tinyhttp / tinyhttp / 29657149946

99%

push

github

fix(send): prevent DoS via malformed Range header (GHSA-w65r-fqv6-q6w9) (#512)

* fix(send): prevent DoS via malformed Range header (GHSA-w65r-fqv6-q6w9)

An inverted range such as 'bytes=10-5' passed the bounds check (both
offsets within the file), produced a negative Content-Length, and made
createReadStream throw ERR_OUT_OF_RANGE synchronously *after* the 206
headers were committed. The default onError handler then called
writeHead on the already-sent response, raising an uncaught
ERR_HTTP_HEADERS_SENT that crashed the process. A single unauthenticated
request could take down any server using res.sendFile.

- send: parse Range with an anchored regex and reject malformed,
  inverted (end < start), or out-of-bounds ranges with 416 before any
  headers are written. Also fixes the 'bytes=1-0' case where end parsed
  as falsy and silently fell back to stats.size - 1.
- app: onErrorHandler bails out (destroys the socket) when headersSent,
  as defense-in-depth against any handler throwing after headers.

Adds regression tests for bytes=10-5, bytes=1-0 and bytes=abc-def
(all now 416) and a test asserting the server survives a handler that
throws after committing headers.

* refactor(send): use header-range-parser for Range parsing

Replace the hand-rolled Range parser with header-range-parser (already a
transitive dependency of @tinyhttp/app via @tinyhttp/req; the same pin
1.1.4). It's a maintained fork of the parser Express uses and never
yields an inverted range, so it structurally eliminates the negative
Content-Length -> createReadStream crash class (GHSA-w65r-fqv6-q6w9)
rather than special-casing individual malformed inputs.

Behavior notes:
- bytes=10-5 / bytes=1-0 / bytes=abc-def -> 416 (unsatisfiable), no crash
- bytes=0-666 now clamps to 0-10 and serves 206 (RFC-correct) instead of
  416; a start beyond EOF (bytes=666-777) still returns 416
- malformed (no '=') and multi-range requests fall back to a 200 full
  response

Updates the out-of-range ... (continued)

1013 of 1022 branches covered (99.12%)

Branch coverage included in aggregate %.

15 of 15 new or added lines in 2 files covered. (100.0%)

1322 of 1325 relevant lines covered (99.77%)

175.84 hits per line