feat(jdk8): move files to new folder to avoid resources compiled.

jdkSrc/jdk8/jdk/xml/internal/JdkXmlFeatures.java

@@ -0,0 +1,383 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package jdk.xml.internal;
+
+import javax.xml.XMLConstants;
+import static jdk.xml.internal.JdkXmlUtils.OVERRIDE_PARSER;
+
+/**
+ * This class manages JDK's XML Features. Previously added features and properties
+ * may be gradually moved to this class.
+ */
+public class JdkXmlFeatures {
+    public static final String ORACLE_JAXP_PROPERTY_PREFIX =
+        "http://www.oracle.com/xml/jaxp/properties/";
+
+    public static final String XML_FEATURE_MANAGER =
+            ORACLE_JAXP_PROPERTY_PREFIX + "XmlFeatureManager";
+
+    public static final String ORACLE_FEATURE_SERVICE_MECHANISM =
+            "http://www.oracle.com/feature/use-service-mechanism";
+
+    /**
+     * Feature enableExtensionFunctions
+     */
+    public static final String ORACLE_ENABLE_EXTENSION_FUNCTION =
+            ORACLE_JAXP_PROPERTY_PREFIX + "enableExtensionFunctions";
+    public static final String SP_ENABLE_EXTENSION_FUNCTION =
+            "javax.xml.enableExtensionFunctions";
+    // This is the correct name by the spec
+    public static final String SP_ENABLE_EXTENSION_FUNCTION_SPEC =
+            "jdk.xml.enableExtensionFunctions";
+
+    public static enum XmlFeature {
+        /**
+         * Feature enableExtensionFunctions
+         * FSP: extension function is enforced by FSP. When FSP is on, extension
+         * function is disabled.
+         */
+        ENABLE_EXTENSION_FUNCTION(ORACLE_ENABLE_EXTENSION_FUNCTION, SP_ENABLE_EXTENSION_FUNCTION_SPEC,
+                ORACLE_ENABLE_EXTENSION_FUNCTION, SP_ENABLE_EXTENSION_FUNCTION,
+                true, false, true, true),
+
+        /**
+         * Feature overrideDefaultParser
+         * FSP: not enforced by FSP.
+         */
+        JDK_OVERRIDE_PARSER(OVERRIDE_PARSER, OVERRIDE_PARSER,
+                ORACLE_FEATURE_SERVICE_MECHANISM, ORACLE_FEATURE_SERVICE_MECHANISM,
+                false, false, true, false);
+
+        private final String name;
+        private final String nameSP;
+        private final String nameOld;
+        private final String nameOldSP;
+        private final boolean valueDefault;
+        private final boolean valueEnforced;
+        private final boolean hasSystem;
+        private final boolean enforced;
+
+        /**
+         * Constructs an XmlFeature instance.
+         * @param name the name of the feature
+         * @param nameSP the name of the System Property
+         * @param nameOld the name of the corresponding legacy property
+         * @param nameOldSP the system property of the legacy property
+         * @param value the value of the feature
+         * @param hasSystem a flag to indicate whether the feature is supported
+         * @param enforced a flag indicating whether the feature is
+         * FSP (Feature_Secure_Processing) enforced
+         * with a System property
+         */
+        XmlFeature(String name, String nameSP, String nameOld, String nameOldSP,
+                boolean value, boolean valueEnforced, boolean hasSystem, boolean enforced) {
+            this.name = name;
+            this.nameSP = nameSP;
+            this.nameOld = nameOld;
+            this.nameOldSP = nameOldSP;
+            this.valueDefault = value;
+            this.valueEnforced = valueEnforced;
+            this.hasSystem = hasSystem;
+            this.enforced = enforced;
+        }
+
+        /**
+         * Checks whether the specified property is equal to the current property.
+         * @param propertyName the name of a property
+         * @return true if the specified property is the current property, false
+         * otherwise
+         */
+        boolean equalsPropertyName(String propertyName) {
+            return name.equals(propertyName) ||
+                    (nameOld != null && nameOld.equals(propertyName));
+        }
+
+        /**
+         * Returns the name of the property.
+         *
+         * @return the name of the property
+         */
+        public String apiProperty() {
+            return name;
+        }
+
+        /**
+         * Returns the name of the corresponding System Property.
+         *
+         * @return the name of the System Property
+         */
+        String systemProperty() {
+            return nameSP;
+        }
+
+        /**
+         * Returns the name of the legacy System Property.
+         *
+         * @return the name of the legacy System Property
+         */
+        String systemPropertyOld() {
+            return nameOldSP;
+        }
+
+        /**
+         * Returns the default value of the property.
+         * @return the default value of the property
+         */
+        public boolean defaultValue() {
+            return valueDefault;
+        }
+
+        /**
+         * Returns the FSP-enforced value.
+         * @return the FSP-enforced value
+         */
+        public boolean enforcedValue() {
+            return valueEnforced;
+        }
+
+        /**
+         * Checks whether System property is supported for the feature.
+         * @return true it is supported, false otherwise
+         */
+        boolean hasSystemProperty() {
+            return hasSystem;
+        }
+
+        /**
+         * Checks whether the property is enforced by FSP
+         * @return true it is, false otherwise
+         */
+        boolean enforced() {
+            return enforced;
+        }
+
+    }
+
+    /**
+     * States of the settings of a property, in the order: default value, value
+     * set by FEATURE_SECURE_PROCESSING, jaxp.properties file, jaxp system
+     * properties, and jaxp api properties
+     */
+    public static enum State {
+        //this order reflects the overriding order
+
+        DEFAULT("default"), FSP("FEATURE_SECURE_PROCESSING"),
+        JAXPDOTPROPERTIES("jaxp.properties"), SYSTEMPROPERTY("system property"),
+        APIPROPERTY("property");
+
+        final String literal;
+        State(String literal) {
+            this.literal = literal;
+        }
+
+        String literal() {
+            return literal;
+        }
+    }
+
+    /**
+     * Values of the features
+     */
+    private final boolean[] featureValues;
+
+    /**
+     * States of the settings for each property
+     */
+    private final State[] states;
+
+    /**
+     * Flag indicating if secure processing is set
+     */
+    boolean secureProcessing;
+
+    /**
+     * Instantiate JdkXmlFeatures and initialize the fields
+     * @param secureProcessing
+     */
+    public JdkXmlFeatures(boolean secureProcessing) {
+        featureValues = new boolean[XmlFeature.values().length];
+        states = new State[XmlFeature.values().length];
+        this.secureProcessing = secureProcessing;
+        for (XmlFeature f : XmlFeature.values()) {
+            if (secureProcessing && f.enforced()) {
+                featureValues[f.ordinal()] = f.enforcedValue();
+                states[f.ordinal()] = State.FSP;
+            } else {
+                featureValues[f.ordinal()] = f.defaultValue();
+                states[f.ordinal()] = State.DEFAULT;
+            }
+        }
+        //read system properties or jaxp.properties
+        readSystemProperties();
+    }
+
+    /**
+     * Updates the JdkXmlFeatures instance by reading the system properties again.
