.getResourceBundle(XPATH_ERROR_RESOURCES);
         }
 
-        fmsg = java.text.MessageFormat.format(msg, args);
-      }
-      catch (Exception e)
-      {
-        fmsg = fResourceBundle.getString(XPATHErrorResources.FORMAT_FAILED);
-        fmsg += " " + msg;
-      }
-    }
-    else
-      fmsg = msg;
-
-    if (throwex)
-    {
-      throw new RuntimeException(fmsg);
+        if (XPATHBundle != null) {
+            return createXPATHMsg(XPATHBundle, msgKey, args);
+        } else {
+            return "Could not load any resource bundles.";
+        }
     }
 
-    return fmsg;
-  }
+    /**
+     * Creates a message from the specified key and replacement arguments,
+     * localized to the given locale.
+     *
+     * @param fResourceBundle The resource bundle to use.
+     * @param msgKey The message key to use.
+     * @param args The arguments to be used as replacement text in the message
+     * created.
+     *
+     * @return The formatted message string.
+     */
+    public static final String createXPATHMsg(ListResourceBundle fResourceBundle,
+            String msgKey, Object args[]) //throws Exception
+    {
 
+        String fmsg = null;
+        boolean throwex = false;
+        String msg = null;
+
+        if (msgKey != null) {
+            msg = fResourceBundle.getString(msgKey);
+        }
+
+        if (msg == null) {
+            msg = fResourceBundle.getString(XPATHErrorResources.BAD_CODE);
+            throwex = true;
+        }
+
+        if (args != null) {
+            try {
+
+                // Do this to keep format from crying.
+                // This is better than making a bunch of conditional
+                // code all over the place.
+                int n = args.length;
+
+                for (int i = 0; i < n; i++) {
+                    if (null == args[i]) {
+                        args[i] = "";
+                    }
+                }
+
+                fmsg = java.text.MessageFormat.format(msg, args);
+            } catch (Exception e) {
+                fmsg = fResourceBundle.getString(XPATHErrorResources.FORMAT_FAILED);
+                fmsg += " " + msg;
+            }
+        } else {
+            fmsg = msg;
+        }
+
+        if (throwex) {
+            throw new RuntimeException(fmsg);
+        }
+
+        return fmsg;
+    }
 }
--- a/src/com/sun/xml/internal/stream/XMLEntityStorage.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/xml/internal/stream/XMLEntityStorage.java	Sat Feb 16 18:03:23 2013 -0800
@@ -36,6 +36,7 @@
 import com.sun.org.apache.xerces.internal.impl.PropertyManager;
 import com.sun.org.apache.xerces.internal.impl.XMLErrorReporter;
 import com.sun.org.apache.xerces.internal.impl.Constants;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import java.util.Enumeration;
 
 /**
@@ -414,7 +415,7 @@
         // get the user.dir property
         String userDir = "";
         try {
-            userDir = System.getProperty("user.dir");
+            userDir = SecuritySupport.getSystemProperty("user.dir");
         }
         catch (SecurityException se) {
         }
--- a/src/com/sun/xml/internal/stream/writers/WriterUtility.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/xml/internal/stream/writers/WriterUtility.java	Sat Feb 16 18:03:23 2013 -0800
@@ -32,6 +32,7 @@
 import java.nio.charset.Charset;
 import java.nio.charset.CharsetEncoder;
 import com.sun.org.apache.xerces.internal.util.XMLChar;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 
 /**
  * Implements common xml writer functions.
@@ -240,7 +241,7 @@
 
     private CharsetEncoder getDefaultEncoder(){
         try{
-            String encoding = System.getProperty("file.encoding");
+            String encoding = SecuritySupport.getSystemProperty("file.encoding");
             if(encoding != null){
                 return Charset.forName(encoding).newEncoder();
             }
--- a/src/com/sun/xml/internal/stream/writers/XMLStreamWriterImpl.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/com/sun/xml/internal/stream/writers/XMLStreamWriterImpl.java	Sat Feb 16 18:03:23 2013 -0800
@@ -53,6 +53,7 @@
 import com.sun.org.apache.xerces.internal.impl.PropertyManager;
 import com.sun.org.apache.xerces.internal.util.NamespaceSupport;
 import com.sun.org.apache.xerces.internal.util.SymbolTable;
+import com.sun.org.apache.xerces.internal.utils.SecuritySupport;
 import com.sun.org.apache.xerces.internal.xni.QName;
 
