odac 1.4.14 → 1.4.16

package/src/Request.js

@@ -1,10 +1,17 @@
 const nodeCrypto = require('crypto')
+const fs = require('fs')
+const fsPromises = fs.promises
+const path = require('path')
+const os = require('os')
 
 class OdacRequest {
   #odac
   #complete = false
   #cookies = {data: {}, sent: []}
   data = {post: {}, get: {}, url: {}}
+  #files = {}
+  #activeWrites = new Set()
+  #cleanedUp = false
   #event = {data: [], end: []}
   #headers = {Server: 'Odac'}
   #status = 200
@@ -36,16 +43,25 @@ class OdacRequest {
     if (!global.Odac.Route.routes[route]) route = 'www'
     this.route = route
     if (this.res) {
-      if (typeof this.#odac.setTimeout === 'function') {
-        this.#timeout = this.#odac.setTimeout(() => !this.res.finished && this.abort(408), global.Odac.Config.request.timeout)
-      } else {
-        this.#timeout = setTimeout(() => !this.res.finished && this.abort(408), global.Odac.Config.request.timeout)
-      }
+      this.#armTimeout()
+      // Client disconnected before we responded (e.g. aborted upload): drop temp files.
+      if (typeof this.res.on === 'function') this.res.on('close', () => this.#cleanupFiles())
     }
     this.#data()
     if (!global.Odac.Request) global.Odac.Request = {}
   }
 
+  // (Re)arm the idle timeout. Called once at construction and again on every
+  // upload data chunk so a slow-but-progressing upload isn't killed at the
+  // fixed timeout; the timer now measures idle time, not total request time.
+  #armTimeout() {
+    if (!this.res || this.res.finished) return
+    clearTimeout(this.#timeout)
+    const fn = () => !this.res.finished && this.abort(408)
+    const ms = global.Odac.Config.request.timeout
+    this.#timeout = typeof this.#odac.setTimeout === 'function' ? this.#odac.setTimeout(fn, ms) : setTimeout(fn, ms)
+  }
+
   // - ABORT REQUEST
   async abort(code) {
     this.status(code)
@@ -100,50 +116,41 @@ class OdacRequest {
         this.data.get[key] = val
       }
     }
+
+    const contentType = this.req.headers['content-type'] || ''
+    if (contentType.startsWith('multipart/form-data')) {
+      return this.#multipart()
+    }
+
+    // Non-multipart: urlencoded or JSON (buffered path)
     let body = ''
     this.req.on('data', chunk => {
       body += chunk.toString()
-      if (body.length > 1e6) {
+      const maxBodySize = global.Odac.Config.request.maxBodySize
+      if (body.length > maxBodySize) {
         body = ''
         this.status(413)
         this.end()
-      } else {
-        if (body.length > 0 && body.indexOf('Content-Disposition') === -1) return
-        if (body.indexOf('Content-Disposition') > -1) {
-          let boundary = body.split('\r\n')[0]
-          if (boundary.includes('boundary=')) {
-            try {
-              boundary = boundary.split('boundary=')[1].split(';')[0].trim()
-            } catch {
-              // ignore
-            }
-          }
-          let data = body.split(boundary)
-          for (let i = 0; i < data.length; i++) {
-            if (data[i].indexOf('Content-Disposition') === -1) continue
-            let key = data[i].split('name="')[1].split('"')[0]
-            let val = data[i].split('\r\n\r\n')[1].split('\r\n')[0]
-            this.data.post[key] = val
-          }
-        } else {
-          let data = body.split('&')
-          for (let i = 0; i < data.length; i++) {
-            if (data[i].indexOf('=') === -1) continue
-            let key = decodeURIComponent(data[i].split('=')[0])
-            let val = decodeURIComponent(data[i].split('=')[1] || '')
-            this.data.post[key] = val
-          }
-        }
+        this.req.removeAllListeners('data')
+        this.req.resume()
+        this.#complete = true
+        return
       }
+
       for (const event of this.#event.data) {
         event.callback(event.active ? chunk : body)
         event.active = true
       }
     })
+
     this.req.on('end', () => {
       if (!body) return (this.#complete = true)
       if (body.startsWith('{') && body.endsWith('}')) {
-        this.data.post = JSON.parse(body)
+        try {
+          this.data.post = JSON.parse(body)
+        } catch {
+          // invalid JSON, ignore
+        }
       } else {
         let data = body.split('&')
         for (let i = 0; i < data.length; i++) {
@@ -158,6 +165,161 @@ class OdacRequest {
     })
   }
 
