Skip to content

Commit

Permalink
Do not apply max_form_parts to non-multipart data
Browse files Browse the repository at this point in the history
  • Loading branch information
ThiefMaster committed May 5, 2023
1 parent 3a4c8d0 commit 4321c5b
Show file tree
Hide file tree
Showing 3 changed files with 8 additions and 7 deletions.
2 changes: 2 additions & 0 deletions CHANGES.rst
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ Unreleased
- ``Authorization.from_header`` and ``WWWAuthenticate.from_header`` detects tokens
that end with base64 padding (``=``). :issue:`2685`
- Remove usage of ``warnings.catch_warnings``. :issue:`2690`
- Remove ``max_form_parts`` restriction from standard form data parsing and only use
if for multipart content. :pr:`2694`


Version 2.3.3
Expand Down
9 changes: 4 additions & 5 deletions src/werkzeug/formparser.py
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,8 @@ def parse_form_data(
:param cls: an optional dict class to use. If this is not specified
or `None` the default :class:`MultiDict` is used.
:param silent: If set to False parsing errors will not be caught.
:param max_form_parts: The maximum number of parts to be parsed. If this is
exceeded, a :exc:`~exceptions.RequestEntityTooLarge` exception is raised.
:param max_form_parts: The maximum number of multipart parts to be parsed. If this
is exceeded, a :exc:`~exceptions.RequestEntityTooLarge` exception is raised.
:return: A tuple in the form ``(stream, form, files)``.
.. versionchanged:: 2.3
Expand Down Expand Up @@ -157,8 +157,8 @@ class FormDataParser:
:param cls: an optional dict class to use. If this is not specified
or `None` the default :class:`MultiDict` is used.
:param silent: If set to False parsing errors will not be caught.
:param max_form_parts: The maximum number of parts to be parsed. If this is
exceeded, a :exc:`~exceptions.RequestEntityTooLarge` exception is raised.
:param max_form_parts: The maximum number of multipart parts to be parsed. If this
is exceeded, a :exc:`~exceptions.RequestEntityTooLarge` exception is raised.
.. versionchanged:: 2.3
The ``charset`` and ``errors`` parameters are deprecated and will be removed in
Expand Down Expand Up @@ -378,7 +378,6 @@ def _parse_urlencoded(
keep_blank_values=True,
encoding=self.charset,
errors="werkzeug.url_quote",
max_num_fields=self.max_form_parts,
)
except ValueError as e:
raise RequestEntityTooLarge() from e
Expand Down
4 changes: 2 additions & 2 deletions tests/test_formparser.py
Original file line number Diff line number Diff line change
Expand Up @@ -126,8 +126,8 @@ def test_x_www_urlencoded_max_form_parts(self):
r = Request.from_values(method="POST", data={"a": 1, "b": 2})
r.max_form_parts = 1

with pytest.raises(RequestEntityTooLarge):
r.form
assert r.form["a"] == "1"
assert r.form["b"] == "2"

def test_missing_multipart_boundary(self):
data = (
Expand Down

0 comments on commit 4321c5b

Please sign in to comment.