XMLConstants (Java Platform SE 8 ) (original) (raw)

Property: accessExternalStylesheet

Restrict access to the protocols specified for external references set by the stylesheet processing instruction, Import and Include element, and document function. If access is denied due to the restriction of this property, a runtime exception that is specific to the context is thrown. In the case of constructing newTransformer for example,TransformerConfigurationException will be thrown by the TransformerFactory.

Value: a list of protocols separated by comma. A protocol is the scheme portion of aURI, or in the case of the JAR protocol, "jar" plus the scheme portion separated by colon. A scheme is defined as:

scheme = alpha *( alpha | digit | "+" | "-" | "." )
where alpha = a-z and A-Z.

And the JAR protocol:
jar[:scheme]

Protocols including the keyword "jar" are case-insensitive. Any whitespaces as defined byCharacter.isSpaceChar(char) in the value will be ignored. Examples of protocols are file, http, jar:file.

Default value: The default value is implementation specific and therefore not specified. The following options are provided for consideration:

• an empty string to deny all access to external references;
• a specific protocol, such as file, to give permission to only the protocol;
• the keyword "all" to grant permission to all protocols.

When FEATURE_SECURE_PROCESSING is enabled, it is recommended that implementations restrict external connections by default, though this may cause problems for applications that process XML/XSD/XSL with external references.

Granting all access: the keyword "all" grants permission to all protocols.

System Property: The value of this property can be set or overridden by system property javax.xml.accessExternalStylesheet

${JAVA_HOME}/lib/jaxp.properties: This configuration file is in standard java.util.Properties format. If the file exists and the system property is specified, its value will be used to override the default of the property.