+  async #multipart() {
+    const cfg = global.Odac.Config.request
+    const busboy = require('busboy')
+
+    const uploadDir = cfg.uploadDir || path.join(os.tmpdir(), 'odac-uploads')
+    try {
+      await fsPromises.mkdir(uploadDir, {recursive: true})
+    } catch (err) {
+      console.error('Failed to create upload directory:', err.message)
+      this.status(500)
+      this.end()
+      this.#complete = true
+      return
+    }
+
+    const bb = busboy({
+      headers: this.req.headers,
+      defParamCharset: 'utf8',
+      limits: {fileSize: cfg.maxFileSize, files: cfg.maxFiles, fieldSize: cfg.maxBodySize, fields: 200}
+    })
+
+    // busboy 'close' can fire before our writeStreams flush to disk, so a file
+    // isn't complete until BOTH the parser closed and every pending write ended.
+    // Otherwise req.file() could resolve before #files is populated.
+    let bbClosed = false
+    const finalize = () => {
+      if (this.#complete || !bbClosed || this.#activeWrites.size > 0) return
+      this.#complete = true
+      for (const event of this.#event.end) event.callback()
+    }
+
+    bb.on('field', (name, val) => {
+      this.data.post[name] = val
+    })
+
+    bb.on('file', (fieldname, stream, info) => {
+      // Empty optional file input: browsers send filename === '' for untouched input
+      if (!info.filename) {
+        stream.resume()
+        return
+      }
+
+      const fileExt = path.extname(info.filename).toLowerCase().slice(1) || 'bin'
+      const tmpPath = path.join(uploadDir, `odac-${nodeCrypto.randomBytes(16).toString('hex')}`)
+      const writeStream = fs.createWriteStream(tmpPath)
+
+      const active = {writeStream, tmpPath}
+      this.#activeWrites.add(active)
+
+      let fileSize = 0
+      let truncated = false
+
+      stream.on('data', chunk => {
+        fileSize += chunk.length
+      })
+
+      // busboy stops feeding data once fileSize limit is hit and lets the
+      // stream end naturally; just flag it so the writeStream 'finish' handler
+      // can drop the partial file and record a truncated metadata object.
+      stream.on('limit', () => {
+        truncated = true
+      })
+
+      stream.pipe(writeStream)
+
+      writeStream.on('finish', () => {
+        this.#activeWrites.delete(active)
+
+        // Oversize file: remove the partial write but still surface metadata so
+        // the validator reports a per-field "too large" error instead of hanging.
+        if (truncated) fs.unlink(tmpPath, () => {})
+
+        const fileObj = {
+          field: fieldname,
+          name: path.basename(info.filename),
+          ext: fileExt,
+          mimetype: info.mimeType,
+          size: fileSize,
+          path: truncated ? null : tmpPath,
+          truncated: truncated,
+          stored: false,
+          move: async dest => this.#moveFile(fileObj, dest)
+        }
+
+        if (!Array.isArray(this.#files[fieldname])) {
+          this.#files[fieldname] = []
+        }
+        this.#files[fieldname].push(fileObj)
+        finalize()
+      })
+
+      writeStream.on('error', () => {
+        this.#activeWrites.delete(active)
+        stream.resume()
+        fs.unlink(tmpPath, () => {})
+        finalize()
+      })
+    })
+
+    bb.on('close', () => {
+      bbClosed = true
+      finalize()
+    })
+
+    bb.on('error', err => {
+      if (this.#complete) return
+      console.error('Busboy error:', err.message)
+      this.#complete = true
+      for (const event of this.#event.end) event.callback()
+      // Malformed multipart body: send 400 instead of letting the handler run on
+      // partial data. #complete is already set so any pending req.file()/request()
+      // pollers resolve, and res.finished blocks any later controller response.
+      this.abort(400)
+    })
+
+    // Keep the timeout as an *idle* deadline: reset it while upload data keeps
+    // arriving so large-but-progressing uploads aren't aborted at 408.
+    this.req.on('data', () => this.#armTimeout())
+    this.req.pipe(bb)
+  }
+
+  // Move the uploaded temp file to a permanent, caller-chosen location. The
+  // destination is developer-controlled (like any fs call): if you build it from
+  // raw user input, sanitize it yourself — the file object's own `.name` is
+  // already basename-only. Handles cross-device moves via copy+unlink fallback.
+  async #moveFile(fileObj, dest) {
+    if (!fileObj.path || fileObj.stored) {
+      throw new Error('Cannot move a truncated or already-moved file')
+    }
+
+    const resolved = path.resolve(dest)
+
+    try {
+      await fsPromises.mkdir(path.dirname(resolved), {recursive: true})
+    } catch {
+      // directory may already exist
+    }
+
+    try {
+      await fsPromises.rename(fileObj.path, resolved)
+    } catch (err) {
+      if (err.code === 'EXDEV') {
+        // Source and destination are on different filesystems: copy then remove.
+        await fsPromises.copyFile(fileObj.path, resolved)
+        await fsPromises.unlink(fileObj.path)
+      } else {
+        throw err
+      }
+    }
+
+    fileObj.path = resolved
+    fileObj.stored = true
+    return resolved
+  }
+
   // - RETURN REQUEST
   end(data) {
     if (data instanceof Promise) return data.then(result => this.end(result))
@@ -172,9 +334,32 @@ class OdacRequest {
     clearTimeout(this.#timeout)
     this.print()
     this.res.end(data)
+    this.#cleanupFiles()
     this.req.connection.destroy()
   }
 
