Content length is checked after downloading full file, allowing for OOM

[5225225]

In upload, you're loading in the full content of the file to memory, and then checking if it is too big. You should be checking the size while downloading, and immediately rejecting a file that is too big.

Steps to reproduce:

curl localhost:8000 -X POST -F file=@/dev/zero and watch as the process uses all your system's memory despite having a max_content_length of 10MB.

[orhun]

Thanks for reporting this 👍🏼