open-standards/wai/http-conformance/falsify/trust-content-range.patch
Transaction Science 909312ce15 wai: falsification patches for the fix round, and the four the rewrite moved, regenerated
New: threshold-all, refusal-ends, reuse-stale, plus-sign, dispatch-layer,
union-no-layer, wai-prefix-case, dup-caps, record-alt, base-unanswered, each
naming the corpus cases it must fail. accept-gzip, trust-content-range,
skip-on-absent and intersection are the same defects written against the
current code.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-05 09:35:08 -04:00

15 lines
936 B
Diff

# must fail: response_wrong_range
# Content-Range is not compared with the request (session::check_response)
diff --git a/wai/wai-rs/src/http_binding/session.rs b/wai/wai-rs/src/http_binding/session.rs
index 4730c192..6cd93bea 100644
--- a/wai/wai-rs/src/http_binding/session.rs
+++ b/wai/wai-rs/src/http_binding/session.rs
@@ -221,7 +221,7 @@ pub fn check_response(req: Option<ByteRange>, r: &ResponseMeta, body_len: u64, e
let (a, b) = span.split_once('-').ok_or_else(mismatch)?;
let (a, b) = (digits(a).ok_or_else(mismatch)?, digits(b).ok_or_else(mismatch)?);
let expect_last = want.last.min(envelope_len.saturating_sub(1));
- if a != want.first || b != expect_last || b < a || (b - a).checked_add(1) != Some(body_len) {
+ if b < a || (b - a).checked_add(1) != Some(body_len) {
return Err(mismatch());
}
match digits(complete) {