feat: request body limit

[productdevbook]

Summary

This PR introduces a new plugin system for limiting request body sizes in H3 applications, addressing the issue raised in #859.

Features

• 🔌 Plugin-based approach for flexible body size limiting
• 🎯 Route-specific limits with include/exclude patterns
• ⚡ Performance-optimized with Content-Length header checking
• 🧪 Comprehensive test coverage

Usage

import { defineBodySizeLimitPlugin } from "h3";

const bodySizeLimit = defineBodySizeLimitPlugin({
  maxSize: 1024 * 1024, // 1MB
  routes: ["/api/upload", /^\/api\/files/],
  exclude: ["/api/large-upload"]
});

app.register(bodySizeLimit);

Why Plugin Approach?

Instead of adding maxBodySize directly to route definitions, this plugin approach provides:

• Better performance (no overhead when not needed)
• More flexibility (apply to multiple routes at once)
• Cleaner separation of concerns
• Easy to enable/disable globally

Test Coverage

• ✅ Global body size limiting
• ✅ Route-specific limiting with patterns
• ✅ Route exclusion functionality
• ✅ Integration with defineRoute

Closes #859

[cloudflare-workers-and-pages]

Deploying h3dev with    Cloudflare Pages

Latest commit:	30c23e9
Status:	✅  Deploy successful!
Preview URL:	https://76ed8f69.h3dev.pages.dev
Branch Preview URL:	https://feat-body-size-limit-plugin.h3dev.pages.dev

View logs

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

📢 Thoughts on this report? Let us know!

[pi0]

It should be a middleware not a plugin to apply in places needed.

With middleware, pattern and route matching can be defined also on definition therefore we do not need to (re)implement logic inside this utility.

[pi0]

This is not a safe implementation as @OskarLebuda pointed out. content-length can be faked.

We need to both check header and transform body stream into another controller that force-stops reading body as soon as max length is reached.

[pi0]

Thanks for PR ❤️ We need some changes:

• Implementation should return a middleware
• Implementation should not do pattern matching (middleware already do it)
• Implementation should also validate stream length other than simple header check