Summary
-------

Enable the XML Signature secure validation mode by default. This will improve out of the box security by restricting signatures that contain potentially unsafe content.

Problem
-------

The XML Signature secure validation mode is enabled by setting the property `org.jcp.xml.dsig.secureValidation` to `Boolean.TRUE` with the `javax.xml.crypto.XMLCryptoContext.setProperty()` method, or by running the code with a security manager.

Use of a security manager is increasingly rare. This option should be enabled by default regardless of whether a security manager is enabled so that all applications can be protected by default.

Solution
--------

Change `javax.xml.crypto.dsig.dom.DOMValidateContext` to set the property `org.jcp.xml.dsig.secureValidation` to `Boolean.TRUE` by default.

Specification
-------------

Add the following to the class summary of `javax.xml.crypto.dsig.dom.DOMValidateContext`:

    * @implNote
    * By default, the JDK implementation enables a secure validation mode by
    * setting the <code>org.jcp.xml.dsig.secureValidation</code> property to
    * <code>Boolean.TRUE</code> (see the {@link #setProperty setProperty}
    * method). When enabled, validation of XML signatures are subject to 
    * stricter checking of algorithms and other constraints as specified by the
    * <code>jdk.xml.dsig.secureValidationPolicy</code> security property.
 
Change the text for the `jdk.xml.dsig.secureValidationPolicy` in the `java.security` file as follows:
```
  #
- # The policy for the XML Signature secure validation mode. The mode is
- # enabled by setting the property "org.jcp.xml.dsig.secureValidation" to
- # true with the javax.xml.crypto.XMLCryptoContext.setProperty() method,
- # or by running the code with a SecurityManager.
+ # The policy for the XML Signature secure validation mode. Validation of
+ # XML Signatures that violate any of these constraints will fail. The
+ # mode is enforced by default. The mode can be disabled by setting the
+ # property "org.jcp.xml.dsig.secureValidation" to Boolean.FALSE with the
+ # javax.xml.crypto.XMLCryptoContext.setProperty() method.
  #
```