fix: enforce request body size limits when Content-Type is absent

.changeset/cold-seals-write.md

@@ -0,0 +1,6 @@
+---
+"@sveltejs/kit": patch
+---
+
+fix: enforce request body size limits when Content-Type is absent
+

packages/kit/src/exports/node/index.js

@@ -13,10 +13,6 @@ const body_data_listeners = new WeakMap();
 function get_raw_body(req, body_size_limit) {
 	const h = req.headers;
 
-	if (!h['content-type']) {
-		return null;
-	}
-
 	const content_length = Number(h['content-length']);
 	const has_content_length = Number.isFinite(content_length);
 

packages/kit/src/exports/node/index.spec.js

@@ -82,6 +82,32 @@ test('rejects request bodies that exceed content-length', async () => {
 	});
 });
 
+test.each([{ 'content-length': '11' }, { 'transfer-encoding': 'chunked' }])(
+	'enforces body size limit without content-type (%j)',
+	async (headers) => {
+		const req = new PassThrough();
+		const incoming = /** @type {import('http').IncomingMessage} */ (/** @type {unknown} */ (req));
+		incoming.headers = headers;
+		incoming.method = 'POST';
+		incoming.url = '/';
+		incoming.httpVersionMajor = 1;
+
+		const request = getRequest({
+			request: incoming,
+			base: 'http://localhost',
+			bodySizeLimit: 10
+		});
+
+		const text = request.text();
+		req.end(Buffer.from('0123456789a'));
+
+		await expect(text).rejects.toMatchObject({
+			status: 413,
+			text: 'Payload Too Large'
+		});
+	}
+);
+
 /**
  * Minimal `ServerResponse` stand-in that records headers and body writes and
  * emits `finish` when ended.