fix(serve-static): correct Range header parsing edge cases#372
Open
otnc wants to merge 2 commits into
Open
Conversation
- `bytes=-N` (suffix range) now returns the last N bytes instead of the first N+1 bytes. - `bytes=0-0` now returns 1 byte instead of the whole file (the old `parseInt(...) || size - 1` treated a valid 0 as falsy). - An unsatisfiable range (start beyond EOF, or start > end) now returns 416 instead of crashing createReadStream with a RangeError.
Member
Member
|
Thank you for creating the PR. I think this is a great way to implement it! I have two concerns: Malformed rangesNow that range parsing has been extracted into its own helper, I think Empty filesFor an empty file, |
…rash - Range segments with trailing garbage (e.g. `bytes=0-1x`) were silently truncated by parseInt into `0-1` instead of being treated as malformed. first-pos/last-pos/suffix-length are now validated as `1*DIGIT`. - A Range request on an empty file fell through to createReadStream with end=-1 and crashed with 500 instead of returning 416. Addresses review feedback from @usualoma on honojs#372.
Contributor
Author
Member
|
@usualoma Could you review this again? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
serveStatic'sRangeparsing had three edge cases that didn't match RFC 9110:bytes=-N(suffix range) returned the first N+1 bytes instead of the last N.bytes=0-0returned the whole file instead of 1 byte (parseInt(...) || size - 1treated a valid0as falsy).bytes=100-200on a 17-byte file) crashedcreateReadStreamwithRangeErrorinstead of returning 416.Replaced the ad-hoc parsing with a
parseRange()helper that handles all three correctly while keeping the existing behavior for malformed headers (e.g.Range: hellostill serves the whole file, per the existing test).Added tests for each case; all existing tests still pass unchanged.