So validate the stream first, then apply your exclusion logic afterward (until you validate, you wouldn't have any way of knowing if you're excluding the right things, because you wouldn't yet know if you're even working with UTF-8).