 import com.sun.xml.internal.stream.util.ReadOnlyIterator;
@@ -340,7 +341,7 @@
                 fEncoder = Charset.forName(encoding).newEncoder();
             }
         } else {
-            encoding = System.getProperty("file.encoding");
+            encoding = SecuritySupport.getSystemProperty("file.encoding");
             if (encoding != null && encoding.equalsIgnoreCase("utf-8")) {
                 fWriter = new UTF8OutputStreamWriter(os);
             } else {
--- a/src/javax/xml/datatype/FactoryFinder.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/javax/xml/datatype/FactoryFinder.java	Sat Feb 16 18:03:23 2013 -0800
@@ -44,6 +44,7 @@
  * @author Santiago.PericasGeertsen@sun.com
  */
 class FactoryFinder {
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
 
     /**
      * Internal debug flag.
@@ -95,18 +96,24 @@
      * If the class loader supplied is <code>null</code>, first try using the
      * context class loader followed by the current (i.e. bootstrap) class
      * loader.
+     *
+     * Use bootstrap classLoader if cl = null and useBSClsLoader is true
      */
     static private Class getProviderClass(String className, ClassLoader cl,
-            boolean doFallback) throws ClassNotFoundException
+            boolean doFallback, boolean useBSClsLoader) throws ClassNotFoundException
     {
         try {
             if (cl == null) {
-                cl = ss.getContextClassLoader();
-                if (cl == null) {
-                    throw new ClassNotFoundException();
-                }
-                else {
-                    return cl.loadClass(className);
+                if (useBSClsLoader) {
+                    return Class.forName(className, true, FactoryFinder.class.getClassLoader());
+                } else {
+                    cl = ss.getContextClassLoader();
+                    if (cl == null) {
+                        throw new ClassNotFoundException();
+                    }
+                    else {
+                        return cl.loadClass(className);
+                    }
                 }
             }
             else {
@@ -131,8 +138,8 @@
      * @param className Name of the concrete class corresponding to the
      * service provider
      *
-     * @param cl ClassLoader to use to load the class, null means to use
-     * the bootstrap ClassLoader
+     * @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code>
+     * current <code>Thread</code>'s context classLoader is used to load the factory class.
      *
      * @param doFallback True if the current ClassLoader should be tried as
      * a fallback if the class is not found using cl
@@ -140,8 +147,38 @@
     static Object newInstance(String className, ClassLoader cl, boolean doFallback)
         throws ConfigurationError
     {
+        return newInstance(className, cl, doFallback, false);
+    }
+
+    /**
+     * Create an instance of a class. Delegates to method
+     * <code>getProviderClass()</code> in order to load the class.
+     *
+     * @param className Name of the concrete class corresponding to the
+     * service provider
+     *
+     * @param cl ClassLoader to use to load the class, null means to use
+     * the bootstrap ClassLoader
+     *
+     * @param doFallback True if the current ClassLoader should be tried as
+     * a fallback if the class is not found using cl
+     *
+     * @param useBSClsLoader True if cl=null actually meant bootstrap classLoader. This parameter
+     * is needed since DocumentBuilderFactory/SAXParserFactory defined null as context classLoader.
+     */
+    static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader)
+        throws ConfigurationError
+    {
+        // make sure we have access to restricted packages
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                cl = null;
+                useBSClsLoader = true;
+            }
+        }
+
         try {
-            Class providerClass = getProviderClass(className, cl, doFallback);
+            Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
             Object instance = providerClass.newInstance();
             if (debug) {    // Extra check to avoid computing cl strings
                 dPrint("created new instance of " + providerClass +
@@ -244,6 +281,7 @@
 