+     * This will become necessary in case the system properties are set after
+     * the instance has been created.
+     */
+    public void update() {
+        readSystemProperties();
+    }
+
+    /**
+     * Set feature by property name and state
+     * @param propertyName property name
+     * @param state the state of the property
+     * @param value the value of the property
+     * @return true if the property is managed by the JdkXmlFeatures instance;
+     *         false otherwise.
+     */
+    public boolean setFeature(String propertyName, State state, Object value) {
+        int index = getIndex(propertyName);
+        if (index > -1) {
+            setFeature(index, state, value);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Set the value for a specific feature.
+     *
+     * @param feature the feature
+     * @param state the state of the property
+     * @param value the value of the property
+     */
+    public void setFeature(XmlFeature feature, State state, boolean value) {
+        setFeature(feature.ordinal(), state, value);
+    }
+
+    /**
+     * Return the value of the specified property
+     *
+     * @param feature the property
+     * @return the value of the property
+     */
+    public boolean getFeature(XmlFeature feature) {
+        return featureValues[feature.ordinal()];
+    }
+
+    /**
+     * Return the value of a feature by its index (the Feature's ordinal)
+     * @param index the index of a feature
+     * @return value of a feature
+     */
+    public boolean getFeature(int index) {
+        return featureValues[index];
+    }
+
+    /**
+     * Set the value of a property by its index
+     *
+     * @param index the index of the property
+     * @param state the state of the property
+     * @param value the value of the property
+     */
+    public void setFeature(int index, State state, Object value) {
+        boolean temp;
+        if (Boolean.class.isAssignableFrom(value.getClass())) {
+            temp = (Boolean)value;
+        } else {
+            temp = Boolean.parseBoolean((String) value);
+        }
+        setFeature(index, state, temp);
+    }
+
+    /**
+     * Set the value of a property by its index
+     *
+     * @param index the index of the property
+     * @param state the state of the property
+     * @param value the value of the property
+     */
+    public void setFeature(int index, State state, boolean value) {
+        //only update if it shall override
+        if (state.compareTo(states[index]) >= 0) {
+            featureValues[index] = value;
+            states[index] = state;
+        }
+    }
+
+    /**
+     * Get the index by property name
+     *
+     * @param propertyName property name
+     * @return the index of the property if found; return -1 if not
+     */
+    public int getIndex(String propertyName) {
+        for (XmlFeature feature : XmlFeature.values()) {
+            if (feature.equalsPropertyName(propertyName)) {
+                //internally, ordinal is used as index
+                return feature.ordinal();
+            }
+        }
+        return -1;
+    }
+
+    /**
+     * Read from system properties, or those in jaxp.properties
+     */
+    private void readSystemProperties() {
+        for (XmlFeature feature : XmlFeature.values()) {
+            if (!getSystemProperty(feature, feature.systemProperty())) {
+                //if system property is not found, try the older form if any
+                String oldName = feature.systemPropertyOld();
+                if (oldName != null) {
+                    getSystemProperty(feature, oldName);
+                }
+            }
+        }
+    }
+
+    /**
+     * Read from system properties, or those in jaxp.properties
+     *
+     * @param feature the feature get
+     * @param sysPropertyName the name of system property
+     * @return true if the system property is found, false otherwise
+     */
+    private boolean getSystemProperty(XmlFeature feature, String sysPropertyName) {
+        try {
+            String value = SecuritySupport.getSystemProperty(sysPropertyName);
+            if (value != null && !value.equals("")) {
+                setFeature(feature, State.SYSTEMPROPERTY, Boolean.parseBoolean(value));
+                return true;
+            }
+
+            value = SecuritySupport.readJAXPProperty(sysPropertyName);
+            if (value != null && !value.equals("")) {
+                setFeature(feature, State.JAXPDOTPROPERTIES, Boolean.parseBoolean(value));
+                return true;
+            }
+        } catch (NumberFormatException e) {
+            //invalid setting
+            throw new NumberFormatException("Invalid setting for system property: " + feature.systemProperty());
+        }
+        return false;
+    }
+
+}

jdkSrc/jdk8/jdk/xml/internal/JdkXmlUtils.java

@@ -0,0 +1,305 @@
+/*
+ * Copyright (c) 2016, 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package jdk.xml.internal;
+
+import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl;
+import com.sun.org.apache.xerces.internal.impl.Constants;
+import com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderFactoryImpl;
+import com.sun.org.apache.xerces.internal.jaxp.SAXParserFactoryImpl;
+import javax.xml.XMLConstants;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.TransformerConfigurationException;
+import javax.xml.transform.sax.SAXTransformerFactory;
+import org.w3c.dom.Document;
+import org.xml.sax.SAXException;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+import org.xml.sax.XMLReader;
+
+/**
+ * Constants for use across JAXP processors.
+ */
+public class JdkXmlUtils {
+    private static final String DOM_FACTORY_ID = "javax.xml.parsers.DocumentBuilderFactory";
+    private static final String SAX_FACTORY_ID = "javax.xml.parsers.SAXParserFactory";
+    private static final String SAX_DRIVER = "org.xml.sax.driver";
+
+    /**
+     * Xerces features
+     */
+    public static final String NAMESPACES_FEATURE =
+        Constants.SAX_FEATURE_PREFIX + Constants.NAMESPACES_FEATURE;
+    public static final String NAMESPACE_PREFIXES_FEATURE =
+        Constants.SAX_FEATURE_PREFIX + Constants.NAMESPACE_PREFIXES_FEATURE;
+
+    /**
+     * jdk.xml.overrideDefaultParser: enables the use of a 3rd party's parser
+     * implementation to override the system-default parser.
+     */
+    public static final String OVERRIDE_PARSER = "jdk.xml.overrideDefaultParser";
+    public static final boolean OVERRIDE_PARSER_DEFAULT = SecuritySupport.getJAXPSystemProperty(
+                    Boolean.class, OVERRIDE_PARSER, "false");
+
+    /**
+     * Values for a feature
+     */
+    public static final String FEATURE_TRUE = "true";
+    public static final String FEATURE_FALSE = "false";
+
+    /**
+     * The system-default factory
+     */
+    private static final SAXParserFactory defaultSAXFactory = getSAXFactory(false);
+
+    /**
+     * Returns the value.
