Proposal Details

Please provide a way to limit the maximum size and number of parts when using http.ParseMultipartForm.

http.ParseMultipartForm is handy when the application knows that the files being uploaded are small; in that case, one does not need to go through the hassle of http.MultipartReader. However, there appears to be no way to cause http.ParseMultipartForm to reject the upload if the parts are larger than a given size (say, a megabyte), and no way to reject posts with more than a given number of parts (say, 10).

I propose the addition of the following function (name to be reconsidered):

func (r *Request) ParseMultipartFormLimited(maxMemory int64, maxPartSize int64, maxParts int) error

This is just like ParseMultipartForm, except that:

• if maxPartSize is strictly larger than 0, then any of the parts is larger than maxPartSize bytes, the function returns http.ErrMessageTooLarge;
• if maxParts is strictly larger than 0, then if there are more than maxParts parts the function returns http.ErrMessageTooLarge.

If the function returns http.ErrMesageTooLarge, then the body of the request has been closed.