         // First try the Context ClassLoader
         ClassLoader cl = ss.getContextClassLoader();
+        boolean useBSClsLoader = false;
         if (cl != null) {
             is = ss.getResourceAsStream(cl, serviceId);
 
@@ -251,11 +289,13 @@
             if (is == null) {
                 cl = FactoryFinder.class.getClassLoader();
                 is = ss.getResourceAsStream(cl, serviceId);
+                useBSClsLoader = true;
             }
         } else {
             // No Context ClassLoader, try the current ClassLoader
             cl = FactoryFinder.class.getClassLoader();
             is = ss.getResourceAsStream(cl, serviceId);
+            useBSClsLoader = true;
         }
 
         if (is == null) {
@@ -293,7 +333,7 @@
             // ClassLoader because we want to avoid the case where the
             // resource file was found using one ClassLoader and the
             // provider class was instantiated using a different one.
-            return newInstance(factoryClassName, cl, false);
+            return newInstance(factoryClassName, cl, false, useBSClsLoader);
         }
 
         // No provider found
--- a/src/javax/xml/parsers/FactoryFinder.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/javax/xml/parsers/FactoryFinder.java	Sat Feb 16 18:03:23 2013 -0800
@@ -42,7 +42,7 @@
  * @author Huizhe.Wang@oracle.com
  */
 class FactoryFinder {
-
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
     /**
      * Internal debug flag.
      */
@@ -166,6 +166,14 @@
     static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader)
         throws ConfigurationError
     {
+        // make sure we have access to restricted packages
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                cl = null;
+                useBSClsLoader = true;
+            }
+        }
+
         try {
             Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
             Object instance = providerClass.newInstance();
--- a/src/javax/xml/stream/FactoryFinder.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/javax/xml/stream/FactoryFinder.java	Sat Feb 16 18:03:23 2013 -0800
@@ -25,14 +25,12 @@
 
 package javax.xml.stream;
 
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.IOException;
 import java.io.InputStream;
-import java.io.IOException;
-import java.io.File;
-import java.io.FileInputStream;
-
+import java.io.InputStreamReader;
 import java.util.Properties;
-import java.io.BufferedReader;
-import java.io.InputStreamReader;
 
 /**
  * <p>Implements pluggable Datatypes.</p>
@@ -43,6 +41,8 @@
  * @author Santiago.PericasGeertsen@sun.com
  */
 class FactoryFinder {
+    // Check we have access to package.
+    private static final String DEFAULT_PACKAGE = "com.sun.xml.internal.";
 