+  // Remove temp files that were never moved to permanent storage. Runs after a
+  // normal response (end) and on early client disconnect (res 'close'), covering
+  // both in-progress writes (aborted mid-upload) and finished-but-unstored files.
+  #cleanupFiles() {
+    if (this.#cleanedUp) return
+    this.#cleanedUp = true
+
+    for (const active of this.#activeWrites) {
+      active.writeStream.destroy()
+      fs.unlink(active.tmpPath, () => {})
+    }
+    this.#activeWrites.clear()
+
+    for (const fieldFiles of Object.values(this.#files)) {
+      for (const file of fieldFiles) {
+        if (!file.stored && file.path) {
+          fs.unlink(file.path, () => {})
+        }
+      }
+    }
+  }
+
   // - GET
   get(key) {
     return this.variables[key] ? this.variables[key].value : null
@@ -242,6 +427,22 @@ class OdacRequest {
     })
   }
 
+  // - GET FILE
+  async file(name) {
+    const resolveFiles = () => {
+      if (!name) return this.#files
+      const arr = this.#files[name]
+      if (!arr || arr.length === 0) return null
+      return arr.length === 1 ? arr[0] : arr
+    }
+    if (this.#complete) return resolveFiles()
+    return new Promise(resolve => {
+      this.#event.end.push({
+        callback: () => resolve(resolveFiles())
+      })
+    })
+  }
+
   setSession() {
     if (!this.cookie('odac_client') || !this.session('_client') || this.session('_client') !== this.cookie('odac_client')) {
       let client = nodeCrypto.randomBytes(16).toString('hex')

package/src/Route/Internal.js

@@ -4,7 +4,7 @@ class Internal {
   static #validateField(validator, field, validation, value) {
     const rules = validation.rule.split('|')
     for (const rule of rules) {
-      const validatorChain = validator.post(field.name).check(rule)
+      const validatorChain = (field.type === 'file' ? validator.file(field.name) : validator.post(field.name)).check(rule)
       if (validation.message) {
         const message = this.replacePlaceholders(validation.message, {
           value: value,
@@ -71,6 +71,8 @@ class Internal {
     const uniqueFields = []
 
     for (const field of config.fields) {
+      if (field.type === 'file') continue
+
       const value = await Odac.request(field.name)
 
       for (const validation of field.validations) {
@@ -408,7 +410,7 @@ class Internal {
     const uniqueFields = []
 
     for (const field of config.fields) {
-      const value = await Odac.request(field.name)
+      const value = field.type === 'file' ? await Odac.file(field.name) : await Odac.request(field.name)
 
       for (const validation of field.validations) {
         this.#validateField(validator, field, validation, value)
@@ -420,7 +422,8 @@ class Internal {
         }
       }
 
