Put a resource budget around untrusted data
Your objectiveDistinguish transfer limits from decoded-document limits.
Understand the idea.
A parser consumes resources before you decide whether the content is useful. Limit both incoming bytes and the decoded document. Compression means those quantities can differ substantially. Dangerous XML behavior also needs a separate restriction; a small file is not automatically safe. A bounded parser is a processing control, not a verdict on the truth of an article.
A worked example.
A response is 200 kilobytes on the wire but expands beyond the collector’s eight-megabyte document budget. Refusing it protects the configured budget. Increasing every source’s limit to an unlimited value would remove that protection rather than explain this exceptional case.
Try the reasoning.
List three distinct outcomes: oversized transfer, oversized decoded document and forbidden XML entity. Write the operator action you would attach to each without weakening the general policy.
Carry it into practice.
Keep refused documents out of article storage and record a specific error category.
Read the reference: Python · XML security ↗