diff -r e044bd1da6b8 -r a14efa699f0f src/share/jaxws_classes/com/sun/xml/internal/bind/v2/model/impl/RuntimeBuiltinLeafInfoImpl.java
--- a/src/share/jaxws_classes/com/sun/xml/internal/bind/v2/model/impl/RuntimeBuiltinLeafInfoImpl.java	Mon Oct 20 23:05:00 2014 -0700
+++ b/src/share/jaxws_classes/com/sun/xml/internal/bind/v2/model/impl/RuntimeBuiltinLeafInfoImpl.java	Fri Oct 24 15:02:28 2014 +0200
@@ -43,6 +43,8 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Collections;
@@ -197,7 +199,15 @@
 
     static {
 
-        QName[] qnames = (System.getProperty(MAP_ANYURI_TO_URI) == null) ? new QName[] {
+        String MAP_ANYURI_TO_URI_VALUE = AccessController.doPrivileged(
+                new PrivilegedAction<String>() {
+                    @Override
+                    public String run() {
+                        return System.getProperty(MAP_ANYURI_TO_URI);
+                    }
+                }
+        );
+        QName[] qnames = (MAP_ANYURI_TO_URI_VALUE == null) ? new QName[] {
                                 createXS("string"),
                                 createXS("anySimpleType"),
                                 createXS("normalizedString"),
@@ -310,7 +320,7 @@
                     return v.toExternalForm();
                 }
             });
-        if (System.getProperty(MAP_ANYURI_TO_URI) == null) {
+        if (MAP_ANYURI_TO_URI_VALUE == null) {
             secondaryList.add(
                 new StringImpl<URI>(URI.class, createXS("string")) {
                     public URI parse(CharSequence text) throws SAXException {
@@ -774,17 +784,18 @@
                 }
             });
         primaryList.add(
-            new StringImpl<BigDecimal>(BigDecimal.class,
-                createXS("decimal")
+                new StringImpl<BigDecimal>(BigDecimal.class,
+                        createXS("decimal")
                 ) {
-                public BigDecimal parse(CharSequence text) {
-                    return DatatypeConverterImpl._parseDecimal(text.toString());
+                    public BigDecimal parse(CharSequence text) {
+                        return DatatypeConverterImpl._parseDecimal(text.toString());
+                    }
+
+                    public String print(BigDecimal v) {
+                        return DatatypeConverterImpl._printDecimal(v);
+                    }
                 }
-
-                public String print(BigDecimal v) {
-                    return DatatypeConverterImpl._printDecimal(v);
-                }
-            });
+        );
         primaryList.add(
             new StringImpl<QName>(QName.class,
                 createXS("QName")
@@ -812,7 +823,7 @@
                     w.getNamespaceContext().declareNamespace(v.getNamespaceURI(),v.getPrefix(),false);
                 }
             });
-        if (System.getProperty(MAP_ANYURI_TO_URI) != null) {
+        if (MAP_ANYURI_TO_URI_VALUE != null) {
             primaryList.add(
                 new StringImpl<URI>(URI.class, createXS("anyURI")) {
                     public URI parse(CharSequence text) throws SAXException {
@@ -830,16 +841,17 @@
                 });
         }
         primaryList.add(
-            new StringImpl<Duration>(Duration.class,  createXS("duration")) {
-                public String print(Duration duration) {
-                    return duration.toString();
+                new StringImpl<Duration>(Duration.class, createXS("duration")) {
+                    public String print(Duration duration) {
+                        return duration.toString();
+                    }
+
+                    public Duration parse(CharSequence lexical) {
+                        TODO.checkSpec("JSR222 Issue #42");
+                        return DatatypeConverterImpl.getDatatypeFactory().newDuration(lexical.toString());
+                    }
                 }
-
-                public Duration parse(CharSequence lexical) {
-                    TODO.checkSpec("JSR222 Issue #42");
-                    return DatatypeConverterImpl.getDatatypeFactory().newDuration(lexical.toString());
-                }
-            });
+        );
         primaryList.add(
             new StringImpl<Void>(Void.class) {
                 // 'void' binding isn't defined by the spec, but when the JAX-RPC processes user-defined