Skip to content

fix(req): validate req.range size #6596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

shivarm
Copy link
Contributor

@shivarm shivarm commented Jun 27, 2025

the req.range function to ensure the size parameter is a non-negative integer. If invalid, a TypeError is thrown with a descriptive message.

Copy link
Member

@bjohansebas bjohansebas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a breaking change. I'm not entirely familiar with range, so I'll need to do some research before accepting it. Could you share a reference in the specification showing that it cannot be negative? That would make the review easier.

Also, if this change is accepted, a deprecation would be needed for v5. But for that, you could first share the spec reference.

@shivarm
Copy link
Contributor Author

shivarm commented Jun 28, 2025

Reference by https://datatracker.ietf.org/doc/html/rfc7233#section-2.1

  1. A byte-range request is satisfiable only if the resource is at least as large as the sum of the requested ranges. If the selected representation is shorter than the specified range(s), the server SHOULD return a 416 (Range Not Satisfiable) response.

  2. A client can request a single range from a resource by specifying the start and end of the range, e.g., Range: bytes=0-499 for the first 500 bytes. The range values are non-negative decimal integers.

Why resource size must be non-negative

  • The resource size represents the total length in bytes (or items) and cannot logically be negative.
  • All range calculations (start, end) are based on non-negative integers.
  • Negative values are not defined or supported in the spec and would not make sense for a resource length.

@bjohansebas
Copy link
Member

A test is also missing for when the argument is a string, or an array, etc.

@shivarm shivarm force-pushed the validate-range-function branch from bd638c1 to 8054e78 Compare July 15, 2025 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants