[HADOOP-12126] Configuration might use ApplicationClassLoader to create XML parser

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.7.0
• Component/s: conf
• Assignee: Laurent Goujon
• Reporter: Laurent Goujon
• Created: 27/Jun/15 00:08
• Updated: 07/Jan/17 01:56

Description

org.apache.hadoop.conf.Configuration creates a new DocumentBuilder to parse the XML config files, but it doesn't specify which classloader to use to discover and instantiate the XML parser.

Because DocumentBuilderFactory relies on ServiceProvider, whose by default, uses the context classloader. If classpath isolation is turned on, one might expect that that Configuration will only load classes from the system classloader, but it turns out that the context classloader is set to ApplicationClassLoader, and that a XML parser might be loaded from the user classpath.