mime/multipart: add field Reader.MaxMIMEHeaderSize

[starius]

Proposal Details

Please provide a way to limit the maximum size of the header when using http.ParseMultipartForm.

Currently package mime/multipart has a hardcoded constant maxMIMEHeaderSize equal to 10 megabytes. This means that an app having multipart HTTP endpoints should allocate at least 10 megabytes of RAM per request, which is quite high. Most headers are much smaller and allowing 10 megabytes for the header is not useful, just exposes an app to memory exhaustion by many parallel slow requests with large MIME headers.

I propose to add a public field MaxMIMEHeaderSize to multipart.Reader.
Methods NextPart() and NextRawPart() should use the value of that field if it is not 0, otherwise they should use the constant.

To use this new field, one would call request.MultipartReader() method in http package, set the field to the desired value (e.g. 1024) and then parse the form using reader.NextPart() method without the risk that multipart headers eat 10 megabytes of RAM.

Fixes #26339

Alternatives considered

There is an alternative proposal #68889 to add maximum size and number of parts in ParseMultipartForm. The proposals don't contradict each other. Request.ParseMultipartFormLimited can use field MaxMIMEHeaderSize of the reader.

[gopherbot]

Change https://go.dev/cl/637915 mentions this issue: mime/multipart: add field Reader.MaxMIMEHeaderSize

[gabyhelp]

Related Issues

• mime/multipart: Allow limiting maximum amount of part's header data #26339
• proposal: net/http: maximum size and number of parts in ParseMultipartForm #68889
• net/http: multipart form parsing is hazardous and difficult to configure #58529

Related Code Changes

• mime/multipart: add field Reader.MaxMIMEHeaderSize
• mime/multipart: limit parsed mime message sizes
• mime/multipart: fix maxMemory param overflow
• [release-branch.go1.19] mime/multipart: limit parsed mime message sizes
• [release-branch.go1.19] mime/multipart: limit parsed mime message sizes

Related Documentation

• Go 1.19 Release Notes > Standard library > Minor changes to the library > mime/multipart
• Go 1.20 Release Notes > Standard library > Minor changes to the library > mime/multipart

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}