     /**
      * Internal debug flag.
@@ -94,18 +94,24 @@
      * If the class loader supplied is <code>null</code>, first try using the
      * context class loader followed by the current (i.e. bootstrap) class
      * loader.
+     *
+     * Use bootstrap classLoader if cl = null and useBSClsLoader is true
      */
     static private Class getProviderClass(String className, ClassLoader cl,
-            boolean doFallback) throws ClassNotFoundException
+            boolean doFallback, boolean useBSClsLoader) throws ClassNotFoundException
     {
         try {
             if (cl == null) {
-                cl = ss.getContextClassLoader();
-                if (cl == null) {
-                    throw new ClassNotFoundException();
-                }
-                else {
-                    return cl.loadClass(className);
+                if (useBSClsLoader) {
+                    return Class.forName(className, true, FactoryFinder.class.getClassLoader());
+                } else {
+                    cl = ss.getContextClassLoader();
+                    if (cl == null) {
+                        throw new ClassNotFoundException();
+                    }
+                    else {
+                        return cl.loadClass(className);
+                    }
                 }
             }
             else {
@@ -130,8 +136,8 @@
      * @param className Name of the concrete class corresponding to the
      * service provider
      *
-     * @param cl ClassLoader to use to load the class, null means to use
-     * the bootstrap ClassLoader
+     * @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code>
+     * current <code>Thread</code>'s context classLoader is used to load the factory class.
      *
      * @param doFallback True if the current ClassLoader should be tried as
      * a fallback if the class is not found using cl
@@ -139,8 +145,38 @@
     static Object newInstance(String className, ClassLoader cl, boolean doFallback)
         throws ConfigurationError
     {
+        return newInstance(className, cl, doFallback, false);
+    }
+
+    /**
+     * Create an instance of a class. Delegates to method
+     * <code>getProviderClass()</code> in order to load the class.
+     *
+     * @param className Name of the concrete class corresponding to the
+     * service provider
+     *
+     * @param cl <code>ClassLoader</code> used to load the factory class. If <code>null</code>
+     * current <code>Thread</code>'s context classLoader is used to load the factory class.
+     *
+     * @param doFallback True if the current ClassLoader should be tried as
+     * a fallback if the class is not found using cl
+     *
+     * @param useBSClsLoader True if cl=null actually meant bootstrap classLoader. This parameter
+     * is needed since DocumentBuilderFactory/SAXParserFactory defined null as context classLoader.
+     */
+    static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader)
+        throws ConfigurationError
+    {
+        // make sure we have access to restricted packages
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                cl = null;
+                useBSClsLoader = true;
+            }
+        }
+
         try {
-            Class providerClass = getProviderClass(className, cl, doFallback);
+            Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
             Object instance = providerClass.newInstance();
             if (debug) {    // Extra check to avoid computing cl strings
                 dPrint("created new instance of " + providerClass +
@@ -233,11 +269,11 @@
                             if (ss.doesFileExist(f)) {
                                 dPrint("Read properties file "+f);
                                 cacheProps.load(ss.getFileInputStream(f));
-                            }
-                        }
                     }
                 }
             }
+                }
+            }
             factoryClassName = cacheProps.getProperty(factoryId);
 
             if (factoryClassName != null) {
@@ -276,6 +312,7 @@
 
         // First try the Context ClassLoader
         ClassLoader cl = ss.getContextClassLoader();
+        boolean useBSClsLoader = false;
         if (cl != null) {
             is = ss.getResourceAsStream(cl, serviceId);
 
@@ -283,11 +320,13 @@
             if (is == null) {
                 cl = FactoryFinder.class.getClassLoader();
                 is = ss.getResourceAsStream(cl, serviceId);
+                useBSClsLoader = true;
             }
         } else {
             // No Context ClassLoader, try the current ClassLoader
             cl = FactoryFinder.class.getClassLoader();
             is = ss.getResourceAsStream(cl, serviceId);
+            useBSClsLoader = true;
         }
 
         if (is == null) {
@@ -325,7 +364,7 @@
             // ClassLoader because we want to avoid the case where the
             // resource file was found using one ClassLoader and the
             // provider class was instantiated using a different one.
-            return newInstance(factoryClassName, cl, false);
+            return newInstance(factoryClassName, cl, false, useBSClsLoader);
         }
 
         // No provider found
--- a/src/javax/xml/transform/FactoryFinder.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/javax/xml/transform/FactoryFinder.java	Sat Feb 16 18:03:23 2013 -0800
@@ -43,6 +43,7 @@
  * @author Huizhe.Wang@oracle.com
  */
 class FactoryFinder {
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xalan.internal.";
 
     /**
      * Internal debug flag.
@@ -169,6 +170,14 @@
     static Object newInstance(String className, ClassLoader cl, boolean doFallback, boolean useBSClsLoader, boolean useServicesMechanism)
         throws ConfigurationError
     {
+        // make sure we have access to restricted packages
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                cl = null;
+                useBSClsLoader = true;
+            }
+        }
+
         try {
             Class providerClass = getProviderClass(className, cl, doFallback, useBSClsLoader);
             Object instance = null;
@@ -210,7 +219,7 @@
                 providerClass.getDeclaredMethod(
                     "newTransformerFactoryNoServiceLoader"
                 );
-                return creationMethod.invoke(null, null);
+                return creationMethod.invoke(null, (Object[])null);
             } catch (NoSuchMethodException exc) {
                 return null;
             } catch (Exception exc) {
--- a/src/javax/xml/validation/SchemaFactoryFinder.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/javax/xml/validation/SchemaFactoryFinder.java	Sat Feb 16 18:03:23 2013 -0800
@@ -54,6 +54,7 @@
      *<p> Take care of restrictions imposed by java security model </p>
      */
     private static SecuritySupport ss = new SecuritySupport();
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
     /**
      * <p>Cache properties for performance.</p>
      */
@@ -213,28 +214,6 @@
             }
         }
 
