feat: Optional max_file_size for parsing form files

docs/requests.md

@@ -122,6 +122,13 @@ async with request.form(max_files=1000, max_fields=1000, max_part_size=1024*1024
     ...
 ```
 
+You can configure maximum [spooled file](https://docs.python.org/3/library/tempfile.html#tempfile.SpooledTemporaryFile) size per file uploaded with the parameter `max_file_size`:
+
+```python
+async with request.form(max_spool_size=100*1024*1024):  # 100 MB limit per file
+    ...
+```
+
 !!! info
     These limits are for security reasons, allowing an unlimited number of fields or files could lead to a denial of service attack by consuming a lot of CPU and memory parsing too many empty fields.
 

starlette/formparsers.py

@@ -135,6 +135,7 @@ def __init__(
         max_files: int | float = 1000,
         max_fields: int | float = 1000,
         max_part_size: int = 1024 * 1024,  # 1MB
+        max_spool_size: int = 1024 * 1024,  # 1MB
     ) -> None:
         assert multipart is not None, "The `python-multipart` library must be installed to use form parsing."
         self.headers = headers
@@ -152,6 +153,7 @@ def __init__(
         self._file_parts_to_finish: list[MultipartPart] = []
         self._files_to_close_on_error: list[SpooledTemporaryFile[bytes]] = []
         self.max_part_size = max_part_size
+        self.spool_max_size = max_spool_size
 
     def on_part_begin(self) -> None:
         self._current_part = MultipartPart()

starlette/requests.py

@@ -255,6 +255,7 @@ async def _get_form(
         max_files: int | float = 1000,
         max_fields: int | float = 1000,
         max_part_size: int = 1024 * 1024,
+        max_spool_size: int = 1024 * 1024,
     ) -> FormData:
         if self._form is None:  # pragma: no branch
             assert parse_options_header is not None, (
@@ -271,6 +272,7 @@ async def _get_form(
                         max_files=max_files,
                         max_fields=max_fields,
                         max_part_size=max_part_size,
+                        max_spool_size=max_spool_size,
                     )
                     self._form = await multipart_parser.parse()
                 except MultiPartException as exc:
@@ -290,9 +292,15 @@ def form(
         max_files: int | float = 1000,
         max_fields: int | float = 1000,
         max_part_size: int = 1024 * 1024,
+        max_spool_size: int = 1024 * 1024,
     ) -> AwaitableOrContextManager[FormData]:
         return AwaitableOrContextManagerWrapper(
-            self._get_form(max_files=max_files, max_fields=max_fields, max_part_size=max_part_size)
+            self._get_form(
+                max_files=max_files,
+                max_fields=max_fields,
+                max_part_size=max_part_size,
+                max_spool_size=max_spool_size,
+            )
         )
 
     async def close(self) -> None: