Sling allows you to register servlets that handle all types of http interactions, so the default Sling servlet's behavior can be overridden at your discretion. If you want a general limit, you can also create filters that run on each post or put request (which are the ones that would be used for uploading) and check the requirements for upload are met.