Skip to content

Commit 263f5ca

Browse files
authored
disallow range -0 (#3255)
2 parents 12abecb + 0c419f9 commit 263f5ca

3 files changed

Lines changed: 9 additions & 0 deletions

File tree

‎CHANGES.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ Unreleased
2222
than the remaining size.
2323
- Rules with 10 or more converters in a single part assign matched values
2424
correctly.
25+
- The invalid ``Range`` suffix length ``-0`` is no longer accepted.
2526

2627

2728
Version 3.1.8

‎src/werkzeug/http.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -878,6 +878,11 @@ def parse_range_header(
878878
begin = _plain_int(item)
879879
except ValueError:
880880
return None
881+
882+
# -0 will parse to 0, and is an invalid suffix length.
883+
if begin == 0:
884+
return None
885+
881886
end = None
882887
last_end = -1
883888
elif "-" in item:

‎tests/test_http.py‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -687,6 +687,9 @@ def test_range_parsing(self):
687687
rv = http.parse_range_header("bytes=52-99, bad")
688688
assert rv is None
689689

690+
rv = http.parse_range_header("bytes=-0")
691+
assert rv is None
692+
690693
def test_content_range_parsing(self):
691694
rv = http.parse_content_range_header("bytes 0-98/*")
692695
assert rv.units == "bytes"

0 commit comments

Comments
 (0)