From 6742ef2f577533fdd5946344a78b942956d2c9c9 Mon Sep 17 00:00:00 2001
From: Eran Hammer <eran@hammer.io>
Date: Wed, 12 Feb 2020 21:29:48 -0800
Subject: [PATCH] Strict parser. Closes #39

---
 lib/index.js | 24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)

diff --git a/lib/index.js b/lib/index.js
index 28c63c8..1bf9eb2 100755
--- a/lib/index.js
+++ b/lib/index.js
@@ -18,14 +18,23 @@ internals.Range = class {
 };
 
 
+// RFC 7233 (https://tools.ietf.org/html/rfc7233#appendix-D)
+//
+// Range = "bytes" "=" byte-range-set
+// byte-range-set = *( "," OWS ) byte-range-spec *( OWS "," [ OWS byte-range-spec ] )
+// byte-range-spec = ( 1*DIGIT "-" [ 1*DIGIT ] ) / ( "-" 1*DIGIT )
+
+
+//                                12  3          3 4       425         6  7          7 8       865 1
+internals.headerRx = /^bytes=[\s,]*((?:(?:\d+\-\d*)|(?:\-\d+))(?:\s*,\s*(?:(?:\d+\-\d*)|(?:\-\d+)))*)$/i;
+
+
 exports.header = function (header, length) {
 
     // Parse header
 
-    const parts = header.split('=');
-    if (parts.length !== 2 ||
-        parts[0] !== 'bytes') {
-
+    const parts = internals.headerRx.exec(header);
+    if (!parts) {
         return null;
     }
 
@@ -36,12 +45,7 @@ exports.header = function (header, length) {
 
     // Handle headers with multiple ranges
 
-    for (let i = 0; i < ranges.length; ++i) {
-        let range = ranges[i];
-        if (range.length === 1) {               // '-'
-            return null;
-        }
-
+    for (let range of ranges) {
         let from;
         let to;
         range = range.split('-');