Trivial Description
Inside Configuration.substituteVars(), there is a call to System.getProperty(var); this contains the implicit assumption that the JVM will never block access to a system property, because if that is the case -such as when the Configuration is running under a restrictive security manager, a SecurityException gets thrown. This will get thrown all the way up the tree.
Better to have some plan to handle it in situ, such as a log@warn level then leave the property unexpanded.