defnull/bottle — comment on commit 6946695b69f5493fb063c351400ff759323a31aa
File:  line 0
By snaury:

I don't think this fixes much, because POST data can be multipart, and then headers (Content-Disposition in particular) can have parameters, so you may get:

--boundary
Content-Disposition: form-data; a=1; b=1; c=1; d=1; e=1; f=1; ...

All of this will be parsed in Python's cgi (see parse_header function) and rfc822 (see Message class which uses fp.readline without any limits). Really, limiting number of parameters is a band-aid in a really wrong place.