Move parser.finalize() inside try/except in MultiPartParser.parse() (#3153)

parser.finalize() can trigger callbacks that raise MultiPartException
(e.g. when multipart data is truncated or malformed). Since it was
called outside the try/except block, any exception raised during
finalize would skip the file cleanup, leaking SpooledTemporaryFile
handles until the garbage collector eventually collects them.

Moving finalize() inside the try block ensures that temporary files
are properly closed on any MultiPartException, whether it occurs
during chunk processing or during finalization.

Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com>

Author: bysiber

starlette/formparsers.py

@@ -266,11 +266,11 @@ async def parse(self) -> FormData:
                     await part.file.seek(0)
                 self._file_parts_to_write.clear()
                 self._file_parts_to_finish.clear()
+            parser.finalize()
         except MultiPartException as exc:
             # Close all the files if there was an error.
             for file in self._files_to_close_on_error:
                 file.close()
             raise exc
 
-        parser.finalize()
         return FormData(self.items)