Skip to content

Fix/multipart 413 pr#4485

Closed
nclimaz wants to merge 8 commits intolitestar-org:mainfrom
nclimaz:fix/multipart-413-PR
Closed

Fix/multipart 413 pr#4485
nclimaz wants to merge 8 commits intolitestar-org:mainfrom
nclimaz:fix/multipart-413-PR

Conversation

@nclimaz
Copy link
Copy Markdown

@nclimaz nclimaz commented Nov 20, 2025

Description

Fixes the issue where exceeding multipart form part limits returned HTTP 400 instead of HTTP 413.

Changes

  • Added RequestEntityTooLarge exception to http_exceptions.py
  • Modified _multipart.py to catch ParserLimitReached and raise RequestEntityTooLarge
  • Added test case test_oversized_file_returns_413 to verify proper status code

Testing

  • Added unit test that verifies 413 status code when part limit is exceeded
  • Test passes locally

Closes 4439

Changed ClientException to RequestEntityTooLarge when multipart
request exceeds size limits, returning HTTP 413 status code
instead of HTTP 400 per RFC 7231.

Closes litestar-org#4439
Previously, when multipart form data exceeded the part limit,
a ClientException (400) was raised. This fix properly raises
RequestEntityTooLarge (413) when ParserLimitReached is caught.

- Added RequestEntityTooLarge exception class
- Updated parse_multipart_form to raise 413 on limit exceeded
- Added test case to verify 413 status code
@nclimaz nclimaz requested review from a team as code owners November 20, 2025 16:09
@github-actions github-actions bot added area/multipart area/private-api This PR involves changes to the privatized API size: small pr/external Triage Required 🏥 This requires triage labels Nov 20, 2025
PushMultipartParser,
)

from litestar.utils.compat import async_next
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is this being imported here?

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@provinzkraut I've addressed the feedback with one clarification:

I did not remove the except StopAsyncIteration: block. Removing it caused a runtime failure (NameError: name 'async_next' is not defined) and resulted in a 500 instead of the expected 413. Keeping the explicit exception handling ensures the correct 413 response is returned.

# FIXME (3.0): This should raise a '413 - Request Entity Too Large', but for
# backwards compatibility, we keep it as a 400 for now
raise ClientException("Request Entity Too Large") from None
# FIXED (3.0): This now should raise a '413 - Request Entity Too Large'
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comment isn't really useful. Please remove it

- Remove FIXED comment from exception handler
- Move multipart 413 test to test_data_extractors.py following project conventions
- Ensure test follows existing test suite patterns
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/multipart area/private-api This PR involves changes to the privatized API pr/external size: small Triage Required 🏥 This requires triage

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants