https://bz.apache.org/bugzilla/show_bug.cgi?id=64541
--- Comment #1 from Christopher Schultz <ch...@christopherschultz.net> --- Interesting. How are you setting the limit for the JAXP entity expansion... via the system property "jdk.xml.entityExpansionLimit"? What's the security justification for the setting of "1" and not, say, 3 or 5 or 63999? Do you happen to know if the system property will override explicitly-setting the JAXP feature "http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit"? I don't have a test-case handy and if you happen to know the answer it might get us to a solution more quickly. -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org