diff -u -r xalan-j_2_7_1/src/org/apache/xalan/processor/TransformerFactoryImpl.java xalan-j_2_7_1/src/org/apache/xalan/processor/TransformerFactoryImpl.java
--- xalan-j_2_7_1/src/org/apache/xalan/processor/TransformerFactoryImpl.java	2007-11-23 05:43:52.000000000 +0800
+++ xalan-j_2_7_1/src/org/apache/xalan/processor/TransformerFactoryImpl.java	2014-04-10 14:42:32.919401384 +0800
@@ -335,6 +335,10 @@
           reader = XMLReaderFactory.createXMLReader();
         }
 
+	if(m_isSecureProcessing)
+        {
+            reader.setFeature("http://xml.org/sax/features/external-general-entities",false);
+        }
         // Need to set options!
         reader.setContentHandler(handler);
         reader.parse(isource);
diff -u -r xalan-j_2_7_1/src/org/apache/xalan/processor/XSLTElementProcessor.java xalan-j_2_7_1/src/org/apache/xalan/processor/XSLTElementProcessor.java
--- xalan-j_2_7_1/src/org/apache/xalan/processor/XSLTElementProcessor.java	2007-11-23 05:43:53.000000000 +0800
+++ xalan-j_2_7_1/src/org/apache/xalan/processor/XSLTElementProcessor.java	2014-04-10 15:22:02.121299365 +0800
@@ -338,17 +338,31 @@
       }
       else
       {
-        // Can we switch the order here:
-
-        boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName,
-                             attributes.getQName(i), attributes.getValue(i),
-                             target);
-                             
-        // Now we only add the element if it passed a validation check
-        if (success)
-            processedDefs.add(attrDef);
+        //handle secure processing
+        if(handler.getStylesheetProcessor()==null)
+            System.out.println("stylesheet processor null");
+        if(attrDef.getName().compareTo("*")==0 && handler.getStylesheetProcessor().isSecureProcessing())
+        {
+            //foreign attributes are not allowed in secure processing mode
+            // Then barf, because this element does not allow this attribute.
+            handler.error(XSLTErrorResources.ER_ATTR_NOT_ALLOWED, new Object[]{attributes.getQName(i), rawName}, null);//"\""+attributes.getQName(i)+"\""
+            //+ " attribute is not allowed on the " + rawName
+            // + " element!", null);
+        }
         else
-            errorDefs.add(attrDef);
+        {
+
+
+            boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName,
+                                 attributes.getQName(i), attributes.getValue(i),
+                                 target);
+
+            // Now we only add the element if it passed a validation check
+            if (success)
+                processedDefs.add(attrDef);
+            else
+                errorDefs.add(attrDef);
+        }
       }
     }
 
diff -u -r xalan-j_2_7_1/src/org/apache/xalan/transformer/TransformerImpl.java xalan-j_2_7_1/src/org/apache/xalan/transformer/TransformerImpl.java
--- xalan-j_2_7_1/src/org/apache/xalan/transformer/TransformerImpl.java	2007-11-23 05:43:55.000000000 +0800
+++ xalan-j_2_7_1/src/org/apache/xalan/transformer/TransformerImpl.java	2014-04-10 15:23:37.520295257 +0800
@@ -438,7 +438,9 @@
     try
     {
       if (sroot.getExtensions() != null)
-        m_extensionsTable = new ExtensionsTable(sroot);
+        //only load extensions if secureProcessing is disabled
+        if(!sroot.isSecureProcessing())
+            m_extensionsTable = new ExtensionsTable(sroot);
     }
     catch (javax.xml.transform.TransformerException te)
     {te.printStackTrace();}
diff -u -r xalan-j_2_7_1/src/org/apache/xpath/functions/FuncSystemProperty.java xalan-j_2_7_1/src/org/apache/xpath/functions/FuncSystemProperty.java
--- xalan-j_2_7_1/src/org/apache/xpath/functions/FuncSystemProperty.java	2007-11-23 05:43:53.000000000 +0800
+++ xalan-j_2_7_1/src/org/apache/xpath/functions/FuncSystemProperty.java	2014-04-10 15:33:49.741268895 +0800
@@ -58,7 +58,7 @@
 
     String fullName = m_arg0.execute(xctxt).str();
     int indexOfNSSep = fullName.indexOf(':');
-    String result;
+    String result = null;
     String propName = "";
 
     // List of properties where the name of the
@@ -98,14 +98,21 @@
 
         try
         {
-          result = System.getProperty(propName);
-
-          if (null == result)
-          {
-
-            // result = System.getenv(propName);
-            return XString.EMPTYSTRING;
-          }
+          //if secure procession is enabled only handle required properties do not not map any valid system property
+          if(!xctxt.isSecureProcessing())
+            {
+                result = System.getProperty(fullName);
+            }
+            else
+            {
+                warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION,
+                        new Object[]{ fullName });  //"SecurityException when trying to access XSL system property: "+fullName);
+                result = xsltInfo.getProperty(propName);
+            }
+            if (null == result)
+            {
+                return XString.EMPTYSTRING;
+            }
         }
         catch (SecurityException se)
         {
@@ -120,14 +127,21 @@
     {
       try
       {
-        result = System.getProperty(fullName);
-
-        if (null == result)
-        {
-
-          // result = System.getenv(fullName);
-          return XString.EMPTYSTRING;
-        }
+          //if secure procession is enabled only handle required properties do not not map any valid system property
+          if(!xctxt.isSecureProcessing())
+          {
+              result = System.getProperty(fullName);
+          }
+          else
+          {
+              warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION,
+                      new Object[]{ fullName });  //"SecurityException when trying to access XSL system property: "+fullName);
+              result = xsltInfo.getProperty(propName);
+          }
+          if (null == result)
+          {
+              return XString.EMPTYSTRING;
+          }
       }
       catch (SecurityException se)
       {