@maiyunnet/kebab 9.13.5 → 9.13.6

package/doc/kebab-rag.md

@@ -1360,7 +1360,7 @@ index/variables/VER.md
 
 # Variable: VER
 
-> `const` **VER**: `"9.13.5"` = `'9.13.5'`
+> `const` **VER**: `"9.13.6"` = `'9.13.6'`
 
 Defined in: [index.ts:10](https://github.com/maiyunnet/kebab/blob/master/index.ts#L10)
 

package/index.d.ts

@@ -5,7 +5,7 @@
  * --- 本文件用来定义每个目录实体地址的常量 ---
  */
 /** --- 当前系统版本号 --- */
-export declare const VER = "9.13.5";
+export declare const VER = "9.13.6";
 /** --- 框架根目录，以 / 结尾  --- */
 export declare const ROOT_PATH: string;
 /** --- 框架的 LIB，以 / 结尾 --- */

package/index.js

@@ -6,7 +6,7 @@
  * --- 本文件用来定义每个目录实体地址的常量 ---
  */
 /** --- 当前系统版本号 --- */
-export const VER = '9.13.5';
+export const VER = '9.13.6';
 // --- 服务端用的路径 ---
 const imu = decodeURIComponent(import.meta.url).replace('file://', '').replace(/^\/(\w:)/, '$1');
 /** --- /xxx/xxx --- */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maiyunnet/kebab",
-  "version": "9.13.5",
+  "version": "9.13.6",
   "description": "Simple, easy-to-use, and fully-featured Node.js framework that is ready-to-use out of the box.",
   "type": "module",
   "keywords": [