-        /**
-        // try to read from $java.home/lib/jaxp.properties
-        try {
-            String javah = ss.getSystemProperty( "java.home" );
-            String configFile = javah + File.separator +
-            "lib" + File.separator + "jaxp.properties";
-            File f = new File( configFile );
-            if( ss.doesFileExist(f)) {
-                sf = loadFromProperty(
-                        propertyName,f.getAbsolutePath(), new FileInputStream(f));
-                if(sf!=null)    return sf;
-            } else {
-                debugPrintln("Tried to read "+ f.getAbsolutePath()+", but it doesn't exist.");
-            }
-        } catch(Throwable e) {
-            if( debug ) {
-                debugPrintln("failed to read $java.home/lib/jaxp.properties");
-                e.printStackTrace();
-            }
-        }
-         */
-
         // try META-INF/services files
         Iterator sitr = createServiceFileIterator();
         while(sitr.hasNext()) {
@@ -269,14 +248,20 @@
      */
     private Class createClass(String className) {
             Class clazz;
+        // make sure we have access to restricted packages
+        boolean internal = false;
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                internal = true;
+            }
+        }
 
-            // use approprite ClassLoader
             try {
-                    if (classLoader != null) {
-                            clazz = classLoader.loadClass(className);
-                    } else {
-                            clazz = Class.forName(className);
-                    }
+                if (classLoader != null && !internal) {
+                        clazz = classLoader.loadClass(className);
+                } else {
+                        clazz = Class.forName(className);
+                }
             } catch (Throwable t) {
                 if(debug)   t.printStackTrace();
                     return null;
@@ -357,7 +342,7 @@
                 providerClass.getDeclaredMethod(
                     "newXMLSchemaFactoryNoServiceLoader"
                 );
-                return creationMethod.invoke(null, null);
+                return creationMethod.invoke(null, (Object[])null);
             } catch (NoSuchMethodException exc) {
                 return null;
             } catch (Exception exc) {
--- a/src/javax/xml/xpath/XPathFactoryFinder.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/javax/xml/xpath/XPathFactoryFinder.java	Sat Feb 16 18:03:23 2013 -0800
@@ -48,6 +48,7 @@
  * @since 1.5
  */
 class XPathFactoryFinder  {
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xpath.internal";
 
     private static SecuritySupport ss = new SecuritySupport() ;
     /** debug support code. */
@@ -246,18 +247,25 @@
      */
     private Class createClass(String className) {
             Class clazz;
+        // make sure we have access to restricted packages
+        boolean internal = false;
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                internal = true;
+            }
+        }
 
-            // use approprite ClassLoader
-            try {
-                    if (classLoader != null) {
-                            clazz = classLoader.loadClass(className);
-                    } else {
-                            clazz = Class.forName(className);
-                    }
-            } catch (Throwable t) {
-                if(debug)   t.printStackTrace();
-                    return null;
+        // use approprite ClassLoader
+        try {
+            if (classLoader != null && !internal) {
+                    clazz = classLoader.loadClass(className);
+            } else {
+                    clazz = Class.forName(className);
             }
+        } catch (Throwable t) {
+            if(debug)   t.printStackTrace();
+                return null;
+        }
 
