From 0f30cd48ea5057ae26f918f950e026829d83c706 Mon Sep 17 00:00:00 2001
From: Jeremy Massel <1123407+jkmassel@users.noreply.github.com>
Date: Fri, 4 Sep 2026 20:25:26 -0600
Subject: [PATCH] fix(ios): don't start a media upload for a torn-down editor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both delivery paths could put bytes on the wire after the editor was gone.
`EditorViewController.deinit` calls `stop()`, which cancels the in-flight
connection tasks, but Swift cancellation is cooperative: the body read is
an uninterruptible loop and a host's `processFile` need not check at all,
so a request can reach delivery well after teardown. Whether it then
actually reached WordPress rested entirely on URLSession noticing the
cancellation.

That is not a guarantee the server can rely on. `URLSessionProtocol` is
public and documented for dependency injection, and the obvious
conformance for a host wrapping a callback-based stack —
`withCheckedThrowingContinuation` around a completion handler — has no
cancellation awareness at all. Such a host would upload deterministically
after teardown, and the response is discarded either way, leaving an
attachment on the site that nothing cleans up.

Check cancellation explicitly before delivery in `processAndUpload` and
before the passthrough forward, so the guarantee comes from this file
rather than from the HTTP client's behavior. `uploadErrorResponse` already
logs CancellationError quietly, and HTTPServer drops the response for a
cancelled task.

Not covered by a test: reaching the window deterministically means driving
teardown between the parse and the delivery of a live socket request, and
a timing-based approximation would be flaky without pinning the behavior.
---
 .../Sources/Media/MediaUploadServer.swift             | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/ios/Sources/GutenbergKit/Sources/Media/MediaUploadServer.swift b/ios/Sources/GutenbergKit/Sources/Media/MediaUploadServer.swift
index 5b3c90c0b..d18cacae4 100644
--- a/ios/Sources/GutenbergKit/Sources/Media/MediaUploadServer.swift
+++ b/ios/Sources/GutenbergKit/Sources/Media/MediaUploadServer.swift
@@ -186,6 +186,10 @@ final class MediaUploadServer: Sendable {
     private static func passthroughResponse(
         _ request: HTTPServer.Request, query: String, context: UploadContext
     ) async throws -> HTTPResponse {
+        // As in `processAndUpload`: don't put bytes on the wire for a torn-down
+        // editor, regardless of whether the HTTP client honors cancellation.
+        try Task.checkCancellation()
+
         Logger.uploadServer.debug("Passthrough: forwarding original request body to WordPress")
         guard let body = request.parsed.body,
               let contentType = request.parsed.header("Content-Type"),
@@ -313,6 +317,13 @@ final class MediaUploadServer: Sendable {
             }
         }
 
+        // The editor was torn down (or the client disconnected) while we processed.
+        // Don't start an outbound upload whose response nobody will read — it would
+        // create an attachment neither GutenbergKit nor the host knows to clean up.
+        // Checking here rather than relying on the HTTP client to notice cancellation
+        // keeps this true for a host-injected `URLSessionProtocol` that doesn't.
+        try Task.checkCancellation()
+
         // Step 2: Upload to remote WordPress
         if let delegate = context.uploadDelegate,
            let result = try await delegate.uploadFile(at: uploadURL, mimeType: uploadMimeType, filename: uploadFilename) {