Add parameter to control maximum number of file uploads per request

Author: clue

README.md

@@ -796,6 +796,18 @@ constructor like this:
 new RequestBodyParserMiddleware(8 * 1024 * 1024); // 8 MiB limit per file
 ```
 
+By default, this middleware respects the
+[`max_file_uploads`](http://php.net/manual/en/ini.core.php#ini.max-file-uploads)
+(default `20`) ini setting.
+If you upload more files in a single request, additional files will be ignored
+and the `getUploadedFiles()` method returns a truncated array. 
+You can control the maximum number of file uploads per request by explicitly
+passing the second parameter to the constructor like this:
+
+```php
+new RequestBodyParserMiddleware(10 * 1024, 100); // 100 files with 10 KiB each
+```
+
 > Note that this middleware handler simply parses everything that is already
   buffered in the request body.
   It is imperative that the request body is buffered by a prior middleware

examples/12-upload.php

@@ -122,7 +122,7 @@
 // buffer and parse HTTP request body before running our request handler
 $server = new StreamingServer(new MiddlewareRunner(array(
     new RequestBodyBufferMiddleware(8 * 1024 * 1024), // 8 MiB max, ignore body otherwise
-    new RequestBodyParserMiddleware(100 * 1024), // 100 KiB max, reject upload otherwise
+    new RequestBodyParserMiddleware(100 * 1024, 1), // 1 file with 100 KiB max, reject upload otherwise
     $handler
 )));
 

src/Io/MultipartParser.php

@@ -54,12 +54,21 @@ final class MultipartParser
      */
     private $uploadMaxFilesize;
 
+    /**
+     * ini setting "max_file_uploads"
+     *
+     * @var int
+     */
+    private $maxFileUploads;
+
     private $postCount = 0;
+    private $filesCount = 0;
 
     /**
      * @param int|null $uploadMaxFilesize
+     * @param int|null $maxFileUploads
      */
-    public function __construct($uploadMaxFilesize = null)
+    public function __construct($uploadMaxFilesize = null, $maxFileUploads = null)
     {
         $var = ini_get('max_input_vars');
         if ($var !== false) {
@@ -71,6 +80,7 @@ public function __construct($uploadMaxFilesize = null)
         }
 
         $this->uploadMaxFilesize = $uploadMaxFilesize === null ? $this->iniUploadMaxFilesize() : (int)$uploadMaxFilesize;
+        $this->maxFileUploads = $maxFileUploads === null ? (int)ini_get('max_file_uploads') : (int)$maxFileUploads;
     }
 
     public function parse(ServerRequestInterface $request)
@@ -86,6 +96,7 @@ public function parse(ServerRequestInterface $request)
         $request = $this->request;
         $this->request = null;
         $this->postCount = 0;
+        $this->filesCount = 0;
         $this->maxFileSize = null;
 
         return $request;
@@ -147,15 +158,25 @@ private function parsePart($chunk)
 
     private function parseFile($name, $filename, $contentType, $contents)
     {
+        $file = $this->parseUploadedFile($filename, $contentType, $contents);
+        if ($file === null) {
+            return;
+        }
+
         $this->request = $this->request->withUploadedFiles($this->extractPost(
             $this->request->getUploadedFiles(),
             $name,
-            $this->parseUploadedFile($filename, $contentType, $contents)
+            $file
         ));
     }
 
     private function parseUploadedFile($filename, $contentType, $contents)
     {
+        // ignore excessive number of file uploads
+        if (++$this->filesCount > $this->maxFileUploads) {
+            return;
+        }
+
         $size = strlen($contents);
 
         // no file selected (zero size and empty filename)

src/Middleware/RequestBodyParserMiddleware.php

@@ -11,10 +11,11 @@ final class RequestBodyParserMiddleware
 
     /**
      * @param int|null $uploadMaxFilesize
+     * @param int|null $maxFileUploads
      */
-    public function __construct($uploadMaxFilesize = null)
+    public function __construct($uploadMaxFilesize = null, $maxFileUploads = null)
     {
-        $this->multipart = new MultipartParser($uploadMaxFilesize);
+        $this->multipart = new MultipartParser($uploadMaxFilesize, $maxFileUploads);
     }
 
     public function __invoke(ServerRequestInterface $request, $next)

tests/Io/MultipartParserTest.php

@@ -754,6 +754,42 @@ public function testUploadNoFile()
         $this->assertSame(UPLOAD_ERR_NO_FILE, $file->getError());
     }
 
+    public function testUploadTooManyFilesReturnsTruncatedList()
+    {
+        $boundary = "---------------------------12758086162038677464950549563";
+
+        $data  = "--$boundary\r\n";
+        $data .= "Content-Disposition: form-data; name=\"first\"; filename=\"first\"\r\n";
+        $data .= "Content-type: text/plain\r\n";
+        $data .= "\r\n";
+        $data .= "hello\r\n";
+        $data .= "--$boundary\r\n";
+        $data .= "Content-Disposition: form-data; name=\"second\"; filename=\"second\"\r\n";
+        $data .= "Content-type: text/plain\r\n";
+        $data .= "\r\n";
+        $data .= "world\r\n";
+        $data .= "--$boundary--\r\n";
+
+        $request = new ServerRequest('POST', 'http://example.com/', array(
+            'Content-Type' => 'multipart/form-data; boundary=' . $boundary,
+        ), $data, 1.1);
+
+        $parser = new MultipartParser(100, 1);
+        $parsedRequest = $parser->parse($request);
+
+        $files = $parsedRequest->getUploadedFiles();
+
+        $this->assertCount(1, $files);
+        $this->assertTrue(isset($files['first']));
+
+        $file = $files['first'];
+        $this->assertSame('first', $file->getClientFilename());
+        $this->assertSame('text/plain', $file->getClientMediaType());
+        $this->assertSame(5, $file->getSize());
+        $this->assertSame(UPLOAD_ERR_OK, $file->getError());
+        $this->assertSame('hello', (string)$file->getStream());
+    }
+
     public function testPostMaxFileSize()
     {
         $boundary = "---------------------------12758086162038677464950549563";