Summary of Changes

Hello @gaby, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a potential resource exhaustion vulnerability by introducing a configurable limit on the number of ranges processed from an HTTP Range header. It standardizes the configuration of this limit, ensures its enforcement during request parsing, and provides clear error handling and documentation, thereby improving the robustness and security of the application against malformed or excessively large range requests.

Highlights

• Introduced Config.MaxRanges: A new configuration option to cap the number of ranges parsed from an HTTP Range header, defaulting to 16, to prevent resource exhaustion.
• Enforced Range Header Limit: The DefaultReq.Range() method now respects Config.MaxRanges, returning ErrRangeTooLarge and setting a 416 Requested Range Not Satisfiable status if the limit is exceeded.
• Removed Redundant Fallback: Streamlined the DefaultReq.Range() logic by removing an unnecessary fallback check, relying on the MaxRanges default being applied during application initialization.
• Updated Documentation and Tests: Added ErrRangeTooLarge, included a new test case for exceeding the range limit, and documented MaxRanges in the API reference.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Walkthrough

Adds Config.MaxRanges (default 16) and enforces it during Range header parsing; exceeding the limit returns HTTP 416 with a Content-Range header and ErrRangeTooLarge. Also adds docs, a test, an exported error, a small BasicAuth trimming change, and context doc-comment updates.

Changes

Sequence Diagram(s)

sequenceDiagram
  participant Client as Client
  participant Ctx as Ctx.Range()
  participant App as App.Config
  participant Res as Response

  Client->>Ctx: Request with Range header (multiple ranges)
  Ctx->>App: read config.MaxRanges
  Ctx->>Ctx: parse ranges, increment count
  alt count <= MaxRanges
    Ctx->>Ctx: finish parsing
    Ctx->>Res: return ranges (206 or appropriate)
    Res-->>Client: 206 Partial Content / response
  else count > MaxRanges
    Ctx->>Res: set Status 416 and header "Content-Range: bytes */<size>"
    Res-->>Client: 416 Requested Range Not Satisfiable
  end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• 🧹 chore: Use int64 when dealing with HTTP Ranges #3874: Modifies the same Range parsing implementation and types — overlaps parsing logic changed here.
• 🐛 bug: Fix Range() parsing of bytes unit #3541: Changes whitespace/unit parsing in Range handling — touches adjacent parsing behavior.
• 🧹 chore: Replace strings.TrimSpace with utils.TrimSpace #3918: Alters Range parsing behavior in req.go (trimming/normalization) — related to the new max-ranges enforcement.

Suggested reviewers

• sixcolors
• efectn
• ReneWerner87

Poem

🐰
I count the slices, nibble each byte,
Sixteen's the limit — keep parsing light.
Too many ranges? I thump and declare: 416 rings,
Content-Range posted — tidy, no overreaching things.
Hops, carrots, and careful byte bites.

No actionable comments were generated in the recent review. 🎉

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.04%. Comparing base (f93613f) to head (b4ab278).
⚠️ Report is 21 commits behind head on main.

@@            Coverage Diff             @@
##             main    #4071      +/-   ##
==========================================
- Coverage   91.08%   91.04%   -0.05%     
==========================================
  Files         119      119              
  Lines       11221    11256      +35     
==========================================
+ Hits        10221    10248      +27     
- Misses        633      637       +4     
- Partials      367      371       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.