+     *
+     * @param value the specified value
+     * @param defValue the default value
+     * @return the value, or the default value if the value is null
+     */
+    public static int getValue(Object value, int defValue) {
+        if (value == null) {
+            return defValue;
+        }
+
+        if (value instanceof Number) {
+            return ((Number) value).intValue();
+        } else if (value instanceof String) {
+            return Integer.parseInt(String.valueOf(value));
+        } else {
+            throw new IllegalArgumentException("Unexpected class: "
+                    + value.getClass());
+        }
+    }
+
+    /**
+     * Sets the XMLReader instance with the specified property if the the
+     * property is supported, ignores error if not, issues a warning if so
+     * requested.
+     *
+     * @param reader an XMLReader instance
+     * @param property the name of the property
+     * @param value the value of the property
+     * @param warn a flag indicating whether a warning should be issued
+     */
+    public static void setXMLReaderPropertyIfSupport(XMLReader reader, String property,
+            Object value, boolean warn) {
+        try {
+            reader.setProperty(property, value);
+        } catch (SAXNotRecognizedException | SAXNotSupportedException e) {
+            if (warn) {
+                XMLSecurityManager.printWarning(reader.getClass().getName(),
+                        property, e);
+            }
+        }
+    }
+
+    /**
+     * Returns an XMLReader instance. If overrideDefaultParser is requested, use
+     * SAXParserFactory or XMLReaderFactory, otherwise use the system-default
+     * SAXParserFactory to locate an XMLReader.
+     *
+     * @param overrideDefaultParser a flag indicating whether a 3rd party's
+     * parser implementation may be used to override the system-default one
+     * @param secureProcessing a flag indicating whether secure processing is
+     * requested
+     * @return an XMLReader instance
+     */
+    public static XMLReader getXMLReader(boolean overrideDefaultParser,
+            boolean secureProcessing) {
+        SAXParserFactory saxFactory;
+        XMLReader reader = null;
+        String spSAXDriver = SecuritySupport.getSystemProperty(SAX_DRIVER);
+        if (spSAXDriver != null) {
+            reader = getXMLReaderWXMLReaderFactory();
+        } else if (overrideDefaultParser) {
+            reader = getXMLReaderWSAXFactory(overrideDefaultParser);
+        }
+
+        if (reader != null) {
+            if (secureProcessing) {
+                try {
+                    reader.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, secureProcessing);
+                } catch (SAXException e) {
+                    XMLSecurityManager.printWarning(reader.getClass().getName(),
+                            XMLConstants.FEATURE_SECURE_PROCESSING, e);
+                }
+            }
+            try {
+                reader.setFeature(NAMESPACES_FEATURE, true);
+                reader.setFeature(NAMESPACE_PREFIXES_FEATURE, false);
+            } catch (SAXException se) {
+                // older version of a parser
+            }
+            return reader;
+        }
+
+        // use the system-default
+        saxFactory = defaultSAXFactory;
+
+        try {
+            reader = saxFactory.newSAXParser().getXMLReader();
+        } catch (ParserConfigurationException | SAXException ex) {
+            // shall not happen with the system-default reader
+        }
+        return reader;
+    }
+
+    /**
+     * Creates a system-default DOM Document.
+     *
+     * @return a DOM Document instance
+     */
+    public static Document getDOMDocument() {
+        try {
+            DocumentBuilderFactory dbf = JdkXmlUtils.getDOMFactory(false);
+            return dbf.newDocumentBuilder().newDocument();
+        } catch (ParserConfigurationException pce) {
+            // can never happen with the system-default configuration
+        }
+        return null;
+    }
+
+    /**
+     * Returns a DocumentBuilderFactory instance.
+     *
+     * @param overrideDefaultParser a flag indicating whether the system-default
+     * implementation may be overridden. If the system property of the
+     * DOM factory ID is set, override is always allowed.
+     *
+     * @return a DocumentBuilderFactory instance.
+     */
+    public static DocumentBuilderFactory getDOMFactory(boolean overrideDefaultParser) {
+        boolean override = overrideDefaultParser;
+        String spDOMFactory = SecuritySupport.getJAXPSystemProperty(DOM_FACTORY_ID);
+
+        if (spDOMFactory != null && System.getSecurityManager() == null) {
+            override = true;
+        }
+        DocumentBuilderFactory dbf
+                = !override
+                        ? new DocumentBuilderFactoryImpl()
+                        : DocumentBuilderFactory.newInstance();
+        dbf.setNamespaceAware(true);
+        // false is the default setting. This step here is for compatibility
+        dbf.setValidating(false);
+        return dbf;
+    }
+
+    /**
+     * Returns a SAXParserFactory instance.
+     *
+     * @param overrideDefaultParser a flag indicating whether the system-default
+     * implementation may be overridden. If the system property of the
+     * DOM factory ID is set, override is always allowed.
+     *
+     * @return a SAXParserFactory instance.
+     */
+    public static SAXParserFactory getSAXFactory(boolean overrideDefaultParser) {
+        boolean override = overrideDefaultParser;
+        String spSAXFactory = SecuritySupport.getJAXPSystemProperty(SAX_FACTORY_ID);
+        if (spSAXFactory != null && System.getSecurityManager() == null) {
+            override = true;
+        }
+
+        SAXParserFactory factory
+                = !override
+                        ? new SAXParserFactoryImpl()
+                        : SAXParserFactory.newInstance();
+        factory.setNamespaceAware(true);
+        return factory;
+    }
+
+    public static SAXTransformerFactory getSAXTransformFactory(boolean overrideDefaultParser) {
+        SAXTransformerFactory tf = overrideDefaultParser
+                ? (SAXTransformerFactory) SAXTransformerFactory.newInstance()
+                : (SAXTransformerFactory) new TransformerFactoryImpl();
+        try {
+            tf.setFeature(OVERRIDE_PARSER, overrideDefaultParser);
+        } catch (TransformerConfigurationException ex) {
+            // ignore since it'd never happen with the JDK impl.
+        }
+        return tf;
+    }
+
+    /**
+     * Returns the external declaration for a DTD construct.
