Skip to content

Multipart dataset upload can bypass single_file_upload_max_size_mib limit #4147

@carloea2

Description

@carloea2

What happened?

Multipart uploads are able to complete successfully even when the final uploaded object exceeds the configured single_file_upload_max_size_mib limit. This allows uploading files larger than the intended max size through the multipart upload flow.

How to reproduce?

How to reproduce?

  1. Configure a small max upload size:

    • Set site_settings.key = single_file_upload_max_size_mib to 1 (1 MiB).
  2. Start a multipart upload for a file larger than 1 MiB (e.g., 2 MiB) using the multipart endpoints.

  3. Upload the parts and call finish.

  4. Observe that the upload completes and the file is accessible despite exceeding the max.

Version

1.1.0-incubating (Pre-release/Master)

Commit Hash (Optional)

No response

What browsers are you seeing the problem on?

No response

Relevant log output

Metadata

Metadata

Assignees

No one assigned

    Labels

    triagePending for triaging

    Type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions