Ignore a Range header with a unit other than bytes (#2657)

RFC 9110 14.2 says an origin server MUST ignore a Range header field
with a range unit it does not understand. parse_range_header() accepts
only bytes=, so a request such as "Range: items=1-2" got a 416 instead
of the full response. The unit is now checked first, and only a bytes
range is parsed and answered with a 416 when it is invalid.
This commit is contained in:
Eminy authored and GitHub committed 2026-11-04 22:44:22 -05:00
1 parent a1ba73a256
commit 39c98d4671
2 files changed
+33 -1

No files matched your search

+4 -1
View File
@@ -15292,7 +15292,10 @@ Server::process_request(Stream &strm, const std::string &remote_addr,
if ((req.method == "GET" || req.method == "HEAD") &&
req.has_header("Range")) {
const auto &range_header_value = req.get_header_value("Range");
if (!detail::parse_range_header(range_header_value, req.ranges)) {
// RFC 9110 14.2: a range unit other than bytes must be ignored
auto unit = range_header_value.substr(0, range_header_value.find('='));
if (detail::case_ignore::equal(unit, "bytes") &&
!detail::parse_range_header(range_header_value, req.ranges)) {
connection_closed = true;
res.status = StatusCode::RangeNotSatisfiable_416;
output_error_log(Error::InvalidRangeHeader, &req);