8356294: Enhance Path Factories

Reviewed-by: abakhtin, fferrari, andrew
Backport-of: 2c7f45612d11199a9d5eaa6d61a2893ec4afa687

Author: Aleksei Voitylov

jaxp/src/com/sun/org/apache/xpath/internal/jaxp/XPathFactoryImpl.java

@@ -187,6 +187,7 @@ public void setFeature(String name, boolean value)
                 if (value && _featureManager != null) {
                     _featureManager.setFeature(JdkXmlFeatures.XmlFeature.ENABLE_EXTENSION_FUNCTION,
                             JdkXmlFeatures.State.FSP, false);
+                    _xmlSecMgr.setSecureProcessing(value);
                 }
 
                 // all done processing feature

jaxp/src/com/sun/org/apache/xpath/internal/jaxp/XPathImpl.java

@@ -20,6 +20,7 @@
 
 package com.sun.org.apache.xpath.internal.jaxp;
 
+import javax.xml.XMLConstants;
 import javax.xml.namespace.QName;
 import javax.xml.namespace.NamespaceContext;
 import javax.xml.xpath.XPathExpressionException;
@@ -180,6 +181,10 @@ private DocumentBuilder getParser() {
             // so we really have to create a fresh DocumentBuilder every time we need one
             // - KK
             DocumentBuilderFactory dbf = JdkXmlUtils.getDOMFactory(overrideDefaultParser);
+            if (xmlSecMgr != null && xmlSecMgr.isSecureProcessingSet()) {
+                dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING,
+                        xmlSecMgr.isSecureProcessing());
+            }
             return dbf.newDocumentBuilder();
         } catch (ParserConfigurationException e) {
             // this should never happen with a well-behaving JAXP implementation.

jaxp/src/jdk/xml/internal/XMLSecurityManager.java

@@ -189,6 +189,12 @@ public static enum Processor {
      */
     boolean secureProcessing;
 
+    /**
+     * Flag indicating the secure processing is set explicitly through factories'
+     * setFeature method and then the setSecureProcessing method
+     */
+    boolean secureProcessingSet;
+
     /**
      * States that determine if properties are set explicitly
      */
@@ -236,6 +242,7 @@ public XMLSecurityManager(boolean secureProcessing) {
      * Setting FEATURE_SECURE_PROCESSING explicitly
      */
     public void setSecureProcessing(boolean secure) {
+        secureProcessingSet = true;
         secureProcessing = secure;
         for (Limit limit : Limit.values()) {
             if (secure) {
@@ -254,6 +261,15 @@ public boolean isSecureProcessing() {
         return secureProcessing;
     }
 
+    /**
+     * Returns the state indicating whether the Secure Processing is set explicitly,
+     * via factories' setFeature and then this class' setSecureProcessing method.
+     * @return the state indicating whether the Secure Processing is set explicitly
+     */
+    public boolean isSecureProcessingSet() {
+        return secureProcessingSet;
+    }
+
     /**
      * Set limit by property name and state
      * @param propertyName property name