Trim tokens in error messages to 256 byte to prevent attacks

Author: asoldano

src/main/java/com/fasterxml/jackson/core/json/UTF8StreamJsonParser.java

@@ -3510,7 +3510,8 @@ protected void _reportInvalidToken(String matchedPart, String msg) throws IOExce
           * regular Java identifier character rules. It's just a heuristic,
           * nothing fancy here (nor fast).
           */
-         while (true) {
+         final int maxTokenLength = 256;
+         while (sb.length() < maxTokenLength) {
              if (_inputPtr >= _inputEnd && !_loadMore()) {
                  break;
              }
@@ -3521,6 +3522,9 @@ protected void _reportInvalidToken(String matchedPart, String msg) throws IOExce
              }
              sb.append(c);
          }
+         if (sb.length() == maxTokenLength) {
+                sb.append("...");
+         }
          _reportError("Unrecognized token '"+sb.toString()+"': was expecting "+msg);
      }