package/sys/route.js

@@ -902,7 +902,7 @@ export function getPost(req) {
  * @param limits 文件上传限制
  */
 export function getFormData(req, events = {}, limits = {}) {
-    return new Promise(function (resolve) {
+    return new Promise(resolve => {
         if (req.readableEnded) {
             resolve({ 'post': {}, 'files': {} });
             return;
@@ -954,6 +954,38 @@ export function getFormData(req, events = {}, limits = {}) {
         let writeFileLength = 0;
         /** --- 当前读取是否已经完全结束 --- */
         let readEnd = false;
+        /** --- 是否有文件被限制拒绝（整体返回 false） --- */
+        let rejected = false;
+        /** --- 清理 rtn.files 中所有已写入的临时文件 --- */
+        function cleanupFiles() {
+            for (const key in rtn.files) {
+                let files = rtn.files[key];
+                if (!Array.isArray(files)) {
+                    files = [files];
+                }
+                for (const file of files) {
+                    lFs.unlink(file.path).catch(() => { });
+                }
+            }
+        }
+        /** --- 拒绝当前文件：销毁流、删临时文件、标记 rejected --- */
+        function rejectFile() {
+            rejected = true;
+            ftmpStream.destroy();
+            lFs.unlink(kebab.FTMP_CWD + ftmpName).catch(() => { });
+            ftmpName = '';
+            --writeFileLength;
+        }
+        /** --- 最终输出 --- */
+        function finalize() {
+            if (rejected) {
+                cleanupFiles();
+                resolve(false);
+            }
+            else {
+                resolve(rtn);
+            }
+        }
         // --- 开始读取 ---
         req.on('data', function (chunk) {
             buffer = Buffer.concat([buffer, chunk], buffer.length + chunk.length);
@@ -983,12 +1015,18 @@ export function getFormData(req, events = {}, limits = {}) {
                             ++writeFileLength;
                             state = EState.FILE;
                             fileName = match[1];
+                            // --- 已被拒绝则不创建文件流，仅丢弃数据 ---
+                            if (rejected) {
+                                ftmpName = '';
+                                break;
+                            }
                             // --- 检查文件扩展名限制 ---
                             if (limits.allowedExts?.length) {
                                 const extIo = fileName.lastIndexOf('.');
                                 const ext = extIo !== -1 ? fileName.slice(extIo).toLowerCase() : '';
                                 if (!limits.allowedExts.includes(ext)) {
-                                    // --- 扩展名不允许，跳过该文件 ---
+                                    // --- 扩展名不允许，拒绝整体上传 ---
+                                    rejected = true;
                                     ftmpName = '';
                                     break;
                                 }
@@ -1003,6 +1041,7 @@ export function getFormData(req, events = {}, limits = {}) {
                                     date.getUTCHours().toString().padStart(2, '0') +
                                     date.getUTCMinutes().toString().padStart(2, '0') + '_' + lCore.random() + '.ftmp';
                                 ftmpStream = lFs.createWriteStream(kebab.FTMP_CWD + ftmpName);
+                                ftmpStream.on('error', () => { });
                                 ftmpSize = 0;
                             }
                             else {
@@ -1042,22 +1081,23 @@ export function getFormData(req, events = {}, limits = {}) {
                             // --- 没找到结束标语，将预留 boundary 长度之前的写入到文件 ---
                             const writeBuffer = buffer.subarray(0, -boundary.length - 4);
                             if (ftmpName) {
-                                // --- 检查文件大小限制 ---
-                                if (limits.maxFileSize &&
-                                    (ftmpSize + Buffer.byteLength(writeBuffer) > limits.maxFileSize)) {
-                                    ftmpStream.destroy();
-                                    lFs.unlink(kebab.FTMP_CWD + ftmpName).catch(() => { });
-                                    ftmpName = '';
-                                    --writeFileLength;
-                                }
-                                else {
-                                    ftmpStream.write(writeBuffer);
-                                    ftmpSize += Buffer.byteLength(writeBuffer);
+                                if (writeBuffer.length > 0) {
+                                    // --- 检查文件大小限制 ---
+                                    if (limits.maxFileSize &&
+                                        (ftmpSize + Buffer.byteLength(writeBuffer) > limits.maxFileSize)) {
+                                        rejectFile();
+                                    }
+                                    else {
+                                        ftmpStream.write(writeBuffer);
+                                        ftmpSize += Buffer.byteLength(writeBuffer);
+                                    }
                                 }
                             }
                             else {
                                 // --- 跳过该文件 ---
-                                events.onfiledata?.(writeBuffer);
+                                if (writeBuffer.length > 0) {
+                                    events.onfiledata?.(writeBuffer);
+                                }
                             }
                             buffer = buffer.subarray(-boundary.length - 4);
                             return;
@@ -1065,44 +1105,51 @@ export function getFormData(req, events = {}, limits = {}) {
                         // --- 找到结束标语，结束标语之前的写入文件，之后的重新放回 buffer ---
                         const writeBuffer = buffer.subarray(0, io);
                         if (ftmpName) {
-                            ftmpStream.write(writeBuffer);
-                            ftmpSize += Buffer.byteLength(writeBuffer);
-                            ftmpStream.end(() => {
-                                --writeFileLength;
-                                if (!readEnd) {
-                                    // --- request 没读完，不管 ---
-                                    return;
-                                }
-                                if (writeFileLength) {
-                                    // --- req 读完了但文件还没写完，不管 ---
-                                    return;
-                                }
-                                // --- 文件也写完了 ---
-                                resolve(rtn);
-                            });
-                            // --- POST 部分 ---
-                            let fname = fileName.replace(/\\/g, '/');
-                            const nlio = fname.lastIndexOf('/');
-                            if (nlio !== -1) {
-                                fname = fname.slice(nlio + 1);
+                            // --- 检查文件大小限制（最后一个分片） ---
+                            if (limits.maxFileSize &&
+                                (ftmpSize + Buffer.byteLength(writeBuffer) > limits.maxFileSize)) {
+                                rejectFile();
                             }
-                            const val = {
-                                'name': fname,
-                                'origin': fileName,
-                                'size': ftmpSize,
-                                'path': kebab.FTMP_CWD + ftmpName
-                            };
-                            if (rtn.files[name]) {
-                                if (Array.isArray(rtn.files[name])) {
-                                    rtn.files[name].push(val);
+                            else {
+                                ftmpStream.write(writeBuffer);
+                                ftmpSize += Buffer.byteLength(writeBuffer);
+                                ftmpStream.end(() => {
+                                    --writeFileLength;
+                                    if (!readEnd) {
+                                        // --- request 没读完，不管 ---
+                                        return;
+                                    }
+                                    if (writeFileLength) {
+                                        // --- req 读完了但文件还没写完，不管 ---
+                                        return;
+                                    }
+                                    // --- 文件也写完了 ---
+                                    finalize();
+                                });
+                                // --- POST 部分 ---
+                                let fname = fileName.replace(/\\/g, '/');
+                                const nlio = fname.lastIndexOf('/');
+                                if (nlio !== -1) {
+                                    fname = fname.slice(nlio + 1);
+                                }
+                                const val = {
+                                    'name': fname,
+                                    'origin': fileName,
+                                    'size': ftmpSize,
+                                    'path': kebab.FTMP_CWD + ftmpName
+                                };
+                                if (rtn.files[name]) {
+                                    if (Array.isArray(rtn.files[name])) {
+                                        rtn.files[name].push(val);
+                                    }
+                                    else {
+                                        rtn.files[name] = [rtn.files[name], val];
+                                    }
                                 }
                                 else {
-                                    rtn.files[name] = [rtn.files[name], val];
+                                    rtn.files[name] = val;
                                 }
                             }
-                            else {
-                                rtn.files[name] = val;
-                            }
                         }
                         else {
                             // --- 跳过该文件 ---
@@ -1114,6 +1161,10 @@ export function getFormData(req, events = {}, limits = {}) {
                         break;
                     }
                 }
+                // --- 被拒绝则丢弃剩余数据，等待 'end' 事件后 resolve ---
+                if (rejected) {
+                    return;
+                }
             }
         });
         req.on('error', function (e) {
@@ -1122,17 +1173,23 @@ export function getFormData(req, events = {}, limits = {}) {
             }
             lCore.debug('[ROUTE][GETFORMDATA] request error before getFormData: ' + e.message);
             lCore.log({}, '[ROUTE][GETFORMDATA] request error before getFormData: ' + (e.stack ?? ''), '-error');
+            cleanupFiles();
             resolve(false);
         });
         req.on('end', function () {
             readEnd = true;
+            // --- 被拒绝则清理文件并 resolve(false) ---
+            if (rejected) {
+                finalize();
+                return;
+            }
             if (state === EState.FILE) {
                 if (ftmpName) {
                     ftmpStream.end(() => {
                         --writeFileLength;
                         if (!writeFileLength) {
                             // --- 文件也写完了 ---
-                            resolve(rtn);
+                            finalize();
                         }
                     });
                     return;
@@ -1146,7 +1203,7 @@ export function getFormData(req, events = {}, limits = {}) {
                 return;
             }
             // --- 文件写完了 ----
-            resolve(rtn);
+            finalize();
         });
     });
 }