             return clazz;
     }
@@ -333,7 +341,7 @@
                 providerClass.getDeclaredMethod(
                     "newXPathFactoryNoServiceLoader"
                 );
-                return creationMethod.invoke(null, null);
+                return creationMethod.invoke(null, (Object[])null);
             } catch (NoSuchMethodException exc) {
                 return null;
             } catch (Exception exc) {
--- a/src/org/w3c/dom/bootstrap/DOMImplementationRegistry.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/org/w3c/dom/bootstrap/DOMImplementationRegistry.java	Sat Feb 16 18:03:23 2013 -0800
@@ -104,6 +104,8 @@
      */
     private static final String FALLBACK_CLASS =
             "com.sun.org.apache.xerces.internal.dom.DOMXSImplementationSourceImpl";
+    private static final String DEFAULT_PACKAGE =
+            "com.sun.org.apache.xerces.internal.dom";
     /**
      * Private constructor.
      * @param srcs Vector List of DOMImplementationSources
@@ -168,10 +170,15 @@
             StringTokenizer st = new StringTokenizer(p);
             while (st.hasMoreTokens()) {
                 String sourceName = st.nextToken();
-                // Use context class loader, falling back to Class.forName
-                // if and only if this fails...
+                // make sure we have access to restricted packages
+                boolean internal = false;
+                if (System.getSecurityManager() != null) {
+                    if (sourceName != null && sourceName.startsWith(DEFAULT_PACKAGE)) {
+                        internal = true;
+                    }
+                }
                 Class sourceClass = null;
-                if (classLoader != null) {
+                if (classLoader != null && !internal) {
                     sourceClass = classLoader.loadClass(sourceName);
                 } else {
                     sourceClass = Class.forName(sourceName);
--- a/src/org/xml/sax/helpers/NewInstance.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/org/xml/sax/helpers/NewInstance.java	Sat Feb 16 18:03:23 2013 -0800
@@ -54,9 +54,10 @@
  * including versions of Java 2.</p>
  *
  * @author Edwin Goei, David Brownell
+ * @version 2.0.1 (sax2r2)
  */
 class NewInstance {
-
+    private static final String DEFAULT_PACKAGE = "com.sun.org.apache.xerces.internal";
     /**
      * Creates a new instance of the specified class name
      *
@@ -66,8 +67,16 @@
         throws ClassNotFoundException, IllegalAccessException,
             InstantiationException
     {
+        // make sure we have access to restricted packages
+        boolean internal = false;
+        if (System.getSecurityManager() != null) {
+            if (className != null && className.startsWith(DEFAULT_PACKAGE)) {
+                internal = true;
+            }
+        }
+
         Class driverClass;
-        if (classLoader == null) {
+        if (classLoader == null || internal) {
             driverClass = Class.forName(className);
         } else {
             driverClass = classLoader.loadClass(className);
@@ -75,29 +84,4 @@
         return driverClass.newInstance();
     }
 
-    /**
-     * Figure out which ClassLoader to use.  For JDK 1.2 and later use
-     * the context ClassLoader.
-     */
-    static ClassLoader getClassLoader ()
-    {
-        Method m = null;
-
-        try {
-            m = Thread.class.getMethod("getContextClassLoader", (Class[]) null);
-        } catch (NoSuchMethodException e) {
-            // Assume that we are running JDK 1.1, use the current ClassLoader
-            return NewInstance.class.getClassLoader();
-        }
-
-        try {
-            return (ClassLoader) m.invoke(Thread.currentThread(), (Object[]) null);
-        } catch (IllegalAccessException e) {
-            // assert(false)
-            throw new UnknownError(e.getMessage());
-        } catch (InvocationTargetException e) {
-            // assert(e.getTargetException() instanceof SecurityException)
-            throw new UnknownError(e.getMessage());
-        }
-    }
 }
--- a/src/org/xml/sax/helpers/ParserAdapter.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/org/xml/sax/helpers/ParserAdapter.java	Sat Feb 16 18:03:23 2013 -0800
@@ -74,13 +74,14 @@
  *
  * @since SAX 2.0
  * @author David Megginson
+ * @version 2.0.1 (sax2r2)
  * @see org.xml.sax.helpers.XMLReaderAdapter
  * @see org.xml.sax.XMLReader
  * @see org.xml.sax.Parser
  */
 public class ParserAdapter implements XMLReader, DocumentHandler
 {
-
+    private static SecuritySupport ss = new SecuritySupport();
 
