fix: enforce parts limit after exceeding it

lib/make-middleware.js

@@ -13,13 +13,25 @@ function drainStream (stream) {
   })
 }
 
+function busboyLimits (limits) {
+  if (!limits || !Object.prototype.hasOwnProperty.call(limits, 'parts')) {
+    return limits
+  }
+
+  var result = { ...limits }
+  delete result.parts
+  return result
+}
+
 function makeMiddleware (setup) {
   return function multerMiddleware (req, res, next) {
     if (!is(req, ['multipart'])) return next()
 
     var options = setup()
 
     var limits = options.limits
+    var parts = 0
+    var partsLimit = limits && limits.parts
     var storage = options.storage
     var fileFilter = options.fileFilter
     var fileStrategy = options.fileStrategy
@@ -107,6 +119,17 @@ function makeMiddleware (setup) {
       abortWithError(new MulterError(code, optionalField))
     }
 
+    function incrementPartCount () {
+      if (typeof partsLimit !== 'number' || !isFinite(partsLimit)) return false
+
+      parts += 1
+
+      if (parts <= partsLimit) return false
+
+      abortWithCode('LIMIT_PART_COUNT')
+      return true
+    }
+
     function handleRequestFailure (err) {
       if (isDone) return
       if (busboy) {
@@ -132,7 +155,7 @@ function makeMiddleware (setup) {
     try {
       busboy = Busboy({
         headers: req.headers,
-        limits: limits,
+        limits: busboyLimits(limits),
         preservePath: preservePath,
         defParamCharset: defParamCharset
       })
@@ -144,6 +167,8 @@ function makeMiddleware (setup) {
 
     // handle text field data
     busboy.on('field', function (fieldname, value, { nameTruncated, valueTruncated }) {
+      if (incrementPartCount()) return
+
       if (fieldname == null) return abortWithCode('MISSING_FIELD_NAME')
       if (nameTruncated) return abortWithCode('LIMIT_FIELD_KEY')
       if (valueTruncated) return abortWithCode('LIMIT_FIELD_VALUE', fieldname)
@@ -171,6 +196,8 @@ function makeMiddleware (setup) {
         abortWithError(err)
       })
 
+      if (incrementPartCount()) return
+
       if (fieldname == null) return abortWithCode('MISSING_FIELD_NAME')
 
       // don't attach to the files object, if there is no file

test/error-handling.js

@@ -66,6 +66,23 @@ describe('Error Handling', function () {
     })
   })
 
+  it('should allow parts up to the limit', function (done) {
+    var form = new FormData()
+    var parser = withLimits({ parts: 2 }, [
+      { name: 'tiny0', maxCount: 1 }
+    ])
+
+    form.append('field0', 'value')
+    form.append('tiny0', util.file('tiny0.dat'))
+
+    util.submitForm(parser, form, function (err, req) {
+      assert.ifError(err)
+      assert.strictEqual(req.body.field0, 'value')
+      assert.strictEqual(req.files.tiny0[0].fieldname, 'tiny0')
+      done()
+    })
+  })
+
   it('should respect file count limit', function (done) {
     var form = new FormData()
     var parser = withLimits({ files: 1 }, [