+     *
+     * @param publicId the public identifier
+     * @param systemId the system identifier
+     * @return a DTD external declaration
+     */
+    public static String getDTDExternalDecl(String publicId, String systemId) {
+        StringBuilder sb = new StringBuilder();
+        if (null != publicId) {
+            sb.append(" PUBLIC ");
+            sb.append(quoteString(publicId));
+        }
+
+        if (null != systemId) {
+            if (null == publicId) {
+                sb.append(" SYSTEM ");
+            } else {
+                sb.append(" ");
+            }
+
+            sb.append(quoteString(systemId));
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Returns the input string quoted with double quotes or single ones if
+     * there is a double quote in the string.
+     * @param s the input string, can not be null
+     * @return the quoted string
+     */
+    private static String quoteString(String s) {
+        char c = (s.indexOf('"') > -1) ? '\'' : '"';
+        return c + s + c;
+    }
+
+    private static XMLReader getXMLReaderWSAXFactory(boolean overrideDefaultParser) {
+        SAXParserFactory saxFactory = getSAXFactory(overrideDefaultParser);
+        try {
+            return saxFactory.newSAXParser().getXMLReader();
+        } catch (ParserConfigurationException | SAXException ex) {
+            return getXMLReaderWXMLReaderFactory();
+        }
+    }
+
+    @SuppressWarnings("deprecation")
+    private static XMLReader getXMLReaderWXMLReaderFactory() {
+        try {
+            return org.xml.sax.helpers.XMLReaderFactory.createXMLReader();
+        } catch (SAXException ex1) {
+        }
+        return null;
+    }
+}

jdkSrc/jdk8/jdk/xml/internal/SecuritySupport.java

@@ -0,0 +1,168 @@
+/*
+ * Copyright (c) 2017, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package jdk.xml.internal;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.io.InputStream;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+import java.util.Properties;
+
+/**
+ * This class contains utility methods for reading resources in the JAXP packages
+ */
+class SecuritySupport {
+    /**
+     * Cache for properties in java.home/lib/jaxp.properties
+     */
+    static final Properties cacheProps = new Properties();
+
+    /**
+     * Flag indicating whether java.home/lib/jaxp.properties has been read
+     */
+    static volatile boolean firstTime = true;
+
+    private SecuritySupport() {}
+
+    /**
+     * Reads JAXP system property with privilege
+     *
+     * @param propName the name of the property
+     * @return the value of the property
+     */
+    public static String getSystemProperty(final String propName) {
+        return AccessController.doPrivileged(new PrivilegedAction<String>() {
+            @Override
+            public String run() {
+                return System.getProperty(propName);
+            }
+        });
+    }
+
+    /**
+     * Reads a system property.
+     *
+     * @param <T> the type of the property value
+     * @param type the type of the property value
+     * @param propName the name of the property
+     * @param defValue the default value
+     * @return the value of the property, or the default value of no system
+     * property is found
+     */
+    public static <T> T getJAXPSystemProperty(Class<T> type, String propName, String defValue) {
+        String value = getJAXPSystemProperty(propName);
+        if (value == null) {
+            value = defValue;
+        }
+        if (Integer.class.isAssignableFrom(type)) {
+            return type.cast(Integer.parseInt(value));
+        } else if (Boolean.class.isAssignableFrom(type)) {
+            return type.cast(Boolean.parseBoolean(value));
+        }
+        return type.cast(value);
+    }
+
+    /**
+     * Reads JAXP system property in this order: system property,
+     * $java.home/lib/jaxp.properties if the system property is not specified
+     *
+     * @param propName the name of the property
+     * @return the value of the property
+     */
+    public static String getJAXPSystemProperty(String propName) {
+        String value = getSystemProperty(propName);
+        if (value == null) {
+            value = readJAXPProperty(propName);
+        }
+        return value;
+    }
+
+    /**
+     * Reads the specified property from $java.home/lib/jaxp.properties
+     *
+     * @param propName the name of the property
+     * @return the value of the property
+     */
+    public static String readJAXPProperty(String propName) {
+        String value = null;
+        InputStream is = null;
+        try {
+            if (firstTime) {
+                synchronized (cacheProps) {
+                    if (firstTime) {
+                        String configFile = getSystemProperty("java.home") + File.separator
+                                + "lib" + File.separator + "jaxp.properties";
+                        File f = new File(configFile);
+                        if (getFileExists(f)) {
+                            is = getFileInputStream(f);
+                            cacheProps.load(is);
+                        }
+                        firstTime = false;
+                    }
+                }
+            }
+            value = cacheProps.getProperty(propName);
+
+        } catch (IOException ex) {
+        } finally {
+            if (is != null) {
+                try {
+                    is.close();
+                } catch (IOException ex) {}
+            }
+        }
+
+        return value;
+    }
+
+//------------------- private methods ---------------------------
+    static boolean getFileExists(final File f) {
+        return AccessController.doPrivileged(new PrivilegedAction<Boolean>() {
+            @Override
+            public Boolean run() {
+                return f.exists() ? Boolean.TRUE : Boolean.FALSE;
+            }
+        });
+    }
+
+    static FileInputStream getFileInputStream(final File file) throws FileNotFoundException {
+        try {
+            return AccessController.doPrivileged(new PrivilegedExceptionAction<FileInputStream>() {
+                @Override
+                public FileInputStream run() throws Exception {
+                    return new FileInputStream(file);
+                }
+            });
+        } catch (PrivilegedActionException e) {
+            throw (FileNotFoundException) e.getException();
+        }
+    }
+}

jdkSrc/jdk8/jdk/xml/internal/XMLLimitAnalyzer.java

@@ -0,0 +1,249 @@
+/*
+ * Copyright (c) 2013, 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+package jdk.xml.internal;
+
+import java.util.Formatter;
+import java.util.HashMap;
+import java.util.Map;
+import jdk.xml.internal.XMLSecurityManager.Limit;
+import com.sun.org.apache.xalan.internal.XalanConstants;
+
+
+/**
+ * A helper for analyzing entity expansion limits
+ *
+ */
+public final class XMLLimitAnalyzer {
+
+    /**
+     * Map old property names with the new ones
+     */
+    public static enum NameMap {
+        ENTITY_EXPANSION_LIMIT(XalanConstants.SP_ENTITY_EXPANSION_LIMIT, XalanConstants.ENTITY_EXPANSION_LIMIT),
+        MAX_OCCUR_NODE_LIMIT(XalanConstants.SP_MAX_OCCUR_LIMIT, XalanConstants.MAX_OCCUR_LIMIT),
+        ELEMENT_ATTRIBUTE_LIMIT(XalanConstants.SP_ELEMENT_ATTRIBUTE_LIMIT, XalanConstants.ELEMENT_ATTRIBUTE_LIMIT);
+
+        final String newName;
+        final String oldName;
+
+        NameMap(String newName, String oldName) {
+            this.newName = newName;
+            this.oldName = oldName;
+        }
+
+        String getOldName(String newName) {
+            if (newName.equals(this.newName)) {
+                return oldName;
+            }
+            return null;
+        }
+    }
+
+    /**
+     * Max value accumulated for each property
+     */
+    private final int[] values;
+    /**
+     * Names of the entities corresponding to their max values
+     */
+    private final String[] names;
+    /**
+     * Total value of accumulated entities
+     */
+    private final int[] totalValue;
+
+    /**
+     * Maintain values of the top 10 elements in the process of parsing
+     */
+    private final Map<String, Integer>[] caches;
+
+    private String entityStart, entityEnd;
+    /**
+     * Default constructor. Establishes default values for known security
+     * vulnerabilities.