package/www/example/ctr/test.d.ts

@@ -64,33 +64,6 @@ export default class extends sCtr.Ctr {
     private _dbTable;
     vector(): Promise<any>;
     kv(): Promise<kebab.Json>;
-    net(): Promise<string>;
-    netPipe(): Promise<kebab.Json>;
-    netPost(): Promise<kebab.Json>;
-    netPost1(): string;
-    netPostString(): Promise<string>;
-    netPostString1(): kebab.Json[];
-    netOpen(): Promise<kebab.Json>;
-    netFormTest(): Promise<string>;
-    netUpload(): Promise<string>;
-    netUpload1(): Promise<string>;
-    netCookie(): Promise<string>;
-    netCookie1(): string;
-    netCookie2(): string;
-    netSave(): Promise<string>;
-    netFollow(): Promise<string>;
-    netFollow1(): void;
-    netFollow2(): kebab.Json;
-    netReuse(): Promise<string>;
-    netError(): Promise<string>;
-    netHosts(): Promise<string>;
-    netMproxy(): Promise<string | boolean>;
-    netMproxy1(): Promise<string | boolean>;
-    netMproxy2(): any[];
-    netFilterheaders(): string;
-    netFetch(): Promise<string | boolean>;
-    netFetch1(): any[];
-    netGetResponseJson(): Promise<string>;
     getResponseJson1(): any[];
     getResponseJson2(): any[];
     undici(): Promise<string>;
@@ -192,6 +165,14 @@ export default class extends sCtr.Ctr {
      * --- CORS 精细化配置测试 ---
      */
     ctrCrossFine(): string;
+    /**
+     * --- 文件上传限制演示页面 ---
+     */
+    ctrUploadLimits(): string;
+    /**
+     * --- 文件上传限制演示接口 ---
+     */
+    ctrUploadLimits1(): Promise<kebab.Json[]>;
     /**
      * --- END ---
      */

