fix(multipart): reject a file part without a filename instead of passing undefined through

Author: waleedlatif1

apps/sim/lib/core/utils/multipart.test.ts

@@ -5,6 +5,7 @@ import { isMultipartError, type MultipartError, readMultipart } from '@/lib/core
 type Part =
   | { name: string; value: string }
   | { name: string; filename: string; value: string; contentType?: string }
+  | { name: string; value: string; contentType: string }
 
 const BOUNDARY = '----testboundary1234'
 
@@ -14,6 +15,8 @@ function buildBody(parts: Part[], boundary = BOUNDARY): Buffer {
     let header = `--${boundary}\r\nContent-Disposition: form-data; name="${part.name}"`
     if ('filename' in part) {
       header += `; filename="${part.filename}"\r\nContent-Type: ${part.contentType ?? 'text/csv'}`
+    } else if ('contentType' in part) {
+      header += `\r\nContent-Type: ${part.contentType}`
     }
     header += '\r\n\r\n'
     segments.push(Buffer.from(header, 'utf8'), Buffer.from(part.value, 'utf8'), Buffer.from('\r\n'))
@@ -121,6 +124,18 @@ describe('readMultipart', () => {
     )
   })
 
+  it('rejects NO_FILE when the file part carries no filename', async () => {
+    const request = makeRequest([
+      { name: 'file', value: 'name\nAlice\n', contentType: 'application/octet-stream' },
+    ])
+    await readMultipart(request, { maxFileBytes: 1024 }).then(
+      () => {
+        throw new Error('expected rejection')
+      },
+      (err) => expectCode(err, 'NO_FILE')
+    )
+  })
+
   it('rejects NOT_MULTIPART for a non-multipart content type', async () => {
     const request = {
       headers: new Headers({ 'content-type': 'application/json' }),

apps/sim/lib/core/utils/multipart.ts

@@ -178,6 +178,15 @@ export function readMultipart(
         return
       }
 
+      // busboy treats an `application/octet-stream` part without a filename as a file.
+      const { filename } = info
+      if (filename === undefined) {
+        stream.resume()
+        nodeStream.destroy()
+        settle(() => reject(new MultipartError('NO_FILE', 'File part has no filename')))
+        return
+      }
+
       const missing = requiredFieldsBeforeFile.filter((field) => !(field in fields))
       if (missing.length > 0) {
         stream.resume()
@@ -218,7 +227,7 @@ export function readMultipart(
         }
         resolve({
           fields,
-          file: { fieldName: name, filename: info.filename, mimeType: info.mimeType, stream },
+          file: { fieldName: name, filename, mimeType: info.mimeType, stream },
         })
       })
     })