+     */
+    @SuppressWarnings({"rawtypes", "unchecked"})
+    public XMLLimitAnalyzer() {
+        values = new int[Limit.values().length];
+        totalValue = new int[Limit.values().length];
+        names = new String[Limit.values().length];
+        caches = new Map[Limit.values().length];
+    }
+
+    /**
+     * Add the value to the current max count for the specified property
+     * To find the max value of all entities, set no limit
+     *
+     * @param limit the type of the property
+     * @param entityName the name of the entity
+     * @param value the value of the entity
+     */
+    public void addValue(Limit limit, String entityName, int value) {
+        addValue(limit.ordinal(), entityName, value);
+    }
+
+    /**
+     * Add the value to the current count by the index of the property
+     * @param index the index of the property
+     * @param entityName the name of the entity
+     * @param value the value of the entity
+     */
+    public void addValue(int index, String entityName, int value) {
+        if (index == Limit.ENTITY_EXPANSION_LIMIT.ordinal() ||
+                index == Limit.MAX_OCCUR_NODE_LIMIT.ordinal() ||
+                index == Limit.ELEMENT_ATTRIBUTE_LIMIT.ordinal() ||
+                index == Limit.TOTAL_ENTITY_SIZE_LIMIT.ordinal() ||
+                index == Limit.ENTITY_REPLACEMENT_LIMIT.ordinal()
+                ) {
+            totalValue[index] += value;
+            return;
+        }
+        if (index == Limit.MAX_ELEMENT_DEPTH_LIMIT.ordinal() ||
+                index == Limit.MAX_NAME_LIMIT.ordinal()) {
+            values[index] = value;
+            totalValue[index] = value;
+            return;
+        }
+
+        Map<String, Integer> cache;
+        if (caches[index] == null) {
+            cache = new HashMap<>(10);
+            caches[index] = cache;
+        } else {
+            cache = caches[index];
+        }
+
+        int accumulatedValue = value;
+        if (cache.containsKey(entityName)) {
+            accumulatedValue += cache.get(entityName);
+            cache.put(entityName, accumulatedValue);
+        } else {
+            cache.put(entityName, value);
+        }
+
+        if (accumulatedValue > values[index]) {
+            values[index] = accumulatedValue;
+            names[index] = entityName;
+        }
+
+
+        if (index == Limit.GENERAL_ENTITY_SIZE_LIMIT.ordinal() ||
+                index == Limit.PARAMETER_ENTITY_SIZE_LIMIT.ordinal()) {
+            totalValue[Limit.TOTAL_ENTITY_SIZE_LIMIT.ordinal()] += value;
+        }
+    }
+
+    /**
+     * Return the value of the current max count for the specified property
+     *
+     * @param limit the property
+     * @return the value of the property
+     */
+    public int getValue(Limit limit) {
+        return getValue(limit.ordinal());
+    }
+
+    public int getValue(int index) {
+        if (index == Limit.ENTITY_REPLACEMENT_LIMIT.ordinal()) {
+            return totalValue[index];
+        }
+        return values[index];
+    }
+    /**
+     * Return the total value accumulated so far
+     *
+     * @param limit the property
+     * @return the accumulated value of the property
+     */
+    public int getTotalValue(Limit limit) {
+        return totalValue[limit.ordinal()];
+    }
+
+    public int getTotalValue(int index) {
+        return totalValue[index];
+    }
+    /**
+     * Return the current max value (count or length) by the index of a property
+     * @param index the index of a property
+     * @return count of a property
+     */
+    public int getValueByIndex(int index) {
+        return values[index];
+    }
+
+    public void startEntity(String name) {
+        entityStart = name;
+    }
+
+    public boolean isTracking(String name) {
+        if (entityStart == null) {
+            return false;
+        }
+        return entityStart.equals(name);
+    }
+    /**
+     * Stop tracking the entity
+     * @param limit the limit property
+     * @param name the name of an entity
+     */
+    public void endEntity(Limit limit, String name) {
+        entityStart = "";
+        Map<String, Integer> cache = caches[limit.ordinal()];
+        if (cache != null) {
+            cache.remove(name);
+        }
+    }
+
+    /**
+     * Resets the current value of the specified limit.
+     * @param limit The limit to be reset.
+     */
+    public void reset(Limit limit) {
+        if (limit.ordinal() == Limit.TOTAL_ENTITY_SIZE_LIMIT.ordinal()) {
+            totalValue[limit.ordinal()] = 0;
+        } else if (limit.ordinal() == Limit.GENERAL_ENTITY_SIZE_LIMIT.ordinal()) {
+            names[limit.ordinal()] = null;
+            values[limit.ordinal()] = 0;
+            caches[limit.ordinal()] = null;
+            totalValue[limit.ordinal()] = 0;
+        }
+    }
+
+    public void debugPrint(XMLSecurityManager securityManager) {
+        Formatter formatter = new Formatter();
+        System.out.println(formatter.format("%30s %15s %15s %15s %30s",
+                "Property","Limit","Total size","Size","Entity Name"));
+
+        for (Limit limit : Limit.values()) {
+            formatter = new Formatter();
+            System.out.println(formatter.format("%30s %15d %15d %15d %30s",
+                    limit.name(),
+                    securityManager.getLimit(limit),
+                    totalValue[limit.ordinal()],
+                    values[limit.ordinal()],
+                    names[limit.ordinal()]));
+        }
+    }
+}

jdkSrc/jdk8/jdk/xml/internal/XMLSecurityManager.java

@@ -0,0 +1,604 @@
+/*
+ * Copyright (c) 2013, 2022, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Oracle designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+package jdk.xml.internal;
+
+import com.sun.org.apache.xerces.internal.util.SecurityManager;
+import java.util.concurrent.CopyOnWriteArrayList;
+import com.sun.org.apache.xalan.internal.XalanConstants;
+import org.xml.sax.SAXException;
+
+
+/**
+ *
+ * This class manages standard and implementation-specific limitations.