package/www/example/ctr/test.js

@@ -1,7 +1,6 @@
 // --- 库 ---
 import * as kebab from '#kebab/index.js';
 import * as lCore from '#kebab/lib/core.js';
-import * as lNet from '#kebab/lib/net.js';
 import * as lUndici from '#kebab/lib/undici.js';
 import * as lDb from '#kebab/lib/db.js';
 import * as lVector from '#kebab/lib/vector.js';
@@ -126,6 +125,7 @@ export default class extends sCtr.Ctr {
             `<br><a href="${this._config.const.urlBase}test/ctr-timeout-short">View "test/ctr-timeout-short"</a>`,
             `<br><a href="${this._config.const.urlBase}test/ctr-session-token">View "test/ctr-session-token"</a>`,
             `<br><a href="${this._config.const.urlBase}test/ctr-500">View "test/ctr-500"</a>`,
+            `<br><a href="${this._config.const.urlBase}test/ctr-upload-limits">View "test/ctr-upload-limits" (File upload limits demo)</a>`,
             '<br><br><b>Middle:</b>',
             `<br><br><a href="${this._config.const.urlBase}test/middle">View "test/middle"</a>`,
             '<br><br><b>Model test:</b>',
@@ -171,25 +171,6 @@ export default class extends sCtr.Ctr {
             `<br><br><a href="${this._config.const.urlBase}test/vector">View "test/vector"</a>`,
             '<br><br><b>Kv:</b>',
             `<br><br><a href="${this._config.const.urlBase}test/kv">View "test/kv"</a>`,
-            '<br><br><b>Net:</b>',
-            `<br><br><a href="${this._config.const.urlBase}test/net">View "test/net"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-pipe">View "test/net-pipe"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-post">View "test/net-post"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-post-string">View "test/net-post-string"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-open">View "test/net-open"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-form-test">View "test/net-form-test"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-upload">View "test/net-upload"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-cookie">View "test/net-cookie"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-save">View "test/net-save"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-follow">View "test/net-follow"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-reuse">View "test/net-reuse"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-error">View "test/net-error"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-hosts">View "test/net-hosts"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-rproxy/dist/core.js">View "test/net-rproxy/dist/core.js"</a> <a href="${this._config.const.urlBase}test/net-rproxy/package.json">View "package.json"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-mproxy">View "test/net-mproxy"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-filterheaders">View "test/net-filterheaders"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-fetch">View "test/net-fetch"</a>`,
-            `<br><a href="${this._config.const.urlBase}test/net-get-response-json">View "test/net-get-response-json"</a>`,
             '<br><br><b>Undici:</b>',
             `<br><br><a href="${this._config.const.urlBase}test/undici">View "test/undici"</a>`,
             `<br><a href="${this._config.const.urlBase}test/undici-pipe">View "test/undici-pipe"</a>`,
@@ -1882,481 +1863,6 @@ echo[echo.length - 1] = echo[echo.length - 1].slice(0, -4);</pre>`);
             '<a href="' + this._config.const.urlBase + 'test/kv?ac=other">Other</a> | ' +
             '<a href="' + this._config.const.urlBase + 'test">Return</a>' + echo.join('') + '<br><br>' + this._getEnd();
     }
-    async net() {
-        const echo = [];
-        const res = await lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json');
-        echo.push(`<pre>Net.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json');</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: ${JSON.stringify(res.error)}`);
-        const res2 = await lNet.get(this._internalUrl + 'test?abc');
-        echo.push(`<pre>Net.get('${this._internalUrl}test?abc');</pre>
-headers: <pre>${JSON.stringify(res2.headers, null, 4)}</pre>
-content: <pre>${(await res2.getContent())?.toString().slice(0, 500) ?? 'null'}</pre>
-error: ${JSON.stringify(res2.error)}`);
-        return echo.join('') + '<br><br>' + this._getEnd();
-    }
-    async netPipe() {
-        const echo = [];
-        const res = await lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json');
-        echo.push(`<pre>Net.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json');</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>`, res, `</pre>
-error: ${JSON.stringify(res.error)}
-<br><br>` + this._getEnd());
-        return echo;
-    }
-    async netPost() {
-        const echo = [];
-        const res = await lNet.post(this._internalUrl + 'test/netPost1', { 'a': '1', 'b': '2', 'c': ['1', '2', '3'] });
