The File, Path, and InputStream parsing APIs currently read their input without a size limit, including data decompressed automatically from gzip files.
The existing unlimited default should remain because these APIs are expected to parse a caller-selected document completely, and applying the HTTP 2 MB default would change existing behavior for larger files.
Callers should have a straightforward way to limit input when parsing untrusted or compressed content.
Add an opt-in parser input size limit, likely configured on Parser to avoid multiplying the existing Jsoup.parse overloads.
The limit should apply to decoded parser input after decompression and use 0 to mean unlimited.
When a limit is reached, the parser should expose whether its input was truncated, for example through Parser.isInputTruncated(), so a partial DOM cannot be mistaken for a complete parse.
Connection.Response should similarly expose whether maxBodySize truncated the response and communicate that state to the parser when the response is parsed.
The controls and truncation state should work consistently across regular, connection, and streaming parser entry points.
The
File,Path, andInputStreamparsing APIs currently read their input without a size limit, including data decompressed automatically from gzip files.The existing unlimited default should remain because these APIs are expected to parse a caller-selected document completely, and applying the HTTP 2 MB default would change existing behavior for larger files.
Callers should have a straightforward way to limit input when parsing untrusted or compressed content.
Add an opt-in parser input size limit, likely configured on
Parserto avoid multiplying the existingJsoup.parseoverloads.The limit should apply to decoded parser input after decompression and use
0to mean unlimited.When a limit is reached, the parser should expose whether its input was truncated, for example through
Parser.isInputTruncated(), so a partial DOM cannot be mistaken for a complete parse.Connection.Responseshould similarly expose whethermaxBodySizetruncated the response and communicate that state to the parser when the response is parsed.The controls and truncation state should work consistently across regular, connection, and streaming parser entry points.