17krishna8 opened a new pull request, #1672: URL: https://github.com/apache/wicket/pull/1672
A `Range` header that does not survive the parsing made the whole resource request fail instead of the resource being served: - `Range: bytes=5` (no dash) and `Range: bytes=abc` fail with `ArrayIndexOutOfBoundsException`, because the second part of the range is read without checking that there is one - `Range: bytes=1-x` and values that do not fit into a long fail with `NumberFormatException` - `Range: bytes 5-10` (no `=`) feeds the whole header text to the number parser instead Every request to a Wicket served resource goes through `AbstractResource.setRequestRangeMetaData()`, so any client able to request a resource can turn such a header into a failed request. The header value is client input, it is not under the application's control, which makes this a denial-of-service vector rather than a plain robustness bug. RFC 9110 requires an origin server to ignore a `Range` header it does not understand, so a malformed value now falls back to serving the whole resource, and the content range meta data is only set for a header of the form `bytes=<start>-<end>` where both parts are numbers that fit into a long. A well-formed range is picked up exactly as before, including the first-of-several rule from WICKET-5995. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