-        echo.push(`<pre>lNet.post('${this._internalUrl}test/netPost1', { 'a': '1', 'b': '2', 'c': ['1', '2', '3'] });</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: ${JSON.stringify(res.error)}`);
-        return echo.join('') + '<br><br>' + this._getEnd();
-    }
-    netPost1() {
-        return `_post:\n\n${JSON.stringify(this._post)}\n\nRequest headers:\n\n${JSON.stringify(this._headers, null, 4)}\n\nIP: ${this._req.socket.remoteAddress ?? ''}`;
-    }
-    async netPostString() {
-        const echo = [];
-        const res = await lNet.post(this._internalUrl + 'test/netPostString1', 'HeiHei');
-        echo.push(`<pre>lNet.post('${this._internalUrl}test/netPostString1', 'HeiHei');</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: ${JSON.stringify(res.error)}`);
-        return echo.join('') + '<br><br>' + this._getEnd();
-    }
-    netPostString1() {
-        return [1, this._input];
-    }
-    async netOpen() {
-        const echo = [];
-        const res = await lNet.open(this._internalUrl + 'test/netPost1').post().data({ 'a': '2', 'b': '0', 'c': ['0', '1', '3'] }).request();
-        echo.push(`<pre>lNet.open('${this._internalUrl}test/netPost1').post().data({ 'a': '2', 'b': '0', 'c': ['0', '1', '3'] }).request();</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: ${JSON.stringify(res.error)}`);
-        return echo.join('') + this._getEnd();
-    }
-    async netFormTest() {
-        if (!await this._handleFormData()) {
-            return '';
-        }
-        const echo = [
-            '<pre>',
-            JSON.stringify(this._post, null, 4),
-            '\n-----\n',
-            JSON.stringify(this._files, null, 4),
-            '</pre>'
-        ];
-        echo.push(`<form enctype="multipart/form-data" method="post">
-    text a: <input type="text" name="a" value="a1"> <input type="text" name="a" value="a2"><br>
-    file b: <input type="file" name="b"><br>
-    file c: <input type="file" name="c"><input type="file" name="c"><br>
-    fi d[]: <input type="file" name="d[]"><input type="file" name="d[]"><br>
-    <input type="submit" value="Upload">
-</form>
-<hr>
-<form method="post">
-    name a: <input type="text" name="a" value="a&1"> <input type="text" name="a" value="a&2"><br>
-    na b[]: <input type="text" name="b[]" value="b1"> <input type="text" name="b[]" value="b2"><br>
-    name d: <input type="text" name="d" value="d"><br>
-    <input type="submit" value="Default post">
-</form>`);
-        return echo.join('') + this._getEnd();
-    }
-    async netUpload() {
-        const echo = [];
-        const fd = lNet.getFormData();
-        fd.putString('a', '1');
-        await fd.putFile('file', kebab.LIB_PATH + 'net/cacert.pem');
-        await fd.putFile('multiple', kebab.LIB_PATH + 'net/cacert.pem');
-        await fd.putFile('multiple', kebab.LIB_PATH + 'net/cacert.pem');
-        const res = await lNet.post(this._internalUrl + 'test/net-upload1', fd);
-        echo.push(`<pre>const fd = lNet.getFormData();
-fd.putString('a', '1');
-await fd.putFile('file', def.LIB_PATH + 'net/cacert.pem');
-await fd.putFile('multiple', def.LIB_PATH + 'net/cacert.pem');
-await fd.putFile('multiple', def.LIB_PATH + 'net/cacert.pem');
-lNet.post('${this._internalUrl}test/net-upload1', fd);</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: ${JSON.stringify(res.error)}`);
-        return echo.join('') + '<br><br>' + this._getEnd();
-    }
-    async netUpload1() {
-        if (!await this._handleFormData()) {
-            return '{}';
-        }
-        return JSON.stringify(this._post, null, 4) + '\n\n' + JSON.stringify(this._files, null, 4);
-    }
-    async netCookie() {
-        const echo = [];
-        const cookie = {};
-        let res = await lNet.get(this._internalUrl + 'test/net-cookie1', {
-            'cookie': cookie
-        });
-        echo.push(`<pre>const cookie = {};
-lNet.get(this._internalUrl + 'test/net-cookie1', {
-    'cookie': cookie
-});</pre>
-headers: <pre>${lText.htmlescape(JSON.stringify(res.headers, null, 4))}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-cookie: <pre>${JSON.stringify(cookie, null, 4)}</pre><hr>`);
-        res = await lNet.get(this._internalUrl + 'test/net-cookie2', {
-            'cookie': cookie
-        });
-        echo.push(`<pre>lNet.get(this._internalUrl + 'test/net-cookie2', {
-    'cookie': cookie
-});</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>`);
-        lCookie.setCookie(cookie, 'custom1', 'abc1', this._config.const.host);
-        lCookie.setCookie(cookie, 'custom2', 'abc2', '172.17.0.1');
-        res = await lNet.get(this._internalUrl + 'test/net-cookie2', {
-            'cookie': cookie
-        });
-        echo.push(`<pre>lCookie.setCookie(cookie, 'custom1', 'abc1', ${this._config.const.host});
-lCookie.setCookie(cookie, 'custom2', 'abc2', '172.17.0.1');
-lNet.get(this._internalUrl + 'test/net-cookie2', {
-    'cookie': cookie
-});</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>`);
-        return echo.join('') + this._getEnd();
-    }