-      if (!field.skip) {
+      // File fields excluded from data bag; controllers access via formHelper.file()
+      if (!field.skip && field.type !== 'file') {
         data[field.name] = value
       }
     }
@@ -498,6 +501,8 @@ class Internal {
     if (Odac.formConfig.table) {
       try {
         const table = Odac.DB[Odac.formConfig.table]
+        const path = require('path')
+        const os = require('os')
 
         for (const field of Odac.formUniqueFields) {
           if (Odac.formData[field.name] == null) continue
@@ -513,6 +518,26 @@ class Internal {
           }
         }
 
+        // Auto-store file fields for table forms. Skipped fields are validated
+        // but excluded from persistence (mirrors `skip` for text fields); their
+        // temp files are cleaned up by Request when the response is sent.
+        const uploadDir = global.Odac.Config.request.uploadDir || path.join(os.tmpdir(), 'odac-uploads')
+        for (const field of Odac.formConfig.fields) {
+          if (field.type !== 'file' || field.skip) continue
+
+          const file = await Odac.file(field.name)
+          if (!file) continue
+
+          const files = Array.isArray(file) ? file : [file]
+          const storedPaths = []
+          for (const f of files) {
+            const rel = path.join(Odac.formConfig.table, `${nodeCrypto.randomBytes(8).toString('hex')}.${f.ext}`)
+            await f.move(path.join(uploadDir, rel))
+            storedPaths.push(rel)
+          }
+          Odac.formData[field.name] = Array.isArray(file) ? JSON.stringify(storedPaths) : storedPaths[0]
+        }
+
         await table.insert(Odac.formData)
 
         Odac.Request.session(`_custom_form_${token}`, null)
@@ -556,6 +581,10 @@ class Internal {
             const formHelper = {
               data: Odac.formData,
 
+              file: name => {
+                return Odac.file(name)
+              },
+
               error: (field, message) => {
                 return Odac.return({
                   result: {success: false},

package/src/Validator.js

@@ -173,11 +173,27 @@ class Validator {
           let error = false
           let rules = checkItem.rules
 
+          // Normalize file value to array
+          let files = []
+          if (method === 'FILES') {
+            if (Array.isArray(value)) {
+              files = value
+            } else if (value) {
+              files = [value]
+            }
+            // Implicit server-limit guard: truncated files always fail
+            if (files.some(f => f.truncated)) {
+              error = true
+              this.#message[key] = checkItem.message
+              continue
+            }
+          }
+
           if (typeof rules === 'boolean') {
             error = rules === false
           } else {
             for (const rule of rules.includes('|') ? rules.split('|') : [rules]) {
-              let vars = rule.split(':')
+              let vars = rule.split(/:(.+)/)
               let ruleName = vars[0].trim()
               let inverse = ruleName.startsWith('!')
               if (inverse) ruleName = ruleName.substr(1)
@@ -185,7 +201,11 @@ class Validator {
               if (!error) {
                 switch (ruleName) {
                   case 'required':
-                    error = value === undefined || value === '' || value === null
+                    if (method === 'FILES') {
+                      error = files.length === 0
+                    } else {
+                      error = value === undefined || value === '' || value === null
+                    }
                     break
                   case 'accepted':
                     error = !value || (value !== 1 && value !== '1' && value !== 'on' && value !== 'yes' && value !== true)
@@ -300,6 +320,35 @@ class Validator {
                   case 'disposable':
                     error = value && value !== '' && !(await Validator.isDisposable(value))
                     break
+                  case 'maxsize':
+                    if (method === 'FILES' && vars[1]) {
+                      const maxBytes = this.#parseSize(vars[1])
+                      error = files.some(f => f.size > maxBytes)
+                    }
+                    break
+                  case 'minsize':
+                    if (method === 'FILES' && vars[1]) {
+                      const minBytes = this.#parseSize(vars[1])
+                      error = files.some(f => f.size < minBytes)
+                    }
+                    break
+                  case 'mimetype':
+                  case 'accept':
+                    if (method === 'FILES' && vars[1] && files.length > 0) {
+                      error = !(await this.#validateMimetype(files, vars[1]))
+                    }
+                    break
+                  case 'ext':
+                    if (method === 'FILES' && vars[1] && files.length > 0) {
+                      const allowedExts = vars[1].split(',').map(e => e.trim().toLowerCase())
+                      error = !files.every(f => allowedExts.includes(f.ext))
+                    }
+                    break
+                  case 'maxfiles':
+                    if (method === 'FILES' && vars[1]) {
+                      error = files.length > parseInt(vars[1])
+                    }
+                    break
                 }
                 if (inverse) error = !error
               }
@@ -316,6 +365,98 @@ class Validator {
     this.#completed = true
   }
 
