Merge pull request #4090 from alphagov/limit-csv-file-size-177535141

Reject CSV / Spreadsheet files larger than 10Mb

app/main/forms.py

@@ -9,6 +9,7 @@ from flask_login import current_user
 from flask_wtf import FlaskForm as Form
 from flask_wtf.file import FileAllowed
 from flask_wtf.file import FileField as FileField_wtf
+from flask_wtf.file import FileSize
 from notifications_utils.columns import Columns
 from notifications_utils.countries.data import Postage
 from notifications_utils.formatters import strip_all_whitespace
@@ -1512,8 +1513,14 @@ class ChangePasswordForm(StripWhitespaceForm):
 
 
 class CsvUploadForm(StripWhitespaceForm):
-    file = FileField('Add recipients', validators=[DataRequired(
-        message='Please pick a file'), CsvFileValidator()])
+    file = FileField('Add recipients', validators=[
+        DataRequired(message='Please pick a file'),
+        CsvFileValidator(),
+        FileSize(
+            max_size=10e6,  # 10Mb
+            message='File must be smaller than 10Mb'
+        )
+    ])
 
 
 class ChangeNameForm(StripWhitespaceForm):

tests/app/main/views/test_send.py

@@ -5,6 +5,7 @@ from glob import glob
 from io import BytesIO
 from itertools import repeat
 from os import path
+from random import randbytes
 from unittest.mock import ANY
 from uuid import uuid4
 from zipfile import BadZipFile
@@ -966,6 +967,25 @@ def test_upload_csv_invalid_extension(
     assert "invalid.txt is not a spreadsheet that Notify can read" in resp.get_data(as_text=True)
 
 
+def test_upload_csv_size_too_big(
+    logged_in_client,
+    mock_login,
+    service_one,
+    mock_get_service_template,
+    fake_uuid,
+):
+
+    resp = logged_in_client.post(
+        url_for('main.send_messages', service_id=service_one['id'], template_id=fake_uuid),
+        data={'file': (BytesIO(randbytes(11_000_000)), 'invalid.csv')},
+        content_type='multipart/form-data',
+        follow_redirects=True
+    )
+
+    assert resp.status_code == 200
+    assert "File must be smaller than 10Mb" in resp.get_data(as_text=True)
+
+
 def test_upload_valid_csv_redirects_to_check_page(
     client_request,
     mock_get_service_template_with_placeholders,