expressjs / multer / 27543801534

99%

master: 98%

push

github

Merge commit from fork

* test: add regression tests for orphan file cleanup

Verify that diskStorage does not leave orphan files on disk when:
- client aborts TCP connection mid-upload
- multipart request is truncated (missing closing boundary)

Ref: https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm

* fix: clean up in-progress disk writes on abort

Track files passed to storage._handleFile in a pendingFiles array so
that finishAbort can remove them even when the callback has not fired.
In diskStorage, set file.path early and skip file creation when the
source stream is already destroyed.

Ref: https://github.com/expressjs/multer/security/advisories/GHSA-3p4h-7m6x-2hcm

* test: cover orphan cleanup for already-completed files on later abort

Add a case to the existing orphan-file-cleanup suite: when a multi-file
upload aborts on a later file, files that already finished writing to
disk (tracked in uploadedFiles) must still be removed. The existing
tests only exercised the in-flight (pendingFiles) path.

---------

Co-authored-by: Sebastian Beltran <bjohansebas@gmail.com>

120 of 135 branches covered (88.89%)

10 of 10 new or added lines in 2 files covered. (100.0%)

298 of 301 relevant lines covered (99.0%)

7777.06 hits per line