     ////////////////////////////////////////////////////////////////////
     // Constructors.
@@ -102,7 +103,7 @@
     {
         super();
 
-        String driver = System.getProperty("org.xml.sax.parser");
+        String driver = ss.getSystemProperty("org.xml.sax.parser");
 
         try {
             setup(ParserFactory.makeParser());
--- a/src/org/xml/sax/helpers/ParserFactory.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/org/xml/sax/helpers/ParserFactory.java	Sat Feb 16 18:03:23 2013 -0800
@@ -30,12 +30,6 @@
 
 package org.xml.sax.helpers;
 
-import java.lang.ClassNotFoundException;
-import java.lang.IllegalAccessException;
-import java.lang.InstantiationException;
-import java.lang.SecurityException;
-import java.lang.ClassCastException;
-
 import org.xml.sax.Parser;
 
 
@@ -69,9 +63,10 @@
  *             interface.
  * @since SAX 1.0
  * @author David Megginson
+ * @version 2.0.1 (sax2r2)
  */
 public class ParserFactory {
-
+    private static SecuritySupport ss = new SecuritySupport();
 
     /**
      * Private null constructor.
@@ -109,7 +104,7 @@
         NullPointerException,
         ClassCastException
     {
-        String className = System.getProperty("org.xml.sax.parser");
+        String className = ss.getSystemProperty("org.xml.sax.parser");
         if (className == null) {
             throw new NullPointerException("No value for sax.parser property");
         } else {
@@ -146,7 +141,7 @@
         ClassCastException
     {
         return (Parser) NewInstance.newInstance (
-                NewInstance.getClassLoader (), className);
+                ss.getContextClassLoader(), className);
     }
 
 }
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/src/org/xml/sax/helpers/SecuritySupport.java	Sat Feb 16 18:03:23 2013 -0800
@@ -0,0 +1,108 @@
+/*
+ * Copyright (c) 2004, 2006, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package org.xml.sax.helpers;
+
+import java.io.*;
+import java.security.*;
+
+/**
+ * This class is duplicated for each JAXP subpackage so keep it in sync.
+ * It is package private and therefore is not exposed as part of the JAXP
+ * API.
+ *
+ * Security related methods that only work on J2SE 1.2 and newer.
+ */
+class SecuritySupport  {
+
+
+    ClassLoader getContextClassLoader() throws SecurityException{
+        return (ClassLoader)
+                AccessController.doPrivileged(new PrivilegedAction() {
+            public Object run() {
+                ClassLoader cl = null;
+                //try {
+                cl = Thread.currentThread().getContextClassLoader();
+                //} catch (SecurityException ex) { }
+
+                if (cl == null)
+                    cl = ClassLoader.getSystemClassLoader();
+
+                return cl;
+            }
+        });
+    }
+
+    String getSystemProperty(final String propName) {
+        return (String)
+            AccessController.doPrivileged(new PrivilegedAction() {
+                public Object run() {
+                    return System.getProperty(propName);
+                }
+            });
+    }
+
+    FileInputStream getFileInputStream(final File file)
+        throws FileNotFoundException
+    {
+        try {
+            return (FileInputStream)
+                AccessController.doPrivileged(new PrivilegedExceptionAction() {
+                    public Object run() throws FileNotFoundException {
+                        return new FileInputStream(file);
+                    }
+                });
+        } catch (PrivilegedActionException e) {
+            throw (FileNotFoundException)e.getException();
+        }
+    }
+
+    InputStream getResourceAsStream(final ClassLoader cl,
+                                           final String name)
+    {
+        return (InputStream)
+            AccessController.doPrivileged(new PrivilegedAction() {
+                public Object run() {
+                    InputStream ris;
+                    if (cl == null) {
+                        ris = Object.class.getResourceAsStream(name);
+                    } else {
+                        ris = cl.getResourceAsStream(name);
+                    }
+                    return ris;
+                }
+            });
+    }
+
+    boolean doesFileExist(final File f) {
+    return ((Boolean)
+            AccessController.doPrivileged(new PrivilegedAction() {
+                public Object run() {
+                    return new Boolean(f.exists());
+                }
+            })).booleanValue();
+    }
+
+}
--- a/src/org/xml/sax/helpers/XMLReaderFactory.java	Thu Feb 14 14:11:20 2013 -0800
+++ b/src/org/xml/sax/helpers/XMLReaderFactory.java	Sat Feb 16 18:03:23 2013 -0800
@@ -34,8 +34,6 @@
 import java.io.BufferedReader;
 import java.io.InputStream;
 import java.io.InputStreamReader;
-import java.security.AccessController;
-import java.security.PrivilegedAction;
 import org.xml.sax.XMLReader;
 import org.xml.sax.SAXException;
 
