How to use

LimitingInputStream

in

org.apache.xml.security.stax.impl.util

@Override
public int read() throws IOException {
  int r = super.read();
  if (r >= 0) {
    incrementCountAndTestLimit(r);
  }
  return r;
}

@Override
public int read(byte[] b) throws IOException {
  return read(b, 0, b.length);
}

@Override
protected InputStream applyTransforms(ReferenceType referenceType, InputStream inputStream) throws XMLSecurityException {
  if (referenceType != null) {
    TransformsType transformsType =
        XMLSecurityUtils.getQNameType(referenceType.getAny(), XMLSecurityConstants.TAG_dsig_Transforms);
    if (transformsType != null) {
      List<TransformType> transformTypes = transformsType.getTransform();
      //to do don't forget to limit the count of transformations if more transformations will be supported!
      if (transformTypes.size() > 1) {
        throw new XMLSecurityException("stax.encryption.Transforms.NotYetImplemented");
      }
      TransformType transformType = transformTypes.get(0);
      @SuppressWarnings("unchecked")
      Class<InputStream> transformerClass =
          (Class<InputStream>) TransformerAlgorithmMapper.getTransformerClass(
              transformType.getAlgorithm(), XMLSecurityConstants.DIRECTION.IN);
      try {
        Constructor<InputStream> constructor = transformerClass.getConstructor(InputStream.class);
        inputStream = new LimitingInputStream(
            constructor.newInstance(inputStream), MAX_ALLOWED_DECOMPRESSED_BYTES);
      } catch (InvocationTargetException | NoSuchMethodException
        | InstantiationException | IllegalAccessException e) {
        throw new XMLSecurityException(e);
      }
    }
  }
  return inputStream;
}

@Override
public int read(byte[] b, int off, int len) throws IOException {
  int r = super.read(b, off, len);
  if (r >= 0) {
    incrementCountAndTestLimit(r);
  }
  return r;
}