Safe multipart uploads using temp files (bounded memory)

                  package api

import (
  "io"
  "net/http"
  "os"
)

func Upload(w http.ResponseWriter, r *http.Request) {
  r.Body = http.MaxBytesReader(w, r.Body, 20<<20) // 20 MiB
  if err := r.ParseMultipartForm(20 << 20); err != nil {
    http.Error(w, "invalid upload", http.StatusBadRequest)
    return
  }

  f, _, err := r.FormFile("file")
  if err != nil {
    http.Error(w, "missing file", http.StatusBadRequest)
    return
  }
  defer f.Close()

  tmp, err := os.CreateTemp("", "upload-*")
  if err != nil {
    http.Error(w, "server error", http.StatusInternalServerError)
    return
  }
  defer os.Remove(tmp.Name())
  defer tmp.Close()

  if _, err := io.Copy(tmp, f); err != nil {
    http.Error(w, "failed to save", http.StatusInternalServerError)
    return
  }

  w.WriteHeader(http.StatusCreated)
}