+ *
+ */
+public final class XMLSecurityManager {
+
+    /**
+     * States of the settings of a property, in the order: default value, value
+     * set by FEATURE_SECURE_PROCESSING, jaxp.properties file, jaxp system
+     * properties, and jaxp api properties
+     */
+    public static enum State {
+        //this order reflects the overriding order
+
+        DEFAULT("default"), FSP("FEATURE_SECURE_PROCESSING"),
+        JAXPDOTPROPERTIES("jaxp.properties"), SYSTEMPROPERTY("system property"),
+        APIPROPERTY("property");
+
+        final String literal;
+        State(String literal) {
+            this.literal = literal;
+        }
+
+        String literal() {
+            return literal;
+        }
+    }
+
+    /**
+     * Limits managed by the security manager
+     */
+    public static enum Limit {
+        ENTITY_EXPANSION_LIMIT("EntityExpansionLimit", XalanConstants.JDK_ENTITY_EXPANSION_LIMIT,
+            XalanConstants.SP_ENTITY_EXPANSION_LIMIT, 0, 64000, Processor.PARSER),
+        MAX_OCCUR_NODE_LIMIT("MaxOccurLimit", XalanConstants.JDK_MAX_OCCUR_LIMIT,
+            XalanConstants.SP_MAX_OCCUR_LIMIT, 0, 5000, Processor.PARSER),
+        ELEMENT_ATTRIBUTE_LIMIT("ElementAttributeLimit", XalanConstants.JDK_ELEMENT_ATTRIBUTE_LIMIT,
+            XalanConstants.SP_ELEMENT_ATTRIBUTE_LIMIT, 0, 10000, Processor.PARSER),
+        TOTAL_ENTITY_SIZE_LIMIT("TotalEntitySizeLimit", XalanConstants.JDK_TOTAL_ENTITY_SIZE_LIMIT,
+            XalanConstants.SP_TOTAL_ENTITY_SIZE_LIMIT, 0, 50000000, Processor.PARSER),
+        GENERAL_ENTITY_SIZE_LIMIT("MaxEntitySizeLimit", XalanConstants.JDK_GENERAL_ENTITY_SIZE_LIMIT,
+            XalanConstants.SP_GENERAL_ENTITY_SIZE_LIMIT, 0, 0, Processor.PARSER),
+        PARAMETER_ENTITY_SIZE_LIMIT("MaxEntitySizeLimit", XalanConstants.JDK_PARAMETER_ENTITY_SIZE_LIMIT,
+            XalanConstants.SP_PARAMETER_ENTITY_SIZE_LIMIT, 0, 1000000, Processor.PARSER),
+        MAX_ELEMENT_DEPTH_LIMIT("MaxElementDepthLimit", XalanConstants.JDK_MAX_ELEMENT_DEPTH,
+            XalanConstants.SP_MAX_ELEMENT_DEPTH, 0, 0, Processor.PARSER),
+        MAX_NAME_LIMIT("MaxXMLNameLimit", XalanConstants.JDK_XML_NAME_LIMIT,
+            XalanConstants.SP_XML_NAME_LIMIT, 1000, 1000, Processor.PARSER),
+        ENTITY_REPLACEMENT_LIMIT("EntityReplacementLimit", XalanConstants.JDK_ENTITY_REPLACEMENT_LIMIT,
+            XalanConstants.SP_ENTITY_REPLACEMENT_LIMIT, 0, 3000000, Processor.PARSER),
+        XPATH_GROUP_LIMIT("XPathGroupLimit", XalanConstants.XPATH_GROUP_LIMIT,
+            XalanConstants.XPATH_GROUP_LIMIT, 10, 10, Processor.XPATH),
+        XPATH_OP_LIMIT("XPathExprOpLimit", XalanConstants.XPATH_OP_LIMIT,
+            XalanConstants.XPATH_OP_LIMIT, 100, 100, Processor.XPATH),
+        XPATH_TOTALOP_LIMIT("XPathTotalOpLimit", XalanConstants.XPATH_TOTALOP_LIMIT,
+            XalanConstants.XPATH_TOTALOP_LIMIT, 10000, 10000, Processor.XPATH)
+        ;
+
+        final String key;
+        final String apiProperty;
+        final String systemProperty;
+        final int defaultValue;
+        final int secureValue;
+        final Processor processor;
+
+        Limit(String key, String apiProperty, String systemProperty, int value,
+                int secureValue, Processor processor) {
+            this.key = key;
+            this.apiProperty = apiProperty;
+            this.systemProperty = systemProperty;
+            this.defaultValue = value;
+            this.secureValue = secureValue;
+            this.processor = processor;
+        }
+
+        public boolean equalsAPIPropertyName(String propertyName) {
+            return (propertyName == null) ? false : apiProperty.equals(propertyName);
+        }
+
+        public boolean equalsSystemPropertyName(String propertyName) {
+            return (propertyName == null) ? false : systemProperty.equals(propertyName);
+        }
+
+        public String key() {
+            return key;
+        }
+
+        public String apiProperty() {
+            return apiProperty;
+        }
+
+        String systemProperty() {
+            return systemProperty;
+        }
+
+        public int defaultValue() {
+            return defaultValue;
+        }
+
+        public boolean isSupported(Processor p) {
+            return processor == p;
+        }
+
+        int secureValue() {
+            return secureValue;
+        }
+    }
+
+    /**
+     * Map old property names with the new ones
+     */
+    public static enum NameMap {
+
+        ENTITY_EXPANSION_LIMIT(XalanConstants.SP_ENTITY_EXPANSION_LIMIT, XalanConstants.ENTITY_EXPANSION_LIMIT),
+        MAX_OCCUR_NODE_LIMIT(XalanConstants.SP_MAX_OCCUR_LIMIT, XalanConstants.MAX_OCCUR_LIMIT),
+        ELEMENT_ATTRIBUTE_LIMIT(XalanConstants.SP_ELEMENT_ATTRIBUTE_LIMIT, XalanConstants.ELEMENT_ATTRIBUTE_LIMIT);
+        final String newName;
+        final String oldName;
+
+        NameMap(String newName, String oldName) {
+            this.newName = newName;
+            this.oldName = oldName;
+        }
+
+        String getOldName(String newName) {
+            if (newName.equals(this.newName)) {
+                return oldName;
+            }
+            return null;
+        }
+    }
+
+    /**
+     * Supported processors
+     */
+    public static enum Processor {
+        PARSER,
+        XPATH,
+    }
+
+    private static final int NO_LIMIT = 0;
+
+    /**
+     * Values of the properties
+     */
+    private final int[] values;
+
+    /**
+     * States of the settings for each property
+     */
+    private State[] states;
+
+    /**
+     * Flag indicating if secure processing is set
+     */
+    boolean secureProcessing;
+
+    /**
+     * States that determine if properties are set explicitly
+     */
+    private boolean[] isSet;
+
+
+    /**
+     * Index of the special entityCountInfo property
+     */
+    private final int indexEntityCountInfo = 10000;
+    private String printEntityCountInfo = "";
+
+    /**
+     * Default constructor. Establishes default values for known security
+     * vulnerabilities.
