Description
src/routes/imports.ts together with multer and csv-parse accept uploaded CSVs processed via src/services/importPreviewService.ts. Without explicit multer limits and content-type checks, a large or malicious upload can exhaust memory/disk or smuggle non-CSV content. We need hard limits on file size and row count, MIME/extension validation, and streaming CSV parsing with early rejection.
Requirements and context
- Configure
multer limits (fileSize, files) and a fileFilter for CSV MIME types in src/routes/imports.ts.
- Stream-parse with
csv-parse and cap row count in src/services/importPreviewService.ts.
- Reject malformed headers and oversized cells with clear 400s.
- Ensure temp files are cleaned up on error.
Suggested execution
Create branch feature/import-upload-limits.
- Modify
src/routes/imports.ts and src/services/importPreviewService.ts.
- Add
tests/routes/imports.test.ts for oversized/non-CSV/malformed input.
- Update
docs/ import documentation.
Test and commit
Run npm run test. Edge cases: file over limit, wrong MIME, zero rows, huge single cell, parser error mid-stream. Security: reject formula-injection cells (=, +, @) in preview output.
Example commit message
feat: enforce size, type, and row limits on CSV imports
Guidelines
- Minimum 95% test coverage
- Clear documentation in import docs
- Timeframe: 96 hours
Description
src/routes/imports.tstogether withmulterandcsv-parseaccept uploaded CSVs processed viasrc/services/importPreviewService.ts. Without explicitmulterlimits and content-type checks, a large or malicious upload can exhaust memory/disk or smuggle non-CSV content. We need hard limits on file size and row count, MIME/extension validation, and streaming CSV parsing with early rejection.Requirements and context
multerlimits (fileSize, files) and a fileFilter for CSV MIME types insrc/routes/imports.ts.csv-parseand cap row count insrc/services/importPreviewService.ts.Suggested execution
Create branch
feature/import-upload-limits.src/routes/imports.tsandsrc/services/importPreviewService.ts.tests/routes/imports.test.tsfor oversized/non-CSV/malformed input.docs/import documentation.Test and commit
Run
npm run test. Edge cases: file over limit, wrong MIME, zero rows, huge single cell, parser error mid-stream. Security: reject formula-injection cells (=,+,@) in preview output.Example commit message
feat: enforce size, type, and row limits on CSV importsGuidelines