Warning: org.apache.xerces.parsers.SAXParser: Feature 'http://javax.xml.XMLConstants/feature/secure-processing' is not recognized

We often see in the logs

Warning: org.apache.xerces.parsers.SAXParser: Feature 'http://javax.xml.XMLConstants/feature/secure-processing' is not recognized.
Warning: org.apache.xerces.parsers.SAXParser: Property http://javax.xml.XMLConstants/property/accessExternalDTD' is not recognized.
Warning org.apache.xerces.parsers.SAXParser: Property 'http://www.oracle.com/xml/jaxp/properties/entityExpansionLimit' is not recognized


See https://access.redhat.com/solutions/1124603 and https://issues.apache.org/jira/browse/XERCESJ-1654

see also Oracle Support:

Warning: org.apache.xerces.parsers.SAXParser After Upgrade to JDK 1.6.0_75 or Higher (Doc ID 1951255.1)

These messages are "logged" by com.sun.org.apache.xml.internal.utils.XMLReaderManager

public synchronized XMLReader getXMLReader()
    throws SAXException
  {
    if (this.m_readers == null) {
      this.m_readers = new ThreadLocal();
    }
    if (this.m_inUse == null) {
      this.m_inUse = new HashMap();
    }
    XMLReader reader = (XMLReader)this.m_readers.get();
    boolean threadHasReader = reader != null;
    String factory = SecuritySupport.getSystemProperty("org.xml.sax.driver");
    if ((threadHasReader) && (this.m_inUse.get(reader) != Boolean.TRUE) && ((factory == null) || (reader.getClass().getName().equals(factory))))
    {
      this.m_inUse.put(reader, Boolean.TRUE);
    }
    else
    {
      try
      {
        try
        {
          reader = XMLReaderFactory.createXMLReader();
          try
          {
            reader.setFeature("http://javax.xml.XMLConstants/feature/secure-processing", this._secureProcessing);
          }
          catch (SAXNotRecognizedException e)
          {
            System.err.println("Warning:  " + reader.getClass().getName() + ": " + e.getMessage());
          }
        }
        catch (Exception e)

so even if you add a Log Filter in WebLogic you won't prevent them from appearing in the stdout/stderr