Add :max-file-count option to multipart middleware

Author: weavejester

ring-core/src/ring/middleware/multipart_params.clj

@@ -88,15 +88,20 @@
 (def ^:private default-store (delay (tf/temp-file-store)))
 
 (defn- parse-multipart-params
-  [request {:keys [encoding fallback-encoding store] :as options}]
+  [request {:keys [encoding fallback-encoding store max-file-count]
+            :as options}]
   (let [store             (or store @default-store)
         fallback-encoding (or encoding
                               fallback-encoding
                               (req/character-encoding request)
                               "UTF-8")]
     (->> (request-context request fallback-encoding)
          (file-item-seq (file-upload request options))
-         (map #(parse-file-item % store))
+         (map-indexed (fn [i item]
+                        (if (and max-file-count (>= i max-file-count))
+                          (throw (ex-info "Max file count exceeded"
+                                          {:max-file-count max-file-count}))
+                          (parse-file-item item store))))
          (build-param-map encoding fallback-encoding))))
 
 (defn multipart-params-request
@@ -145,7 +150,10 @@
                        bytes-read, content-length, and item-count.
 
   :max-file-size     - the maximum size allowed size of a file in bytes. If
-                       nil or omitted, there is no limit."
+                       nil or omitted, there is no limit.
+
+  :max-file-count    - the maximum number of files allowed in a single request.
+                       If nil or omitted, there is no limit."
   ([handler]
    (wrap-multipart-params handler {}))
   ([handler options]

ring-core/test/ring/middleware/test/multipart_params.clj

@@ -182,9 +182,18 @@
                        "name=\"upload\"; filename=\"test1.txt\"\r\n"
                        "Content-Type: text/plain\r\n\r\n"
                        "foobarbaz\r\n"
+                       "--XXXX\r\n"
+                       "Content-Disposition: form-data;"
+                       "name=\"upload\"; filename=\"test2.txt\"\r\n"
+                       "Content-Type: text/plain\r\n\r\n"
+                       "foobar\r\n"
                        "--XXXX--")
-        request {:headers {"content-type"
-                           (str "multipart/form-data; boundary=XXXX")}
-                 :body (string-input-stream form-body)}]
+        headers {"content-type" (str "multipart/form-data; boundary=XXXX")}]
     (is (thrown? org.apache.commons.fileupload.FileUploadBase$FileUploadIOException
-                 (multipart-params-request request {:max-file-size 6})))))
+                 (multipart-params-request
+                  {:headers headers, :body (string-input-stream form-body)}
+                  {:max-file-size 6})))
+    (is (thrown? clojure.lang.ExceptionInfo
+                 (multipart-params-request
+                  {:headers headers, :body (string-input-stream form-body)}
+                  {:max-file-count 1})))))