JDK-8049514 : FEATURE_SECURE_PROCESSING can not be turned off on a validator through SchemaFactory
  • Type: Bug
  • Component: xml
  • Sub-Component: javax.xml.validation
  • Affected Version: 9
  • Priority: P3
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • Submitted: 2014-07-08
  • Updated: 2016-08-26
  • Resolved: 2014-07-17
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
6u91Fixed 7u76Fixed 8u40Fixed 9 b24Fixed
The setFeature method of SchemaFactory is specified as the following: 
 "Set a feature for this SchemaFactory, Schemas created by this factory, and by extension, Validators and ValidatorHandlers created by those Schemas.
Implementors and developers should pay particular attention to how the special Schema object returned by newSchema() is processed. In some cases, for example, when the SchemaFactory and the class actually loading the schema come from different implementations, it may not be possible for SchemaFactory features to be inherited automatically. Developers should make sure that features, such as secure processing, are explicitly set in both places."
But run the following code snippet on JDK 9, it outputs true 
        SchemaFactory schemaFactory = SchemaFactory.newInstance("http://www.w3.org/2001/XMLSchema");
         schemaFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, false);
         Schema schema = schemaFactory.newSchema(xsdSource); 
        Validator validator = schema.newValidator(); 
        System.out.println( validator.getFeature(XMLConstants.FEATURE_SECURE_PROCESSING));