-    netCookie1() {
-        lCore.setCookie(this, 'test0', 'session');
-        lCore.setCookie(this, 'test1', 'normal', {
-            'ttl': 10
-        });
-        lCore.setCookie(this, 'test2', 'baidu.com', {
-            'ttl': 20,
-            'path': '/',
-            'domain': 'baidu.com'
-        });
-        lCore.setCookie(this, 'test3', this._config.const.hostname, {
-            'ttl': 30,
-            'path': '/',
-            'domain': this._config.const.hostname
-        });
-        lCore.setCookie(this, 'test4', '/ok/', {
-            'ttl': 40,
-            'path': '/ok/'
-        });
-        lCore.setCookie(this, 'test5', 'secure', {
-            'ttl': 50,
-            'ssl': true
-        });
-        lCore.setCookie(this, 'test6', '0.1', {
-            'ttl': 40,
-            'path': '/',
-            'domain': '0.1'
-        });
-        lCore.setCookie(this, 'test7', 'localhost', {
-            'ttl': 30,
-            'path': '/',
-            'domain': 'localhost'
-        });
-        lCore.setCookie(this, 'test8', 'com', {
-            'ttl': 20,
-            'path': '/',
-            'domain': 'com'
-        });
-        lCore.setCookie(this, 'test9', 'com.cn', {
-            'ttl': 10,
-            'path': '/',
-            'domain': 'com.cn'
-        });
-        lCore.setCookie(this, 'test10', 'httponly', {
-            'ttl': 60,
-            'httponly': true
-        });
-        // --- 用于测试 BUG 的额外 Cookie ---
-        this._res.setHeader('Set-Cookie', [
-            ...this._res.getHeader('Set-Cookie'),
-            'test-del=; Max-Age=0; Path=/',
-            'test-equals=val=with=equals; Path=/',
-            'test-expires=val; Expires=Wed, 21 Oct 2035 07:28:00 GMT; Path=/',
-            'test-invalid=%invalid; Path=/'
-        ]);
-        return `lCore.setCookie(this, 'test0', 'session');
-lCore.setCookie(this, 'test1', 'normal', {
-    'ttl': 10
-});
-lCore.setCookie(this, 'test2', 'baidu.com', {
-    'ttl': 20,
-    'path': '/',
-    'domain': 'baidu.com'
-});
-lCore.setCookie(this, 'test3', this._config.const.hostname, {
-    'ttl': 30,
-    'path': '/',
-    'domain': this._config.const.hostname
-});
-lCore.setCookie(this, 'test4', '/ok/', {
-    'ttl': 40,
-    'path': '/ok/'
-});
-lCore.setCookie(this, 'test5', 'secure', {
-    'ttl': 50,
-    'ssl': true
-});
-lCore.setCookie(this, 'test6', '0.1', {
-    'ttl': 40,
-    'path': '/',
-    'domain': '0.1'
-});
-lCore.setCookie(this, 'test7', 'localhost', {
-    'ttl': 30,
-    'path': '/',
-    'domain': 'localhost'
-});
-lCore.setCookie(this, 'test8', 'com', {
-    'ttl': 20,
-    'path': '/',
-    'domain': 'com'
-});
-lCore.setCookie(this, 'test9', 'com.cn', {
-    'ttl': 10,
-    'path': '/',
-    'domain': 'com.cn'
-});
-lCore.setCookie(this, 'test10', 'httponly', {
-    'ttl': 60,
-    'httponly': true
-});`;
-    }
-    netCookie2() {
-        return 'this._cookie: \n\n' + JSON.stringify(this._cookie, null, 4);
-    }
-    async netSave() {
-        const echo = [];
-        const res = await lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json', {
-            'follow': 5,
-            'save': kebab.LOG_CWD + 'test-must-remove.json'
-        });
-        echo.push(`<pre>lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json', {
-    'follow': 5,
-    'save': def.LOG_PATH + 'test-must-remove.json'
-});</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: ${JSON.stringify(res.error)}`);
-        return echo.join('') + this._getEnd();
-    }
-    async netFollow() {
-        const echo = [];
-        const res = await lNet.post(this._internalUrl + 'test/net-follow1', {
-            'a': '1',
-            'b': '2'
-        }, {
-            'follow': 5
-        });
-        echo.push(`<pre>lNet.post(this._internalUrl + 'test/net-follow1', {
-    'a': '1',
-    'b': '2'
-}, {
-    'follow': 5
-});</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: ${JSON.stringify(res.error)}</pre>`);
-        return echo.join('') + this._getEnd();
-    }
-    netFollow1() {
-        this._location('test/net-follow2');
-    }
-    netFollow2() {
-        return [1, { 'post': this._post['a'] + ',' + this._post['b'] }];
-    }
-    async netReuse() {
-        const echo = [];
-        echo.push('<strong>Reuse:</strong>');
-        let time0 = Date.now();
-        await lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json');
-        let time1 = Date.now();
-        echo.push("<pre>lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/package.json');</pre>" + Math.round(time1 - time0).toString() + 'ms.');
-        time0 = Date.now();
-        await lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/README.md');
-        time1 = Date.now();
-        echo.push("<pre>lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/README.md');</pre>" + Math.round(time1 - time0).toString() + 'ms.');
-        time0 = Date.now();
-        await lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/LICENSE');
