Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

ContentRangeHeaderValue "to" must always be less than "length"

See original GitHub issue

Summary

The ContentRangeHeaderValue constructor allows the creation of an invalid (range) instance. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Range <range-start> and <range-end> are zero-indexed & inclusive This means that to must always be a maximum of length - 1

Motivation and goals

Prevent people (like me) to create invalid content range headers.

In scope

None.

Out of scope

None.

Risks / unknowns

People sending invalid requests to forgiving servers might be broken.

Examples

I think this line https://github.com/dotnet/aspnetcore/blob/fd1891536f27e959d14a140ff9307b6a21191de9/src/Http/Headers/src/ContentRangeHeaderValue.cs#L41 Should be changed from if ((to < 0) || (to > length)) to if ((to < 0) || (to > Math.Max(0, length-1)))

Issue Analytics

State:
Created a year ago
Comments:11 (4 by maintainers)

Top GitHub Comments

2reactions

adityamandaleekacommented, Mar 30, 2023

Looks like this discussion has been quiet for a while, so I’m going to go ahead and open a PR.

1reaction

tmricardo7commented, Nov 15, 2022

I was checking the file and it looks like we have the same validation here https://github.com/dotnet/aspnetcore/blob/fd1891536f27e959d14a140ff9307b6a21191de9/src/Http/Headers/src/ContentRangeHeaderValue.cs#L421-L425

It will be useful to have a special scenario where this issue is triggered.

Top Results From Across the Web

Does a HTTP resource that accepts range requests always ...

A Range of e.g. 123-500 is valid even if the size of the entity is less than 500, in which case as many...

Caching with Azure Front Door

Override always: Azure Front Door always overrides with the cache duration, meaning that it caches the contents for the cache duration ignoring ...

HTTP/1.1, part 5: Range Requests and Partial Responses

If a syntactically valid byte-range-set includes at least one byte-range-spec whose first-byte-pos is less than the current length of the entity-body, or at ......

HTTP/1.1, part 5: Range Requests and Partial Responses

A cache that does not support the Range and Content-Range headers MUST NOT ... value is less than its first-byte-pos value, or whose...

Public R2 bucket doesn't handle range requests well

When accessing my files through public access with a range header, R2 always responds with the proper amount of bytes but never with...