一般的做法
err := r.ParseMultipartForm(32 << 20) // 32Mb
if err != nil {
http.Error(w, err.Error(), http.StatusBadRequest)
}
问题
请注意，32Mb是分配给请求体的字节存储在内存中，而不是请求体的限制，当满(33Mb)时，它将写入临时目录。
查看源码
src/net/http/request.go中
func (r *Request) ParseMultipartForm(maxMemory int64) error {
...
f, err := mr.ReadForm(maxMemory)
...
}
func (r *Reader) ReadForm(maxMemory int64) (*Form, error) {
return r.readForm(maxMemory)
}
func (r *Reader) readForm(maxMemory int64) (_ *Form, err error) {
...
n, err := io.CopyN(&b, p, maxMemory+1)
...
if n > maxMemory {
可以看到这里把剩余的内容写入到临时文件了
file, err := ioutil.TempFile("", "multipart-")
size, err := io.Copy(file, io.MultiReader(&b, p))
...
}
...
}
解决方案一
直接限制客户端上传大小,但是有时候这个数字不通用而且不合适,而且文件类型的检查也没法做
r.Body = http.MaxBytesReader(w, r.Body, 32<<20+512)
解决方案二
自己逐步解析
r.Body = http.MaxBytesReader(w, r.Body, 32<<20+1024)
reader, err := r.MultipartReader()
if err != nil {
http.Error(w, err.Error(), http.StatusBadRequest)
return
}
// parse text field
text := make([]byte, 512)
p, err := reader.NextPart()
// one more field to parse, EOF is considered as failure here
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
if p.FormName() != "text_field" {
http.Error(w, "text_field is expected", http.StatusBadRequest)
return
}
_, err = p.Read(text)
if err != nil && err != io.EOF {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
// parse file field
p, err = reader.NextPart()
if err != nil && err != io.EOF {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
if p.FormName() != "file_field" {
http.Error(w, "file_field is expected", http.StatusBadRequest)
return
}
buf := bufio.NewReader(p)
sniff, _ := buf.Peek(512)
contentType := http.DetectContentType(sniff)
if contentType != "application/zip" {
http.Error(w, "file type not allowed", http.StatusBadRequest)
return
}
f, err := ioutil.TempFile("", "")
if err != nil {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
defer f.Close()
var maxSize int64 = 32 << 20
lmt := io.MultiReader(buf, io.LimitReader(p, maxSize - 511))
written, err := io.Copy(f, lmt)
if err != nil && err != io.EOF {
http.Error(w, err.Error(), http.StatusInternalServerError)
return
}
if written > maxSize {
os.Remove(f.Name())
http.Error(w, "file size over limit", http.StatusBadRequest)
return
}
提示:
只在POST主体中获取前两个部分，处理程序将期望text_field然后file_field
使用bufio.Reader包装part reader(先查看512字节)断言文件类型
使用io.LimitReader限制文件大小(使用1个字节的偏移量来查看part reader是否还有一些数据)