-        time1 = Date.now();
-        echo.push("<pre>lNet.get('https://cdn.jsdelivr.net/npm/deskrt@2.0.10/LICENSE');</pre>" + Math.round(time1 - time0).toString() + 'ms.<hr>');
-        return echo.join('') + this._getEnd();
-    }
-    async netError() {
-        const echo = [];
-        const res = await lNet.get('https://192.111.000.222/xxx.zzz');
-        echo.push(`<pre>lNet.get('https://192.111.000.222/xxx.zzz');</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-error: <pre>${JSON.stringify(res.error, null, 4)}</pre>`);
-        return echo.join('') + this._getEnd();
-    }
-    async netHosts() {
-        const echo = [];
-        const res = await lNet.get('http://nodejs.org:' + this._config.const.hostport.toString() + this._config.const.urlBase + 'test', {
-            'hosts': {
-                'nodejs.org': '127.0.0.1'
-            }
-        });
-        echo.push(`<pre>lNet.get('http://nodejs.org:${this._config.const.hostport.toString() + this._config.const.urlBase}test', {
-    'hosts': {
-        'nodejs.org': '127.0.0.1'
-    }
-});</pre>
-headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-content: <pre>${lText.htmlescape((await res.getContent())?.toString() ?? '')}</pre>
-error: <pre>${JSON.stringify(res.error, null, 4)}</pre>`);
-        return echo.join('') + this._getEnd();
-    }
-    async netMproxy() {
-        const echo = [];
-        const res = await lNet.postJson(this._internalUrl + 'test/net-mproxy2', {
-            'abc': 'ok',
-        }, {
-            'mproxy': {
-                'url': this._internalUrl + 'test/net-mproxy1',
-                'auth': '123456',
-                'data': { 'test': '123' },
-            }
-        });
-        echo.push(`<pre>lNet.get('${this._internalUrl}test/net-mproxy2', {
-    'mproxy': {
-        'url': '${this._internalUrl}test/net-mproxy1',
-        'auth': '123456',
-        'data': { 'test': '123' },
-    }
-});</pre>
-        headers: <pre>${JSON.stringify(res.headers, null, 4)}</pre>
-        content: <pre>${(await res.getContent())?.toString() ?? 'null'}</pre>
-        error: ${JSON.stringify(res.error)}`);
-        return echo.join('') + '<br><br>' + this._getEnd();
-    }
-    async netMproxy1() {
-        const data = lNet.mproxyData(this);
-        lCore.debug('Got data', data);
-        const rtn = await lNet.mproxy(this, '123456');
-        if (rtn > 0) {
-            return false;
-        }
-        return 'Nothing(' + rtn + ')';
-    }
-    netMproxy2() {
-        return [1, {
-                'data': this._post,
-            }];
-    }
-    netFilterheaders() {
-        const echo = [];
-        const headers = {
-            'host': 'www.maiyun.net',
-            'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/180.0.0.0 Safari/537.36',
-            'accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7',
-            'accept-encoding': 'gzip, deflate',
-            'accept-language': 'zh-CN,zh;q=0.9,en;q=0.8',
-            'cache-control': 'no-cache',
-            'cdn-loop': 'TencentEdgeOne; loops=2',
-            'eo-connecting-ip': 'xx:xx:xx:xx:xx',
-            'eo-log-uuid': '102780998859203995',
-            'pragma': 'no-cache',
-            'priority': 'u=0, i',
-            'sec-ch-ua': '"Chromium";v="140", "Not=A?Brand";v="24", "Google Chrome";v="180"',
-            'sec-ch-ua-mobile': '?0',
-            'sec-ch-ua-platform': '"Windows"',
-            'sec-fetch-dest': 'document',
-            'sec-fetch-mode': 'navigate',
-            'sec-fetch-site': 'none',
-            'sec-fetch-user': '?1',
-            'upgrade-insecure-requests': '1',
-            'x-forwarded-for': '127.1.2.3',
-            'x-forwarded-host': 'www.maiyun.net',
-            'x-forwarded-proto': 'http',
-            'authorization': ''
-        };
-        echo.push(`origin:<pre>${JSON.stringify(headers, null, 4)}</pre>`);
-        const filtered = lNet.filterHeaders(headers, undefined, h => {
-            return !['x-', 'eo-'].some(i => h.startsWith(i));
-        });
-        echo.push(`const filtered = lNet.filterHeaders(headers);<pre>${JSON.stringify(filtered, null, 4)}</pre>`);
-        return echo.join('') + this._getEnd();
-    }
-    async netFetch() {
-        const echo = [];
-        try {
-            const res = await lNet.fetch(this._internalUrl + 'test/net-fetch1', {
-                'method': 'POST',
-                'headers': {
-                    'content-type': 'application/json',
-                },
-                'body': JSON.stringify({ 'test': '123' }),
-            });
-            echo.push(`<pre>lNet.fetch('${this._internalUrl}test/net-fetch1', {
-    'method': 'POST',
-    'headers': {
-        'content-type': 'application/json',
-    },
-    'body': JSON.stringify({ 'test': '123' }),
-});</pre>
-            headers: <pre>${JSON.stringify(Object.fromEntries(res.headers.entries()), null, 4)}</pre>
-            content: <pre>${await res.text()}</pre>`);
