Created attachment 24885 [details]
testcase (containg 3 catalogs and CatalogManager.properties)

(sent to the commons-dev list too)

For the long report read Debian bug#552018:
http://bugs.debian.org/552018

Say a catalog contains two entries delegateSystem and delegateURI
rewriting the same URL. Then the resolver fails to work correctly. It
strongly depends on the order in the catalog if the URI gets resolved.
Consider the attached testcase:

java -cp /usr/share/java/xml-commons-resolver-1.1.jar:. \
  org.apache.xml.resolver.apps.resolver -u http://invalid.invalid uri
> Parse catalog: catalog1.xml
> Loading catalog: catalog1.xml
> Default BASE: file:////usr/local/src/bugs/552018/catalog1.xml
> delegateSystem: http://invalid.invalid
>       catalog2.xml
> DELEGATE_SYSTEM: http://invalid.invalid
>       file:////usr/local/src/bugs/552018/catalog2.xml
> delegateURI: http://invalid.invalid
>       catalog2.xml
> DELEGATE_URI: http://invalid.invalid
>       file:////usr/local/src/bugs/552018/catalog2.xml
> Resolve URI (uri):
>         uri: http://invalid.invalid
> resolveURI(http://invalid.invalid)
> Result: null

Why doesn't it select the delegateURI entry? Now this:

java -cp /usr/share/java/xml-commons-resolver-1.1.jar:. \
  org.apache.xml.resolver.apps.resolver -s http://invalid.invalid system
> Parse catalog: catalog1.xml
> Loading catalog: catalog1.xml
> Default BASE: file:////usr/local/src/bugs/552018/catalog1.xml
> delegateSystem: http://invalid.invalid
>       catalog2.xml
> DELEGATE_SYSTEM: http://invalid.invalid
>       file:////usr/local/src/bugs/552018/catalog2.xml
> delegateURI: http://invalid.invalid
>       catalog2.xml
> DELEGATE_URI: http://invalid.invalid
>       file:////usr/local/src/bugs/552018/catalog2.xml
> Resolve SYSTEM (systemid):
>   system id: http://invalid.invalid
> resolveSystem(http://invalid.invalid)
> Switching to delegated catalog(s):
>       file:////usr/local/src/bugs/552018/catalog2.xml
> Parse catalog: file:////usr/local/src/bugs/552018/catalog2.xml
> Loading catalog: file:////usr/local/src/bugs/552018/catalog2.xml
> Default BASE: file:////usr/local/src/bugs/552018/catalog2.xml
> delegateURI: http://invalid.invalid
>       catalog3.xml
> DELEGATE_URI: http://invalid.invalid
>       file:////usr/local/src/bugs/552018/catalog3.xml
> delegateSystem: http://invalid.invalid
>       catalog3.xml
> DELEGATE_SYSTEM: http://invalid.invalid
>       file:////usr/local/src/bugs/552018/catalog3.xml
> resolveSystem(http://invalid.invalid)
> Result: null

It chooses catalog2.xml. But there it fails, because delegateURI is
listed before delegateSystem.

You see the problem? Ask for a system ID and it will fail if a
delegateURI entry with the same URI is parsed before the relevant
delegateSystem entry and ditto for URI and delegateSystem before
delegateURI.