ppkarwasz commented on code in PR #114:
URL:
https://github.com/apache/commons-secure-xml/pull/114#discussion_r4223720643
##########
src/main/java/org/apache/commons/xml/secure/SecureXMLInputFactory.java:
##########
@@ -285,7 +285,8 @@ public static XMLInputFactory newDefaultFactory() {
}
try {
// Java 8: the method does not exist, and XMLInputFactory has no
class-name-taking lookup; instantiate the JDK's built-in default directly.
- return secure((XMLInputFactory)
Class.forName(JDK_XML_INPUT_FACTORY).getConstructor().newInstance());
+ // Load it from the bootstrap loader: our own loader may not see
com.sun.* (for example, an OSGi bundle class loader).
+ return secure((XMLInputFactory)
Class.forName(JDK_XML_INPUT_FACTORY, true,
null).getConstructor().newInstance());
} catch (final ReflectiveOperationException e) {
Review Comment:
I would rather allow `SecurityException` to propagate directly to the
caller, instead of wrapping it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
