multipart: cleanup files after reading their contents

one idea is just use express.raw() . however, we have to implement some
file size limit there.

one case this does not handle is aborted uploads from a box.service restart.
for this rare case, a server reboot will clean up /tmp anyway.

src/middleware/multipart.js

@@ -3,6 +3,7 @@
 'use strict';
 
 const multiparty = require('multiparty'),
+    safe = require('safetydance'),
     timeout = require('connect-timeout');
 
 function _mime(req) {
@@ -19,18 +20,21 @@ module.exports = function multipart(options) {
             keepExtensions: true,
             maxFieldsSize: options.maxFieldsSize || (2 * 1024), // only field size, not files
             limit: options.limit || '8mb', // file sizes
-            autoFiles: true
+            autoFiles: true // emit files instead of emitting 'part'
         });
 
         // increase timeout of file uploads by default to 3 mins
         if (req.clearTimeout) req.clearTimeout(); // clear any previous installed timeout middleware
 
         timeout(options.timeout || (3 * 60 * 1000))(req, res, function () {
-            req.fields = { };
-            req.files = { };
+            req.fields = {};
+            req.files = {};
 
-            form.parse(req, function (err /*, fields, files */) {
-                if (err) return res.status(400).send('Error parsing request');
+            form.parse(req, function (error, fields, files) {
+                if (error) {
+                    for (const file in files) safe.fs.unlinkSync(file.path);
+                    return res.status(400).send('Error parsing request');
+                }
                 next(null);
             });