@@ -85,8 +83,8 @@
     }
 
     private static final String property = "org.xml.sax.driver";
+    private static SecuritySupport ss = new SecuritySupport();
 
-    private static String _clsFromJar = null;
     private static boolean _jarread = false;
     /**
      * Attempt to create an XMLReader from system defaults.
@@ -134,43 +132,45 @@
         throws SAXException
     {
         String          className = null;
-        ClassLoader     loader = NewInstance.getClassLoader ();
+        ClassLoader     cl = ss.getContextClassLoader();
 
         // 1. try the JVM-instance-wide system property
-        try { className = System.getProperty (property); }
-        catch (RuntimeException e) { /* normally fails for applets */ }
+        try {
+            className = ss.getSystemProperty(property);
+        }
+        catch (RuntimeException e) { /* continue searching */ }
 
         // 2. if that fails, try META-INF/services/
         if (className == null) {
             if (!_jarread) {
-                final ClassLoader       loader1 = loader;
                 _jarread = true;
-                _clsFromJar =  (String)
-                AccessController.doPrivileged(new PrivilegedAction() {
-                    public Object run() {
-                        String clsName = null;
-                        try {
-                            String      service = "META-INF/services/" + property;
-                            InputStream in;
-                            BufferedReader      reader;
-                            if (loader1 == null)
-                                in = ClassLoader.getSystemResourceAsStream (service);
-                            else
-                                in = loader1.getResourceAsStream (service);
+                String      service = "META-INF/services/" + property;
+                InputStream in;
+                BufferedReader      reader;
 
-                            if (in != null) {
-                                reader = new BufferedReader (
-                                        new InputStreamReader (in, "UTF8"));
-                                clsName = reader.readLine ();
-                                in.close ();
-                            }
-                        } catch (Exception e) {
+                try {
+                    if (cl != null) {
+                        in = ss.getResourceAsStream(cl, service);
+
+                        // If no provider found then try the current ClassLoader
+                        if (in == null) {
+                            cl = null;
+                            in = ss.getResourceAsStream(cl, service);
                         }
-                        return clsName;
+                    } else {
+                        // No Context ClassLoader, try the current ClassLoader
+                        in = ss.getResourceAsStream(cl, service);
                     }
-                });
+
+                    if (in != null) {
+                        reader = new BufferedReader (
+                                new InputStreamReader (in, "UTF8"));
+                        className = reader.readLine ();
+                        in.close ();
+                    }
+                } catch (Exception e) {
+                }
             }
-            className = _clsFromJar;
         }
 
         // 3. Distro-specific fallback
@@ -187,7 +187,7 @@
 
         // do we know the XMLReader implementation class yet?
         if (className != null)
-            return loadClass (loader, className);
+            return loadClass (cl, className);
 
         // 4. panic -- adapt any SAX1 parser
         try {
@@ -217,7 +217,7 @@
     public static XMLReader createXMLReader (String className)
         throws SAXException
     {
-        return loadClass (NewInstance.getClassLoader (), className);
+        return loadClass (ss.getContextClassLoader(), className);
     }
 
     private static XMLReader loadClass (ClassLoader loader, String className)