Handle Rack errors when too many files are uploaded

CHANGELOG.md

@@ -1,4 +1,4 @@
-### 1.6.3 (Next)
+### 1.7.0 (Next)
 
 #### Features
 
@@ -18,6 +18,7 @@
 * [#2227](https://github.com/ruby-grape/grape/pull/2222): Rename `MissingGroupType` and `UnsupportedGroupType` exceptions - [@ericproulx](https://github.com/ericproulx).
 * [#2244](https://github.com/ruby-grape/grape/pull/2244): Fix a breaking change in `Grape::Validations` provided in 1.6.1 - [@dm1try](https://github.com/dm1try).
 * [#2250](https://github.com/ruby-grape/grape/pull/2250): Add deprecation warning for `UnsupportedGroupTypeError` and `MissingGroupTypeError` - [@ericproulx](https://github.com/ericproulx).
+* [#2256](https://github.com/ruby-grape/grape/pull/2256): Raise `Grape::Exceptions::MultipartPartLimitError` from Rack when too many files are uploaded - [@bschmeck](https://github.com/bschmeck).
 * Your contribution here.
 
 ### 1.6.2 (2021/12/30)

README.md

@@ -158,7 +158,7 @@ content negotiation, versioning and much more.
 
 ## Stable Release
 
-You're reading the documentation for the next release of Grape, which should be **1.6.3**.
+You're reading the documentation for the next release of Grape, which should be **1.7.0**.
 Please read [UPGRADING](UPGRADING.md) when upgrading from a previous version.
 The current stable release is [1.6.2](https://github.com/ruby-grape/grape/blob/v1.6.2/README.md).
 

UPGRADING.md

@@ -1,7 +1,7 @@
 Upgrading Grape
 ===============
 
-### Upgrading to >= 1.6.3
+### Upgrading to >= 1.7.0
 
 #### Exceptions renaming
 
@@ -12,6 +12,10 @@ The following exceptions has been renamed for consistency through exceptions nam
 
 See [#2227](https://github.com/ruby-grape/grape/pull/2227) for more information.
 
+#### Handling Multipart Limit Errors
+
+Rack supports a configurable limit on the number of files created from multipart parameters (`Rack::Utils.multipart_part_limit`) and raises an error if params are received that create too many files. If you were handling the Rack error directly, Grape now wraps that error in `Grape::Execeptions::TooManyMultipartFiles`. Additionally, Grape will return a 413 status code if the exception goes unhandled.
+
 ### Upgrading to >= 1.6.0
 
 #### Parameter renaming with :as

lib/grape.rb

@@ -81,6 +81,7 @@ module Exceptions
  autoload :MethodNotAllowed
  autoload :InvalidResponse
  autoload :EmptyMessageBody
+ autoload :TooManyMultipartFiles
  autoload :MissingGroupTypeError, 'grape/exceptions/missing_group_type'
  autoload :UnsupportedGroupTypeError, 'grape/exceptions/unsupported_group_type'
  end

lib/grape/exceptions/too_many_multipart_files.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Grape
+ module Exceptions
+ class TooManyMultipartFiles < Base
+ def initialize(limit)
+ super(message: compose_message(:too_many_multipart_files, limit: limit), status: 413)
+ end
+ end
+ end
+end

lib/grape/locale/en.yml

@@ -45,6 +45,7 @@ en:
  %{body_format} in the request's 'body'
  "
  empty_message_body: 'Empty message body supplied with %{body_format} content-type'
+ too_many_multipart_files: "The number of uploaded files exceeded the system's configured limit (%{limit})"
  invalid_accept_header:
  problem: 'Invalid accept header'
  resolution: '%{message}'

lib/grape/request.rb

@@ -17,6 +17,8 @@ def params
  @params ||= build_params
  rescue EOFError
  raise Grape::Exceptions::EmptyMessageBody.new(content_type)
+ rescue Rack::Multipart::MultipartPartLimitError
+ raise Grape::Exceptions::TooManyMultipartFiles.new(Rack::Utils.multipart_part_limit)
  end
 
  def headers

lib/grape/version.rb

@@ -2,5 +2,5 @@
 
 module Grape
  # The current version of Grape.
- VERSION = '1.6.3'
+ VERSION = '1.7.0'
 end

spec/grape/endpoint_spec.rb

@@ -436,6 +436,27 @@ def app
  end
  end
 
+ context 'when the limit on multipart files is exceeded' do
+ around do |example|
+ limit = Rack::Utils.multipart_part_limit
+ Rack::Utils.multipart_part_limit = 1
+ example.run
+ Rack::Utils.multipart_part_limit = limit
+ end
+
+ it 'returns a 413 if given too many multipart files' do
+ subject.params do
+ requires :file, type: Rack::Multipart::UploadedFile
+ end
+ subject.post '/upload' do
+ params[:file][:filename]
+ end
+ post '/upload', { file: Rack::Test::UploadedFile.new(__FILE__, 'text/plain'), extra: Rack::Test::UploadedFile.new(__FILE__, 'text/plain') }
+ expect(last_response.status).to eq(413)
+ expect(last_response.body).to eq("The number of uploaded files exceeded the system's configured limit (1)")
+ end
+ end
+
  it 'responds with a 415 for an unsupported content-type' do
  subject.format :json
  # subject.content_type :json, "application/json"