Currently "maxDocumentLength" limit is not applied for DataInput backed parser (unlike streaming and non-blocking) because check cannot be implemented efficiently, due to input being read byte-by-byte, instead of in blocks (where checks can be applied only at boundary).
Since max-doc-length is "unset" (set as -1), i.e. not applied, user setting limit indicates expectation of limit.
We should explicitly fail parsing attempt in such case.
Note: addresses GHSA-2m67-wjpj-xhg9
Currently "maxDocumentLength" limit is not applied for
DataInputbacked parser (unlike streaming and non-blocking) because check cannot be implemented efficiently, due to input being read byte-by-byte, instead of in blocks (where checks can be applied only at boundary).Since max-doc-length is "unset" (set as
-1), i.e. not applied, user setting limit indicates expectation of limit.We should explicitly fail parsing attempt in such case.
Note: addresses GHSA-2m67-wjpj-xhg9