Saxon

(Email sent to support@saxonica.com)

The user reports that a schema document contains a DTD reference:

<!DOCTYPE schema
        PUBLIC "-//W3C//DTD XMLSchema 200102//EN" "http://www.w3.org/2001/XMLSchema.dtd"
        [
                <!ATTLIST schema
                        xmlns:ds CDATA #FIXED "http://www.w3.org/2000/09/xmldsig#">
                <!ENTITY dsig 'http://www.w3.org/2000/09/xmldsig#'>
                <!ENTITY % p ''>
                <!ENTITY % s ''>
                ]>

and the DTD is being fetched from the W3C server rather from our local cache. This is SaxonJ-EE-11.

The schema is being loaded using

Processor processor = processorFactory.newInstance();
SchemaManager manager = processor.getSchemaManager();
manager.setErrorReporter((e) -> errReporter.report(e));
manager.setSchemaURIResolver(sur);
manager.setXsdVersion(xsdVersion);
manager.load(xsdSource);

where sur is an instance of the standard schema resolver.