Affects Version/s: 2.7
Fix Version/s: None
Security Level: No security risk; visible to anyone (Ordinary problems in Xalan projects. Anybody can view the issue.)
Environment:Operating System: Other
On jdk >=1.2 (but <1.4) xalan uses the ContextClassLoader to load classes of
its own distribution. This is never appropriate and will lead to
ClassCastException in a J2EE setting.
For loading classes of its own distribution, the (current) ClassLoader that has
loaded the distribution classes (i.e. xalan.jar) should be used.
The problem shows up when there is a (outdated) xalan in your (ClassLoader)
path but you want to use a newer version of xalan in your application. Note
that this is NOT an obscure setting but the normal case in every J2EE (1.3)
application because you are guarantied to have JAXP XML access, but often to an
outdated product (in my case I'm using IBM WAS 5.0.1 on Solaris).
In principle the problem is the same as reported for xerces
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24244 . This is because the
offending class is the same in both distributions: