merge: Check for truncated uploads in Mastodon API (!998)

View MR for information: https://activitypub.software/TransFem-org/Sharkey/-/merge_requests/998

Approved-by: Marie <github@yuugi.dev>
Approved-by: dakkar <dakkar@thenautilus.net>

packages/backend/src/misc/create-temp.ts

@@ -30,13 +30,20 @@ export function createTempDir(): Promise<[string, () => void]> {
 	});
 }
 
-export async function saveToTempFile(stream: NodeJS.ReadableStream): Promise<string> {
+export async function saveToTempFile(stream: NodeJS.ReadableStream & { truncated?: boolean }): Promise<[string, () => void]> {
 	const [filepath, cleanup] = await createTemp();
+
 	try {
 		await pipeline(stream, fs.createWriteStream(filepath));
-		return filepath;
 	} catch (e) {
 		cleanup();
 		throw e;
 	}
+
+	if (stream.truncated) {
+		cleanup();
+		throw new Error('Read failed: input stream truncated');
+	}
+
+	return [filepath, cleanup];
 }

packages/backend/src/server/ServerUtilityService.ts

@@ -54,7 +54,7 @@ export class ServerUtilityService {
 						}
 					} else { // Otherwise it's a file
 						try {
-							const filepath = await saveToTempFile(part.file);
+							const [filepath] = await saveToTempFile(part.file);
 
 							const tmpUploads = (request.tmpUploads ??= []);
 							tmpUploads.push(filepath);