## Filter Data - Security

To ensure that you don't return more data than you should, read the docs for [Tutorial - Response Model - Return Type](../tutorial/response-model.md){.internal-link target=_blank}.

## Documentation Tags - OpenAPI

  private val countingSource: CountingSource = CountingSource(source)
  private val source: BufferedSource = countingSource.buffer()

  /** Total bytes read thus far. */
  private val byteCount: Long
    get() = countingSource.bytesRead - source.buffer.size

  /** How many bytes to read before [peekHeader] should return false, or -1L for no limit. */
  private var limit = -1L

        }

        // Fill the receive buffer without holding any locks.
        val read = source.read(receiveBuffer, remainingByteCount)
        if (read == -1L) throw EOFException()
        remainingByteCount -= read

        // Move the received data to the read buffer to the reader can read it. If this source has
        // been closed since this read began we must discard the incoming data and tell the
        // connection we've done so.

 *
 * Every [edit] call must be matched by a call to [Editor.commit] or [Editor.abort]. Committing is
 * atomic: a read observes the full set of values as they were before or after the commit, but never
 * a mix of values.
 *
 * Clients call [get] to read a snapshot of an entry. The read will observe the value at the time
 * that [get] was called. Updates and removals after the call do not impact ongoing reads.
 *

    /** The next byte to read. This is always less than or equal to [upstreamPos]. */
    private var sourcePos = 0L

    /**
     * Selects where to find the bytes for a read and read them. This is one of three sources.
     *
     * ## Upstream
     *
     * In this case the current thread is assigned as the upstream reader. We read bytes from

    val b1 = source.readByte() and 0xff

    val isMasked = b1 and B1_FLAG_MASK != 0
    if (isMasked == isClient) {
      // Masked payloads must be read on the server. Unmasked payloads must be read on the client.
      throw ProtocolException(
        if (isClient) {
          "Server-sent frames must not be masked."
        } else {
          "Client-sent frames must be masked."

    val body = body("")
    val bytes = body.byteStream()
    assertThat(bytes.read()).isEqualTo(-1)
  }

  @Test
  fun byteStreamSeesBom() {
    val body = body("efbbbf68656c6c6f")
    val bytes = body.byteStream()
    assertThat(bytes.read()).isEqualTo(0xef)
    assertThat(bytes.read()).isEqualTo(0xbb)
    assertThat(bytes.read()).isEqualTo(0xbf)

  private var outputByteCount = 0L

  fun wrapInput(source: Source): Source {
    return object : ForwardingSource(source) {
      override fun read(
        sink: Buffer,
        byteCount: Long,
      ): Long {
        val result = super.read(sink, byteCount)
        if (result == -1L) return result
        inputByteCount += result
        return result
      }
    }
  }

    val derReader = DerReader(buffer)

    derReader.read("test") { header ->
      assertThat(header.tag).isEqualTo(16L)

      derReader.read("test") { header2 ->
        assertThat(header2.tag).isEqualTo(21L)
        assertThat(derReader.readOctetString()).isEqualTo("Smith".encodeUtf8())
      }

      derReader.read("test") { header3 ->
        assertThat(header3.tag).isEqualTo(1L)

It would also mean that if you get data from the `Request` object directly (for example, read the body) it won't be validated, converted or documented (with OpenAPI, for the automatic API user interface) by FastAPI.