+     */
+    public XMLSecurityManager() {
+        this(false);
+    }
+
+    /**
+     * Instantiate Security Manager in accordance with the status of
+     * secure processing
+     * @param secureProcessing
+     */
+    public XMLSecurityManager(boolean secureProcessing) {
+        values = new int[Limit.values().length];
+        states = new State[Limit.values().length];
+        isSet = new boolean[Limit.values().length];
+        this.secureProcessing = secureProcessing;
+        for (Limit limit : Limit.values()) {
+            if (secureProcessing) {
+                values[limit.ordinal()] = limit.secureValue;
+                states[limit.ordinal()] = State.FSP;
+            } else {
+                values[limit.ordinal()] = limit.defaultValue();
+                states[limit.ordinal()] = State.DEFAULT;
+            }
+        }
+        //read system properties or jaxp.properties
+        readSystemProperties();
+    }
+
+    /**
+     * Setting FEATURE_SECURE_PROCESSING explicitly
+     */
+    public void setSecureProcessing(boolean secure) {
+        secureProcessing = secure;
+        for (Limit limit : Limit.values()) {
+            if (secure) {
+                setLimit(limit.ordinal(), State.FSP, limit.secureValue());
+            } else {
+                setLimit(limit.ordinal(), State.FSP, limit.defaultValue());
+            }
+        }
+    }
+
+    /**
+     * Return the state of secure processing
+     * @return the state of secure processing
+     */
+    public boolean isSecureProcessing() {
+        return secureProcessing;
+    }
+
+    /**
+     * Set limit by property name and state
+     * @param propertyName property name
+     * @param state the state of the property
+     * @param value the value of the property
+     * @return true if the property is managed by the security manager; false
+     *              if otherwise.
+     */
+    public boolean setLimit(String propertyName, State state, Object value) {
+        int index = getIndex(propertyName);
+        if (index > -1) {
+            setLimit(index, state, value);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Set the value for a specific limit.
+     *
+     * @param limit the limit
+     * @param state the state of the property
+     * @param value the value of the property
+     */
+    public void setLimit(Limit limit, State state, int value) {
+        setLimit(limit.ordinal(), state, value);
+    }
+
+    /**
+     * Set the value of a property by its index
+     *
+     * @param index the index of the property
+     * @param state the state of the property
+     * @param value the value of the property
+     */
+    public void setLimit(int index, State state, Object value) {
+        if (index == indexEntityCountInfo) {
+            printEntityCountInfo = (String)value;
+        } else {
+            int temp = 0;
+            try {
+                temp = Integer.parseInt((String) value);
+                if (temp < 0) {
+                    temp = 0;
+                }
+            } catch (NumberFormatException e) {}
+            setLimit(index, state, temp);        }
+    }
+
+    /**
+     * Set the value of a property by its index
+     *
+     * @param index the index of the property
+     * @param state the state of the property
+     * @param value the value of the property
+     */
+    public void setLimit(int index, State state, int value) {
+        if (index == indexEntityCountInfo) {
+            //if it's explicitly set, it's treated as yes no matter the value
+            printEntityCountInfo = XalanConstants.JDK_YES;
+        } else {
+            //only update if it shall override
+            if (state.compareTo(states[index]) >= 0) {
+                values[index] = value;
+                states[index] = state;
+                isSet[index] = true;
+            }
+        }
+    }
+
+    /**
+     * Return the value of the specified property
+     *
+     * @param propertyName the property name
+     * @return the value of the property as a string. If a property is managed
+     * by this manager, its value shall not be null.
+     */
+    public String getLimitAsString(String propertyName) {
+        int index = getIndex(propertyName);
+        if (index > -1) {
+            return getLimitValueByIndex(index);
+        }
+
+        return null;
+    }
+    /**
+     * Return the value of the specified property
+     *
+     * @param limit the property
+     * @return the value of the property
+     */
+    public int getLimit(Limit limit) {
+        return values[limit.ordinal()];
+    }
+
+    /**
+     * Return the value of a property by its ordinal
+     *
+     * @param limit the property
+     * @return value of a property
+     */
+    public String getLimitValueAsString(Limit limit) {
+        return Integer.toString(values[limit.ordinal()]);
+    }
+
+    /**
+     * Return the value of a property by its ordinal
+     *
+     * @param index the index of a property
+     * @return limit of a property as a string
+     */
+    public String getLimitValueByIndex(int index) {
+        if (index == indexEntityCountInfo) {
+            return printEntityCountInfo;
+        }
+
+        return Integer.toString(values[index]);
+    }
+
+    /**
+     * Return the state of the limit property
+     *
+     * @param limit the limit
+     * @return the state of the limit property
+     */
+    public State getState(Limit limit) {
+        return states[limit.ordinal()];
+    }
+
+    /**
+     * Return the state of the limit property
+     *
+     * @param limit the limit
+     * @return the state of the limit property
+     */
+    public String getStateLiteral(Limit limit) {
+        return states[limit.ordinal()].literal();
+    }
+
+    /**
+     * Get the index by property name
+     *
+     * @param propertyName property name
+     * @return the index of the property if found; return -1 if not
+     */
+    public int getIndex(String propertyName) {
+        for (Limit limit : Limit.values()) {
+            if (limit.equalsAPIPropertyName(propertyName)) {
+                //internally, ordinal is used as index
+                return limit.ordinal();
+            }
+        }
+        //special property to return entity count info
+        if (propertyName.equals(XalanConstants.JDK_ENTITY_COUNT_INFO)) {
+            return indexEntityCountInfo;
+        }
+        return -1;
+    }
+
+    /**
+     * Check if there's no limit defined by the Security Manager
+     * @param limit
+     * @return
+     */
+    public boolean isNoLimit(int limit) {
+        return limit == NO_LIMIT;
+    }
+    /**
+     * Check if the size (length or count) of the specified limit property is
+     * over the limit
+     *
+     * @param limit the type of the limit property
+     * @param entityName the name of the entity
