A regression has been introduced in JDK 7 in the XMLDSig XPathFilter2 Transform involving the intersect filter. If the intersect filter is present, but the result of the XPath expression is an empty node-set, it ignores the filter rather than properly performing an intersection with an empty node-set, the result of which should always be an empty node-set. The problem is that the code does not distinguish between filters that are not included in the Transform and those that produce an empty node-set.

This is a fairly obscure case and should occur infrequently in practice, as it would signify that the Transform was probably created incorrectly if the intersect filter didn't select any nodes at all.