Bug ID: JDK-8185991 Illegal SystemId causes TransformerFactory to compute an illegal classname

Type: Bug
Component: xml
Sub-Component: jaxp
Affected Version: 10

Priority: P5
Status: Open
Resolution: Unresolved

Submitted: 2017-08-08
Updated: 2018-09-11

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

Other
tbdUnresolved

There are two issues.

(1) No validation in Source::setSystemId���(String systemId)
     The correctness of a SystemId is not enforced in Source::setSystemId���(String systemId), that made it possible to pass an Illegal SystemId through a Source object to TransformerFactory.

(2) No validation when computing the classname
     The implementation of TransformerFactory does not validate the SystemId it gets from a Source. When the SystemId is incorrect, it can result in an illegal classname. This is  manifested when the default Java version is upgraded higher, e.g. from Java 1.1 to Java 1.5.