+  #parseSize(sizeStr) {
+    const match = sizeStr.match(/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB)?$/i)
+    if (!match) return 0
+    let bytes = parseFloat(match[1])
+    const unit = (match[2] || 'B').toUpperCase()
+    const multipliers = {B: 1, KB: 1024, MB: 1024 * 1024, GB: 1024 * 1024 * 1024}
+    return Math.floor(bytes * (multipliers[unit] || 1))
+  }
+
+  async #validateMimetype(files, mimeStr) {
+    const allowedTypes = mimeStr.split(',').map(m => m.trim().toLowerCase())
+    const extToMimeMap = {
+      jpg: 'image/jpeg',
+      jpeg: 'image/jpeg',
+      png: 'image/png',
+      gif: 'image/gif',
+      webp: 'image/webp',
+      svg: 'image/svg+xml',
+      pdf: 'application/pdf',
+      txt: 'text/plain',
+      csv: 'text/csv',
+      zip: 'application/zip',
+      mp4: 'video/mp4',
+      mp3: 'audio/mpeg',
+      doc: 'application/msword',
+      docx: 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
+      xls: 'application/vnd.ms-excel',
+      xlsx: 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'
+    }
+    for (const file of files) {
+      const claimed = (file.mimetype || '').toLowerCase()
+      const extMime = extToMimeMap[file.ext] || 'application/octet-stream'
+      let allowed = false
+      for (const type of allowedTypes) {
+        if (type === claimed || type === extMime) {
+          allowed = true
+          break
+        }
+        if (type.endsWith('/*')) {
+          const prefix = type.slice(0, -2)
+          if (claimed.startsWith(prefix) || extMime.startsWith(prefix)) {
+            allowed = true
+            break
+          }
+        }
+      }
+      if (!allowed) return false
+
+      // Content sniffing: if the file's own extension is a raster format we have
+      // a signature for, verify the bytes match to catch a renamed/spoofed file
+      // (e.g. a script uploaded as photo.png). Formats without a known signature
+      // (svg, pdf, office docs, ...) fall back to extension + claimed MIME.
+      if (file.path) {
+        const sniff = await this.#sniffImage(file.path, file.ext)
+        if (sniff === false) return false
+      }
+    }
+    return true
+  }
+
+  // Returns true if the file's leading bytes match the expected signature for
+  // its extension, false if it's a known raster type but the bytes don't match,
+  // and null if the extension has no signature we sniff (caller should skip).
+  async #sniffImage(filePath, ext) {
+    const format = ext === 'jpg' ? 'jpeg' : ext
+    if (!['jpeg', 'png', 'gif', 'webp'].includes(format)) return null
+
+    let buf
+    let fd
+    try {
+      fd = await require('fs').promises.open(filePath, 'r')
+      buf = Buffer.alloc(12)
+      await fd.read(buf, 0, 12, 0)
+    } catch {
+      return null // unreadable: don't fail validation on a sniff error
+    } finally {
+      if (fd) await fd.close().catch(() => {})
+    }
+
+    switch (format) {
+      case 'jpeg':
+        return buf.subarray(0, 3).equals(Buffer.from([0xff, 0xd8, 0xff]))
+      case 'png':
+        return buf.subarray(0, 4).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47]))
+      case 'gif':
+        return buf.subarray(0, 4).equals(Buffer.from([0x47, 0x49, 0x46, 0x38]))
+      case 'webp':
+        // RIFF container + "WEBP" fourCC at offset 8 (distinguishes from AVI/WAV)
+        return buf.subarray(0, 4).toString('latin1') === 'RIFF' && buf.subarray(8, 12).toString('latin1') === 'WEBP'
+    }
+  }
+
   static async isDisposable(email) {
     if (!email || typeof email !== 'string') return false
     await loadDisposableDomains()

package/src/View/Form.js

@@ -173,6 +173,7 @@ class Form {
     attrs += ` novalidate`
     if (config.id) attrs += ` id="${this.escapeHtml(config.id)}"`
     if (type === 'form' && config.clear !== undefined) attrs += ` clear="${config.clear}"`
+    if (config.fields && config.fields.some(f => f.type === 'file')) attrs += ` enctype="multipart/form-data"`
 
