Function parseMultipartGraphQL

serv/upload.go:74–184

parseMultipartGraphQL parses a graphql-multipart-request-spec body and returns a populated gqlReq with file values injected at the paths declared in the `map` part. When `backend` is nil, files are inlined as base64 (legacy mode). When `backend` is non-nil, files are streamed to the backend and the

(r *http.Request, conf UploadsConfig, backend fstable.Backend)

//
// Spec: https://github.com/jaydenseric/graphql-multipart-request-spec
func parseMultipartGraphQL(r *http.Request, conf UploadsConfig, backend fstable.Backend) (gqlReq, error) {
	maxSize := conf.MaxSize
	if maxSize <= 0 {
		maxSize = defaultMaxUploadSize
	}

	// Cap the raw body before any parsing; protects against zip-bomb
	// style abuse (large declared length, slow trickle).
	r.Body = http.MaxBytesReader(nil, r.Body, maxSize)

	if err := r.ParseMultipartForm(maxSize); err != nil {
		return gqlReq{}, fmt.Errorf("multipart: parse failed: %w", err)
	}

	// 1. operations: { query, operationName, variables }
	opsRaw := r.FormValue("operations")
	if opsRaw == "" {
		return gqlReq{}, errors.New("multipart: missing 'operations' field")
	}
	var ops gqlReq
	if err := json.Unmarshal([]byte(opsRaw), &ops); err != nil {
		return gqlReq{}, fmt.Errorf("multipart: 'operations' is not valid JSON: %w", err)
	}

	// 2. map: { "0": ["variables.file"], "1": ["variables.files.0"] }
	mapRaw := r.FormValue("map")
	if mapRaw == "" {
		// Spec mandates `map`; without it, no file injection happens.
		// Treat as a structural error rather than silently dropping uploads.
		return gqlReq{}, errors.New("multipart: missing 'map' field")
	}
	var fileMap map[string][]string
	if err := json.Unmarshal([]byte(mapRaw), &fileMap); err != nil {
		return gqlReq{}, fmt.Errorf("multipart: 'map' is not valid JSON: %w", err)
	}

	// Decode variables to a generic structure so we can write file
	// values at arbitrary paths.
	var vars map[string]any
	if len(ops.Vars) > 0 {
		if err := json.Unmarshal(ops.Vars, &vars); err != nil {
			return gqlReq{}, fmt.Errorf("multipart: 'variables' is not valid JSON: %w", err)
		}
	} else {
		vars = make(map[string]any)
	}
	root := map[string]any{"variables": vars}

	allowed := buildMIMEAllowlist(conf.AllowedMIME)
	ctx := r.Context()

	for partName, paths := range fileMap {
		fhs, ok := r.MultipartForm.File[partName]
		if !ok || len(fhs) == 0 {
			return gqlReq{}, fmt.Errorf("multipart: 'map' references file %q which is missing from the request", partName)
		}
		fh := fhs[0]