-        }
-        catch (e) {
-            echo.push(`error: <pre>${JSON.stringify(e)}</pre>`);
-        }
-        echo.push(`mproxy:`);
-        try {
-            const res = await lNet.fetch(this._internalUrl + 'test/net-fetch1', {
-                'method': 'POST',
-                'headers': {
-                    'content-type': 'application/json',
-                },
-                'body': JSON.stringify({ 'test': '456' }),
-                'mproxy': {
-                    'url': this._internalUrl + 'test/net-mproxy1',
-                    'auth': '123456',
-                    'data': { 'test': '789' },
-                },
-            });
-            echo.push(`<pre>lNet.fetch('${this._internalUrl}test/net-fetch1', {
-    'method': 'POST',
-    'headers': {
-        'content-type': 'application/json',
-    },
-    'body': JSON.stringify({ 'test': '123' }),
-    'mproxy': {
-        'url': this._internalUrl + 'test/net-mproxy1',
-        'auth': '123456',
-        'data': { 'test': '789' },
-    },
-});</pre>
-            headers: <pre>${JSON.stringify(Object.fromEntries(res.headers.entries()), null, 4)}</pre>
-            content: <pre>${await res.text()}</pre>`);
-        }
-        catch (e) {
-            echo.push(`error: <pre>${JSON.stringify(e)}</pre>`);
-        }
-        return echo.join('') + '<br>' + this._getEnd();
-    }
-    netFetch1() {
-        return [1, {
-                'post': this._post,
-            }];
-    }
-    async netGetResponseJson() {
-        const echo = [];
-        const json = await lNet.getResponseJson(this._internalUrl + 'test/get-response-json1');
-        echo.push(`<pre>const json = await lNet.getResponseJson('${this._internalUrl}test/get-response-json1');</pre>
-result: <pre>${lText.htmlescape(JSON.stringify(json, null, 4))}</pre>`);
-        const json2 = await lNet.getResponseJson(this._internalUrl + 'test/get-response-json2');
-        echo.push(`<pre>const json2 = await lNet.getResponseJson('${this._internalUrl}test/get-response-json2');</pre>
-result: <pre>${lText.htmlescape(JSON.stringify(json2, null, 4))}</pre>`);
-        return echo.join('') + '<br><br>' + this._getEnd();
-    }
     getResponseJson1() {
         return [1, {
                 'data': 'This is test data from getResponseJson1',
@@ -4730,6 +4236,70 @@ send.addEventListener('click', async () => {
         echo.push(`Response CORS Headers: <pre>${JSON.stringify(headers, null, 4)}</pre>`);
         return echo.join('') + '<br><br>' + this._getEnd();
     }
+    /**
+     * --- 文件上传限制演示页面 ---
+     */
+    ctrUploadLimits() {
+        const urlBase = this._config.const.urlBase;
+        return `
+<b>File Upload Limits Demo</b><br><br>
+<b>Rules:</b>
+<ul>
+<li>Allowed extensions: <code>.jpg</code>, <code>.png</code>, <code>.pdf</code></li>
+<li>Max file size: <code>100 KB</code></li>
+<li>If any file is rejected, the entire upload is rejected (returns <code>false</code>)</li>
+</ul>
+<b>Test cases:</b>
+<ol>
+<li>Upload a <code>.jpg</code> under 100KB → should succeed</li>
+<li>Upload a <code>.exe</code> → should be rejected (extension)</li>
+<li>Upload a <code>.jpg</code> over 100KB → should be rejected (size)</li>
+<li>Upload 2 files: one valid + one invalid → should reject entire upload</li>
+</ol>
+<form id="uploadForm" enctype="multipart/form-data">
+<input type="file" id="fileInput" multiple><br><br>
+<input type="button" value="Upload" onclick="doUpload()">
+</form>
+Result:<pre id="result">Nothing.</pre>
+<script>
+function doUpload() {
+    var fd = new FormData();
+    var files = document.getElementById('fileInput').files;
+    for (var i = 0; i < files.length; i++) {
+        fd.append('file' + i, files[i]);
+    }
+    document.getElementById('result').innerText = 'Uploading...';
+    fetch('${urlBase}test/ctr-upload-limits1', {
+        method: 'POST',
+        body: fd
+    }).then(function(r) { return r.text(); }).then(function(t) {
+        document.getElementById('result').innerText = t;
+    }).catch(function(e) {
+        document.getElementById('result').innerText = 'Error: ' + e.message;
+    });
+}
+</script>` + this._getEnd();
+    }
+    /**
+     * --- 文件上传限制演示接口 ---
+     */
+    async ctrUploadLimits1() {
+        const rtn = await this._handleFormData({}, {
+            'maxFileSize': 100 * 1024,
+            'allowedExts': ['.jpg', '.png', '.pdf'],
+        });
+        if (!rtn) {
+            return [0, 'Upload rejected. File extension not allowed or size exceeds 100KB limit.'];
+        }
+        const fileSummary = {};
+        for (const key in this._files) {
+            const f = this._files[key];
+            fileSummary[key] = Array.isArray(f)
+                ? f.map(item => ({ 'name': item.name, 'size': item.size }))
+                : { 'name': f.name, 'size': f.size };
+        }
+        return [1, { 'files': fileSummary, 'post': this._post }];
+    }
     /**
      * --- END ---
      */