ESAPI.validator().getValidInput("HTTP header value (" + name + "): " + value, value, "HTTPHeaderValue", 150, true);

if found length limit 150 in SecurityWrapperRequest.java getHeader method,but it throws a exception when is use it to get user-agent for ie8, it's 162 chractors,