diff --git a/jaxp-api-1.3/src/main/java/org/xml/sax/helpers/SecuritySupport.java b/jaxp-api-1.3/src/main/java/org/xml/sax/helpers/SecuritySupport.java
new file mode 100644
index 0000000..38767de
--- /dev/null
+++ b/jaxp-api-1.3/src/main/java/org/xml/sax/helpers/SecuritySupport.java
@@ -0,0 +1,93 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.xml.sax.helpers;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.InputStream;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
+import java.security.PrivilegedActionException;
+import java.security.PrivilegedExceptionAction;
+
+/**
+ * This class is duplicated for each JAXP subpackage so keep it in sync.
+ * It is package private and therefore is not exposed as part of the JAXP
+ * API.
+ *
+ * Security related methods that only work on J2SE 1.2 and newer.
+ */
+final class SecuritySupport {
+    
+    private SecuritySupport() {}
+
+    static ClassLoader getContextClassLoader() {
+	return (ClassLoader)
+		AccessController.doPrivileged(new PrivilegedAction() {
+	    public Object run() {
+		ClassLoader cl = null;
+		try {
+		    cl = Thread.currentThread().getContextClassLoader();
+		} catch (SecurityException ex) { }
+		return cl;
+	    }
+	});
+    }
+
+    static String getSystemProperty(final String propName) {
+	return (String)
+            AccessController.doPrivileged(new PrivilegedAction() {
+                public Object run() {
+                    return System.getProperty(propName);
+                }
+            });
+    }
+
+    static FileInputStream getFileInputStream(final File file)
+        throws FileNotFoundException
+    {
+	try {
+            return (FileInputStream)
+                AccessController.doPrivileged(new PrivilegedExceptionAction() {
+                    public Object run() throws FileNotFoundException {
+                        return new FileInputStream(file);
+                    }
+                });
+	} catch (PrivilegedActionException e) {
+	    throw (FileNotFoundException)e.getException();
+	}
+    }
+
+    static InputStream getResourceAsStream(final ClassLoader cl,
+                                           final String name)
+    {
+        return (InputStream)
+            AccessController.doPrivileged(new PrivilegedAction() {
+                public Object run() {
+                    InputStream ris;
+                    if (cl == null) {
+                        ris = ClassLoader.getSystemResourceAsStream(name);
+                    } else {
+                        ris = cl.getResourceAsStream(name);
+                    }
+                    return ris;
+                }
+            });
+    }
+}
diff --git a/jaxp-api-1.3/src/main/java/org/xml/sax/helpers/XMLReaderFactory.java b/jaxp-api-1.3/src/main/java/org/xml/sax/helpers/XMLReaderFactory.java
index 762d6fe..ef46075 100644
--- a/jaxp-api-1.3/src/main/java/org/xml/sax/helpers/XMLReaderFactory.java
+++ b/jaxp-api-1.3/src/main/java/org/xml/sax/helpers/XMLReaderFactory.java
@@ -3,7 +3,7 @@
 // Written by David Megginson
 // and by David Brownell
 // NO WARRANTY!  This class is in the Public Domain.
-// $Id: XMLReaderFactory.java 226251 2005-06-21 19:19:22Z mrglavas $
+// $Id: XMLReaderFactory.java 670295 2008-06-22 01:46:43Z mrglavas $
 
 package org.xml.sax.helpers;
 import java.io.BufferedReader;
@@ -111,15 +111,14 @@
     throws SAXException
     {
         String		className = null;
-        SecuritySupport ss = SecuritySupport.getInstance();
         ClassLoader	loader = NewInstance.getClassLoader ();
         
         // 1. try the JVM-instance-wide system property
-        try { className = ss.getSystemProperty (property); }
+        try { className = SecuritySupport.getSystemProperty (property); }
         catch (Exception e) { /* normally fails for applets */ }
         
         // 2. if that fails, try META-INF/services/
-        if (className == null) {
+        if (className == null || className.length() == 0) {
             String      service = "META-INF/services/" + property;
             
 	        try {
@@ -132,22 +131,23 @@
 	        }
 
             InputStream is = null;
+            className = null;
             
             // First try the Context ClassLoader
-            ClassLoader cl = ss.getContextClassLoader();
+            ClassLoader cl = SecuritySupport.getContextClassLoader();
             if (cl != null) {
-                is = ss.getResourceAsStream(cl, service);
+                is = SecuritySupport.getResourceAsStream(cl, service);
                 
                 // If no provider found then try the current ClassLoader
                 if (is == null) {
                     cl = XMLReaderFactory.class.getClassLoader();
-                    is = ss.getResourceAsStream(cl, service);
+                    is = SecuritySupport.getResourceAsStream(cl, service);
                 }
             } else {
                 // No Context ClassLoader or JDK 1.1 so try the current
                 // ClassLoader
                 cl = XMLReaderFactory.class.getClassLoader();
-                is = ss.getResourceAsStream(cl, service);
+                is = SecuritySupport.getResourceAsStream(cl, service);
             }
             
             if (is != null) {