+     * @param size the size (count or length) of the entity
+     * @return true if the size is over the limit, false otherwise
+     */
+    public boolean isOverLimit(Limit limit, String entityName, int size,
+            XMLLimitAnalyzer limitAnalyzer) {
+        return isOverLimit(limit.ordinal(), entityName, size, limitAnalyzer);
+    }
+
+    /**
+     * Check if the value (length or count) of the specified limit property is
+     * over the limit
+     *
+     * @param index the index of the limit property
+     * @param entityName the name of the entity
+     * @param size the size (count or length) of the entity
+     * @return true if the size is over the limit, false otherwise
+     */
+    public boolean isOverLimit(int index, String entityName, int size,
+            XMLLimitAnalyzer limitAnalyzer) {
+        if (values[index] == NO_LIMIT) {
+            return false;
+        }
+        if (size > values[index]) {
+            limitAnalyzer.addValue(index, entityName, size);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Check against cumulated value
+     *
+     * @param limit the type of the limit property
+     * @param size the size (count or length) of the entity
+     * @return true if the size is over the limit, false otherwise
+     */
+    public boolean isOverLimit(Limit limit, XMLLimitAnalyzer limitAnalyzer) {
+        return isOverLimit(limit.ordinal(), limitAnalyzer);
+    }
+
+    public boolean isOverLimit(int index, XMLLimitAnalyzer limitAnalyzer) {
+        if (values[index] == NO_LIMIT) {
+            return false;
+        }
+
+        if (index == Limit.ELEMENT_ATTRIBUTE_LIMIT.ordinal() ||
+                index == Limit.ENTITY_EXPANSION_LIMIT.ordinal() ||
+                index == Limit.TOTAL_ENTITY_SIZE_LIMIT.ordinal() ||
+                index == Limit.ENTITY_REPLACEMENT_LIMIT.ordinal() ||
+                index == Limit.MAX_ELEMENT_DEPTH_LIMIT.ordinal() ||
+                index == Limit.MAX_NAME_LIMIT.ordinal()
+                ) {
+            return (limitAnalyzer.getTotalValue(index) > values[index]);
+        } else {
+            return (limitAnalyzer.getValue(index) > values[index]);
+        }
+    }
+
+    public void debugPrint(XMLLimitAnalyzer limitAnalyzer) {
+        if (printEntityCountInfo.equals(XalanConstants.JDK_YES)) {
+            limitAnalyzer.debugPrint(this);
+        }
+    }
+
+
+    /**
+     * Indicate if a property is set explicitly
+     * @param index
+     * @return
+     */
+    public boolean isSet(int index) {
+        return isSet[index];
+    }
+
+    public boolean printEntityCountInfo() {
+        return printEntityCountInfo.equals(XalanConstants.JDK_YES);
+    }
+
+    /**
+     * Read from system properties, or those in jaxp.properties
+     */
+    private void readSystemProperties() {
+
+        for (Limit limit : Limit.values()) {
+            if (!getSystemProperty(limit, limit.systemProperty())) {
+                //if system property is not found, try the older form if any
+                for (NameMap nameMap : NameMap.values()) {
+                    String oldName = nameMap.getOldName(limit.systemProperty());
+                    if (oldName != null) {
+                        getSystemProperty(limit, oldName);
+                    }
+                }
+            }
+        }
+
+    }
+
+    // Array list to store printed warnings for each SAX parser used
+    private static final CopyOnWriteArrayList<String> printedWarnings = new CopyOnWriteArrayList<>();
+
+    /**
+     * Prints out warnings if a parser does not support the specified feature/property.
+     *
+     * @param parserClassName the name of the parser class
+     * @param propertyName the property name
+     * @param exception the exception thrown by the parser
+     */
+    public static void printWarning(String parserClassName, String propertyName, SAXException exception) {
+        String key = parserClassName+":"+propertyName;
+        if (printedWarnings.addIfAbsent(key)) {
+            System.err.println( "Warning: "+parserClassName+": "+exception.getMessage());
+        }
+    }
+
+    /**
+     * Read from system properties, or those in jaxp.properties
+     *
+     * @param property the type of the property
+     * @param sysPropertyName the name of system property
+     */
+    private boolean getSystemProperty(Limit limit, String sysPropertyName) {
+        try {
+            String value = SecuritySupport.getSystemProperty(sysPropertyName);
+            if (value != null && !value.equals("")) {
+                values[limit.ordinal()] = Integer.parseInt(value);
+                states[limit.ordinal()] = State.SYSTEMPROPERTY;
+                return true;
+            }
+
+            value = SecuritySupport.readJAXPProperty(sysPropertyName);
+            if (value != null && !value.equals("")) {
+                values[limit.ordinal()] = Integer.parseInt(value);
+                states[limit.ordinal()] = State.JAXPDOTPROPERTIES;
+                return true;
+            }
+        } catch (NumberFormatException e) {
+            //invalid setting
+            throw new NumberFormatException("Invalid setting for system property: " + limit.systemProperty());
+        }
+        return false;
+    }
+
+
+    /**
+     * Convert a value set through setProperty to XMLSecurityManager.
+     * If the value is an instance of XMLSecurityManager, use it to override the default;
+     * If the value is an old SecurityManager, convert to the new XMLSecurityManager.
+     *
+     * @param value user specified security manager
+     * @param securityManager an instance of XMLSecurityManager
+     * @return an instance of the new security manager XMLSecurityManager
+     */
+    public static XMLSecurityManager convert(Object value, XMLSecurityManager securityManager) {
+        if (value == null) {
+            if (securityManager == null) {
+                securityManager = new XMLSecurityManager(true);
+            }
+            return securityManager;
+        }
+        if (value instanceof XMLSecurityManager) {
+            return (XMLSecurityManager)value;
+        } else {
+            if (securityManager == null) {
+                securityManager = new XMLSecurityManager(true);
+            }
+            if (value instanceof SecurityManager) {
+                SecurityManager origSM = (SecurityManager)value;
+                securityManager.setLimit(Limit.MAX_OCCUR_NODE_LIMIT, State.APIPROPERTY, origSM.getMaxOccurNodeLimit());
+                securityManager.setLimit(Limit.ENTITY_EXPANSION_LIMIT, State.APIPROPERTY, origSM.getEntityExpansionLimit());
+                securityManager.setLimit(Limit.ELEMENT_ATTRIBUTE_LIMIT, State.APIPROPERTY, origSM.getElementAttrLimit());
+            }
+            return securityManager;
+        }
+    }
+}