From: Paul Sandoz <Paul.Sandoz_at_Sun.COM>
Date: Tue, 14 Jul 2009 09:24:25 +0200

On Jul 13, 2009, at 11:20 PM, Craig McClanahan wrote:

> With the latest bits (r2499), I am getting a jersey-tests failure
> when building the trunk (Java 1.6, on both Mac and Linux).
>
> -------------------------------------------------------------------------------
> Test set: com.sun.jersey.impl.entity.XXETest
> -------------------------------------------------------------------------------
> Tests run: 14, Failures: 1, Errors: 0, Skipped: 0, Time elapsed:
> 8.959 sec <<< F
> AILURE!
> testDOMSecure(com.sun.jersey.impl.entity.XXETest) Time elapsed:
> 0.412 sec <<<
> FAILURE!
> junit.framework.ComparisonFailure: expected:<> but was:<COMPROMISED>
> at junit.framework.Assert.assertEquals(Assert.java:81)
> at junit.framework.Assert.assertEquals(Assert.java:87)
> at
> com.sun.jersey.impl.entity.XXETest.testDOMSecure(XXETest.java:290)
>
> Perhaps the logic to set up XML security is Java version specific?
>

The configuration is as follows:

     @Override
     protected DocumentBuilderFactory getInstance() {
         DocumentBuilderFactory f =
DocumentBuilderFactory.newInstance();

         f.setNamespaceAware(true);

         if (!disableXmlSecurity) {
             f.setExpandEntityReferences(false);
         }

         return f;
     }

Is this a bug in the DocumentBuilderFactory?

Paul.