ppkarwasz commented on PR #640: URL: https://github.com/apache/commons-configuration/pull/640#issuecomment-4741152433
> This was theoretically fixed by [JDK-8159139](https://bugs.openjdk.org/browse/JDK-8159139), but still doesn't work. Apparently OpenJDK never got the fix, probably the fix is only present in Oracle's builds. This mean that on JDK 8 parsing this file will always **fail** if `ACCESS_EXTERNAL_SCHEMA` does not contain `https`. This happens even if an `EntityResolver` is set. ```xml <configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:noNamespaceSchemaLocation="https://commons.apache.org/testMultiConfiguration.xsd";> ... </configuration> ``` This is a bummer, because on JDK 9+ libraries can choose to call `DocumentBuilderFactory.newDefaultInstance()`, which solves the problem of implementation-specific hardenings altogether. Almost: Android's default instance will be different from the one in the JDK and will not accept the same options. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
