There are properties incorrectky set in method com.sun.org.apache.xerces.internal.jaxp.DocumentBuilderImpl#setFeatures:

{code}
    private void setFeatures(Hashtable features)
        throws SAXNotSupportedException, SAXNotRecognizedException {
        if (features != null) {
            Iterator entries = features.entrySet().iterator();
            while (entries.hasNext()) {
                Map.Entry entry = (Map.Entry) entries.next();
                String feature = (String) entry.getKey();
                boolean value = ((Boolean) entry.getValue()).booleanValue();
                domParser.setFeature(feature, value);
                if (feature.equals(XMLConstants.FEATURE_SECURE_PROCESSING)) {
                    domParser.setProperty(ACCESS_EXTERNAL_DTD, "");
                    domParser.setProperty(ACCESS_EXTERNAL_SCHEMA, "");
                }
            }
        }
    }
{code}

Actual value isn't used in the condition. If XMLConstants.FEATURE_SECURE_PROCESSING is explicitly turned of (value = false), restrictions are set anyway