Discard buffered request body if size limit is exceeded

Author: clue

README.md

@@ -694,7 +694,14 @@ configuration.
 configuration in most cases.)
 
 Any incoming request that has a request body that exceeds this limit will be
-accepted but their request body will not be added to the request.
+accepted, but its request body will be discarded (empty request body).
+This is done in order to avoid having to keep an incoming request with an
+excessive size (for example, think of a 2 GB file upload) in memory.
+This allows the next middleware handler to still handle this request, but it
+will see an empty request body.
+This is similar to PHP's default behavior, where the body will not be parsed
+if this limit is exceeded. However, unlike PHP's default behavior, the raw
+request body is not available via `php://input`.
 
 The `RequestBodyBufferMiddleware` will buffer requests with bodies of known size 
 (i.e. with `Content-Length` header specified) as well as requests with bodies of 
@@ -781,6 +788,8 @@ See also [example #12](examples) for more details.
   handler as given in the example above.
   This previous middleware handler is also responsible for rejecting incoming
   requests that exceed allowed message sizes (such as big file uploads).
+  The [`RequestBodyBufferMiddleware`](#requestbodybuffermiddleware) used above
+  simply discards excessive request bodies, resulting in an empty body.
   If you use this middleware without buffering first, it will try to parse an
   empty (streaming) body and may thus assume an empty data structure.
   See also [`RequestBodyBufferMiddleware`](#requestbodybuffermiddleware) for

src/Middleware/RequestBodyBufferMiddleware.php

@@ -29,18 +29,24 @@ public function __construct($sizeLimit = null)
 
     public function __invoke(ServerRequestInterface $request, $stack)
     {
-        $sizeLimit = $this->sizeLimit;
         $body = $request->getBody();
 
+        // skip if body is already buffered
+        if (!$body instanceof ReadableStreamInterface) {
+            // replace with empty buffer if size limit is exceeded
+            if ($body->getSize() > $this->sizeLimit) {
+                $request = $request->withBody(new BufferStream(0));
+            }
+
+            return $stack($request);
+        }
+
         // request body of known size exceeding limit
+        $sizeLimit = $this->sizeLimit;
         if ($body->getSize() > $this->sizeLimit) {
             $sizeLimit = 0;
         }
 
-        if (!$body instanceof ReadableStreamInterface) {
-            return $stack($request);
-        }
-
         return Stream\buffer($body, $sizeLimit)->then(function ($buffer) use ($request, $stack) {
             $stream = new BufferStream(strlen($buffer));
             $stream->write($buffer);

tests/Middleware/RequestBodyBufferMiddlewareTest.php

@@ -38,6 +38,7 @@ function (ServerRequestInterface $request) use (&$exposedRequest) {
         $stream->write('world');
         $stream->end('!');
 
+        $this->assertSame(11, $exposedRequest->getBody()->getSize());
         $this->assertSame('helloworld!', $exposedRequest->getBody()->getContents());
     }
 
@@ -63,13 +64,14 @@ function (ServerRequestInterface $request) use (&$exposedRequest) {
             }
         );
 
+        $this->assertSame($size, $exposedRequest->getBody()->getSize());
         $this->assertSame($body, $exposedRequest->getBody()->getContents());
     }
 
     public function testKnownExcessiveSizedBodyIsDisgardedTheRequestIsPassedDownToTheNextMiddleware()
     {
         $loop = Factory::create();
-        
+
         $stream = new ThroughStream();
         $stream->end('aa');
         $serverRequest = new ServerRequest(
@@ -91,6 +93,28 @@ function (ServerRequestInterface $request) {
         $this->assertSame('', $response->getBody()->getContents());
     }
 
+    public function testAlreadyBufferedExceedingSizeResolvesImmediatelyWithEmptyBody()
+    {
+        $serverRequest = new ServerRequest(
+            'GET',
+            'https://example.com/',
+            array(),
+            'hello'
+        );
+
+        $exposedRequest = null;
+        $buffer = new RequestBodyBufferMiddleware(1);
+        $buffer(
+            $serverRequest,
+            function (ServerRequestInterface $request) use (&$exposedRequest) {
+                $exposedRequest = $request;
+            }
+        );
+
+        $this->assertSame(0, $exposedRequest->getBody()->getSize());
+        $this->assertSame('', $exposedRequest->getBody()->getContents());
+    }
+
     public function testExcessiveSizeBodyIsDiscardedAndTheRequestIsPassedDownToTheNextMiddleware()
     {
         $loop = Factory::create();
@@ -128,7 +152,7 @@ function (ServerRequestInterface $request) {
     public function testBufferingErrorThrows()
     {
         $loop = Factory::create();
-        
+
         $stream = new ThroughStream();
         $serverRequest = new ServerRequest(
             'GET',