- Shipped
- September 23, 2026 at 10:50 AM UTC
- Author
- Kamo
- Commit
- 2ba2ce2
POST /sessions/{guid}/attachments bound its parts as a @RequestParam MultipartFile[] method parameter. Spring resolves method parameters before a controller method's body runs, so the container started spooling toward the 3.1 GB request ceiling before requireMember ever got a chance to reject an unauthenticated caller - an unauthenticated POST could make a pod spool gigabytes to disk for nothing. (kamo-internal's own multipart piping is handled separately.) upload() now takes only HttpServletRequest, calls requireMember and the session-membership check first, and only then reads the parts by hand off the MultipartHttpServletRequest Spring already wrapped the request in. **************** (application.yml and k8s/configmap.yaml) keeps that wrapper from parsing anything until this method actually asks it to - binding MultipartFile[] directly would still have forced a parse during argument resolution, ahead of every line in the method body, lazily or not. Covered by **************** mutation-checked by moving the file-read back ahead of the auth check (same signature, same class): two of the four assertions turn red under that ordering.