fix(uploads): leave an already-consumed multipart body as a server error

Author: waleedlatif1

apps/sim/lib/core/utils/stream-limits.test.ts

@@ -319,6 +319,30 @@ describe('stream limits', () => {
     ).rejects.toBeInstanceOf(MultipartFieldValidationError)
   })
 
+  it('leaves a body that was already read to fail as a server error', async () => {
+    const input = new FormData()
+    input.append('name', 'example')
+    const encoded = new Request('http://localhost/upload', { method: 'POST', body: input })
+    const bytes = new Uint8Array(await encoded.arrayBuffer())
+    const request = new Request('http://localhost/upload', {
+      method: 'POST',
+      headers: {
+        'content-type': encoded.headers.get('content-type') ?? '',
+        'content-length': String(bytes.byteLength),
+      },
+      body: bytes,
+    })
+    await request.text()
+
+    const failure = await readFormDataWithLimit(request, {
+      maxBytes: 1024 * 1024,
+      label: 'multipart body',
+    }).catch((error: unknown) => error)
+
+    expect(failure).toBeInstanceOf(TypeError)
+    expect(failure).not.toBeInstanceOf(MultipartFieldValidationError)
+  })
+
   it('rejects multipart streams without content-length once bytes exceed the limit', async () => {
     const request = new Request('http://localhost/upload', {
       method: 'POST',

apps/sim/lib/core/utils/stream-limits.ts

@@ -69,6 +69,7 @@ export interface ReadFormDataWithLimitRequest {
   method: string
   headers?: Headers
   body?: ReadableStream<Uint8Array> | null
+  bodyUsed?: boolean
   formData: () => Promise<FormData>
 }
 
@@ -158,9 +159,14 @@ export async function readFormDataWithLimit(
  * The fetch body parser rejects a body that does not decode as the content type it
  * declares (a JSON body, a boundary the body never uses) with a bare `TypeError`. That
  * is the caller's malformed input, so it surfaces as the same validation failure every
- * multipart route already answers with a 400.
+ * multipart route already answers with a 400. So does a declared-length body that ends
+ * early, since the client sent an incomplete request. A body some earlier code already
+ * consumed is a server bug, so that failure is left to surface as it is.
  */
-async function parseFormData(request: Pick<Request, 'formData'>): Promise<FormData> {
+async function parseFormData(
+  request: Pick<ReadFormDataWithLimitRequest, 'formData' | 'bodyUsed'>
+): Promise<FormData> {
+  if (request.bodyUsed) return request.formData()
   try {
     return await request.formData()
   } catch (error) {