fix: omit empty file inputs from remote form data

.changeset/quiet-plums-hide.md

@@ -0,0 +1,5 @@
+---
+'@sveltejs/kit': patch
+---
+
+fix: omit empty `file` inputs from remote form data

packages/kit/src/runtime/form-utils.js

@@ -50,6 +50,7 @@ export function convert_formdata(data) {
 		values = values.filter(
 			(entry) => typeof entry === 'string' || entry.name !== '' || entry.size > 0
 		);
+		if (values.length === 0 && !is_array) continue;
 
 		if (key.startsWith('n:')) {
 			key = key.slice(2);

packages/kit/src/runtime/form-utils.spec.js

@@ -50,6 +50,14 @@ describe('split_path', () => {
 });
 
 describe('convert_formdata', () => {
+	beforeAll(() => {
+		// TODO: remove after dropping support for Node 18
+		if (!('File' in globalThis)) {
+			// @ts-ignore
+			globalThis.File = buffer.File;
+		}
+	});
+
 	test('converts a FormData object', () => {
 		const data = new FormData();
 
@@ -91,6 +99,23 @@ describe('convert_formdata', () => {
 		});
 	});
 
+	test('omits empty file inputs', () => {
+		const data = new FormData();
+
+		data.append('file', new File([], ''));
+
+		expect(convert_formdata(data)).toEqual({});
+	});
+
+	test('keeps real zero-byte files', () => {
+		const data = new FormData();
+		const file = new File([], 'empty.txt');
+
+		data.append('file', file);
+
+		expect(convert_formdata(data)).toEqual({ file });
+	});
+
 	test.each(POLLUTION_ATTACKS)('prevents prototype pollution: %s', (attack) => {
 		const data = new FormData();
 		data.append(attack, 'bad');