If test uses SAXParser
SAXParser parser = getSAXParser(false, false, false);
parser.setProperty(ACCESS_EXTERNAL_DTD, PROTOCOL_FILE);
then file access is allowed but not http
It works for JDK 8 but not for JDK 7

Attached you will find a test that works differently for JDK 7 than for JDK 8

> java -version; java -Djava.endorsed.dirs=/files/devel/jaxp1.5/endorsed org.kleo.ExternalAccessTest02
java version "1.7.0_21"
Java(TM) SE Runtime Environment (build 1.7.0_21-b09)
Java HotSpot(TM) 64-Bit Server VM (build 23.21-b01, mixed mode)
(SAX) JAXP Property - fail: Http protocol has to be forbidden

> java -version; java -Djava.endorsed.dirs=/files/devel/jaxp1.5/endorsed org.kleo.ExternalAccessTest02
java version "1.8.0-ea-fastdebug"
Java(TM) SE Runtime Environment (build 1.8.0-ea-fastdebug-b75)
Java HotSpot(TM) 64-Bit Server VM (build 25.0-b17-fastdebug, mixed mode)
(SAX) JAXP Property - ok: Http protocol is forbidden