The 7u45 and JDK 8 releases introduced three limits:
The JDK 8u11 release added one additional property:
Together with the three previously defined properties, there are seven limits. While the original properties were only changeable through system properties, all seven properties can now be changed in three ways: using API properties, system properties, or the jaxp.properties file.
Name: http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit
Definition: Limit the number of entity expansions.
Value: A positive integer. 0 is treated as no limit. Negative numbers are treated as 0.
Default value: 64,000. This is the current limit.
System property: jdk.xml.entityExpansionLimit. The previous entityExpansionLimit property was renamed to jdk.xml.entityExpansionLimit. For backward compatibility, the previous name is still supported, but it is recommended that you use the new name since it is more consistent with the other JAXP properties.
Name: http://www.oracle.com/xml/jaxp/properties/elementAttributeLimit
Definition: Limit the number of attributes an element can have.
Value: A positive integer. 0 is treated as no limit. Negative numbers are treated as 0.
Default value: 10,000
System property: jdk.xml.elementAttributeLimit. The prevous elementAttributeLimit property was renamed to jdk.xml.elementAttributeLimit. For backward compatibility, the previous name is supported, but it is recommended that you use the new name since it is more consistent with the other JAXP properties.
Name: http://www.oracle.com/xml/jaxp/properties/maxOccurLimit
Definition: Limit the number of content model nodes that may be created when building a grammar for a W3C XML Schema that contains maxOccurs attributes with values other than "unbounded".
Value: A positive integer. 0 is treated as no limit. Negative numbers are treated as 0.
Default value: 5000
System property: jdk.xml.maxOccurLimit. The previous maxOccurLimit property was renamed to jdk.xml.maxOccurLimit. For backward compatibility, the previous name is supported, but it is recommended that you use the new name since it is more consistent with the other JAXP properties.
Name: http://www.oracle.com/xml/jaxp/properties/totalEntitySizeLimit
Definition: Limit the total size of all entities that include general and parameter entities. The size is calculated as an aggregation of all entities.
Value: A positive integer. 0 is treated as no limit. Negative numbers are treated as 0.
Default value: 5x10^7
System property: jdk.xml.totalEntitySizeLimit
Name: http://www.oracle.com/xml/jaxp/properties/maxGeneralEntitySizeLimit
Definition: Limit the maximum size of any general entities. It is recommended that users set the limit to the smallest possible number so that malformed xml files can be caught quickly.
Value: A positive integer. 0 is treated as no limit. Negative numbers are treated as 0.
Default value: 0, no limit.
System property: jdk.xml.maxGeneralEntitySizeLimit
Name: http://www.oracle.com/xml/jaxp/properties/maxParameterEntitySizeLimit
Definition: Limit the maximum size of any parameter entities, including the result of nesting multiple parameter entities. It is recommended that users set the limit to the smallest possible number so that malformed xml files can be caught quickly.
Value: A positive integer. 0 is treated as no limit. Negative numbers are treated as 0.
Default value: 0, no limit.
System property: jdk.xml.maxParameterEntitySizeLimit
Name: http://java.sun.com/xml/jaxp/properties/maxElementDepth
Definition: Limit the maximum element depth
Value: A positive integer. 0 is treated as no limit. Negative numbers are treated as 0.
Default value: 0
System property: jdk.xml.maxElementDepth
The system properties can be specified in the jaxp.properties file to define the behavior for all invocations of the JDK or JRE. The format is system-property-name=value. For example:
jdk.xml.maxGeneralEntitySizeLimit=1024