fix(uploads): reject boolean upload limits (#5920)

Signed-off-by: xbzz1018 <xbzz1018@users.noreply.github.com>
Co-authored-by: xbzz1018 <xbzz1018@users.noreply.github.com>
This commit is contained in:
xbzz1018 2026-09-28 15:17:41 +08:00 committed by GitHub
parent c917c2cc8f
commit 00c35fcce6
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 19 additions and 0 deletions

View File

@ -163,6 +163,8 @@ def _get_upload_limit(app_config: AppConfig, key: str, default: int, *, legacy_k
value = _get_uploads_config_value(app_config, legacy_key, None)
if value is None:
value = default
if isinstance(value, bool):
raise ValueError
limit = int(value)
if limit <= 0:
raise ValueError

View File

@ -1646,6 +1646,23 @@ def test_upload_limits_accept_legacy_config_keys():
assert limits == uploads.UploadLimits(max_files=7, max_file_size=123, max_total_size=456)
@pytest.mark.parametrize(
("key", "default"),
[
("max_files", uploads.DEFAULT_MAX_FILES),
("max_file_size", uploads.DEFAULT_MAX_FILE_SIZE),
("max_total_size", uploads.DEFAULT_MAX_TOTAL_SIZE),
],
)
def test_upload_limits_reject_boolean_values(key, default):
cfg = MagicMock()
cfg.uploads = {key: True}
limits = uploads._get_upload_limits(cfg)
assert getattr(limits, key) == default
def test_upload_files_uses_configured_file_count_limit(tmp_path):
thread_uploads_dir = tmp_path / "uploads"
thread_uploads_dir.mkdir(parents=True)