@Override
    public void startElement(String uri, String localName, String name, Attributes atts)
            throws SAXException {
        currentDepth++;
        if (currentDepth >= maxDepth) {
            throw new SecureSAXException(
                    "Suspected zip bomb: " + currentDepth + " levels of XML element nesting");
        }

        if ("div".equals(name) && "package-entry".equals(atts.getValue("class"))) {
            packageEntryDepths.addLast(currentDepth);
            if (packageEntryDepths.size() >= maxPackageEntryDepth) {
                throw new SecureSAXException("Suspected zip bomb: " + packageEntryDepths.size() +
                        " levels of package entry nesting");
            }
        }

        super.startElement(uri, localName, name, atts);
    }
Records the given number of output characters (or more accurately
UTF-16 code units). Throws an exception if the recorded number of
characters highly exceeds the number of input bytes read.

@param length number of new output characters produced
@throws SAXException if a zip bomb is detected
tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java