Sanity checks for HTTP range requests [SPR-17318] #21851
Description
Rossen Stoyanchev opened SPR-17318 and commented
When serving static resources, or as of 5.0 also when a controller returns a Resource, if the "Range" header is present, one or more subsets of the content may be served instead of the entire content. Some basic validations to the requested ranges should be applied as recommended in RFC 7233 Section 3.1:
A server that supports range requests MAY ignore or reject a Range
header field that consists of more than two overlapping ranges, or a
set of many small ranges that are not listed in ascending order,
since both are indications of either a broken client or a deliberate
denial-of-service attack.
Affects: 4.3.20, 5.0.9, 5.1 GA