     let html = `<form ${attrs}>\n`
     html += `  <input type="hidden" name="${meta.tokenInputName}" value="${this.escapeHtml(token)}">\n`
@@ -537,6 +538,9 @@ class Form {
       html += `<textarea${idAttr} name="${escapedName}" placeholder="${escapedPlaceholder}"${classAttr}${attrs}>${this.escapeHtmlPreservingTemplates(
         field.value || ''
       )}</textarea>\n`
+    } else if (field.type === 'file') {
+      const attrs = this.buildHtml5Attributes(field)
+      html += `<input type="file"${idAttr} name="${escapedName}"${classAttr}${attrs}>\n`
     } else {
       const attrs = this.buildHtml5Attributes(field)
       html += `<input type="${escapedType}"${idAttr} name="${escapedName}"${valueAttr} placeholder="${escapedPlaceholder}"${classAttr}${attrs}>\n`
@@ -545,6 +549,15 @@ class Form {
     return html
   }
 
+  static #parseSizeStatic(sizeStr) {
+    const match = sizeStr.match(/^(\d+(?:\.\d+)?)\s*(B|KB|MB|GB)?$/i)
+    if (!match) return 0
+    let bytes = parseFloat(match[1])
+    const unit = (match[2] || 'B').toUpperCase()
+    const multipliers = {B: 1, KB: 1024, MB: 1024 * 1024, GB: 1024 * 1024 * 1024}
+    return Math.floor(bytes * (multipliers[unit] || 1))
+  }
+
   static appendExtraAttributes(attrs, field) {
     if (!field.extraAttributes) return attrs
     for (const key in field.extraAttributes) {
@@ -624,6 +637,45 @@ class Form {
               if (validation.message) errorMessages.required = validation.message
             }
             break
+          case 'maxsize':
+            if (field.type === 'file') {
+              const maxBytes = this.#parseSizeStatic(ruleValue)
+              attrs += ` data-maxsize="${maxBytes}"`
+              if (validation.message) errorMessages.maxsize = validation.message
+            }
+            break
+          case 'minsize':
+            if (field.type === 'file') {
+              const minBytes = this.#parseSizeStatic(ruleValue)
+              attrs += ` data-minsize="${minBytes}"`
+              if (validation.message) errorMessages.minsize = validation.message
+            }
+            break
+          case 'mimetype':
+          case 'accept':
+            if (field.type === 'file') {
+              attrs += ` accept="${this.escapeHtml(ruleValue)}"`
+              if (validation.message) errorMessages.accept = validation.message
+            }
+            break
+          case 'ext':
+            if (field.type === 'file') {
+              const exts = ruleValue
+                .split(',')
+                .map(e => e.trim())
+                .map(e => (e.startsWith('.') ? e : '.' + e))
+                .join(',')
+              attrs += ` accept="${this.escapeHtml(exts)}"`
+              if (validation.message) errorMessages.accept = validation.message
+            }
+            break
+          case 'maxfiles':
+            if (field.type === 'file' && parseInt(ruleValue) > 1) {
+              attrs += ` multiple`
+              attrs += ` data-maxfiles="${this.escapeHtml(ruleValue)}"`
+              if (validation.message) errorMessages.maxfiles = validation.message
+            }
+            break
         }
       }
     }
@@ -640,6 +692,10 @@ class Form {
     if (errorMessages.maxlength) attrs += ` data-error-maxlength="${this.escapeHtml(errorMessages.maxlength)}"`
     if (errorMessages.pattern) attrs += ` data-error-pattern="${this.escapeHtml(errorMessages.pattern)}"`
     if (errorMessages.email) attrs += ` data-error-email="${this.escapeHtml(errorMessages.email)}"`
+    if (errorMessages.maxsize) attrs += ` data-error-maxsize="${this.escapeHtml(errorMessages.maxsize)}"`
+    if (errorMessages.minsize) attrs += ` data-error-minsize="${this.escapeHtml(errorMessages.minsize)}"`
+    if (errorMessages.accept) attrs += ` data-error-accept="${this.escapeHtml(errorMessages.accept)}"`
+    if (errorMessages.maxfiles) attrs += ` data-error-maxfiles="${this.escapeHtml(errorMessages.maxfiles)}"`
 
     return this.appendExtraAttributes(attrs, field)
   }