fix(server): validate If-Range HTTP dates

Author: Boyeep

packages/vinext/src/server/http-range.ts

@@ -55,10 +55,31 @@ export function ifRangeAllowsRange(
     return !trimmed.startsWith("W/") && !etag.startsWith("W/") && trimmed === etag;
   }
 
-  const timestamp = Date.parse(trimmed);
+  const timestamp = parseHttpDate(trimmed);
   return Number.isFinite(timestamp) && Math.floor(mtimeMs / 1000) * 1000 <= timestamp;
 }
 
+const HTTP_WEEKDAY = "(?:Mon|Tue|Wed|Thu|Fri|Sat|Sun)";
+const HTTP_WEEKDAY_LONG = "(?:Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday)";
+const HTTP_MONTH = "(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)";
+const IMF_FIXDATE_RE = new RegExp(
+  `^${HTTP_WEEKDAY}, \\d{2} ${HTTP_MONTH} \\d{4} \\d{2}:\\d{2}:\\d{2} GMT$`,
+);
+const RFC850_DATE_RE = new RegExp(
+  `^${HTTP_WEEKDAY_LONG}, \\d{2}-${HTTP_MONTH}-\\d{2} \\d{2}:\\d{2}:\\d{2} GMT$`,
+);
+const ASCTIME_DATE_RE = new RegExp(
+  `^${HTTP_WEEKDAY} ${HTTP_MONTH} (?: \\d|\\d{2}) \\d{2}:\\d{2}:\\d{2} \\d{4}$`,
+);
+
+/** Parse only the three HTTP-date wire formats accepted by RFC 9110. */
+function parseHttpDate(value: string): number {
+  if (!IMF_FIXDATE_RE.test(value) && !RFC850_DATE_RE.test(value) && !ASCTIME_DATE_RE.test(value)) {
+    return Number.NaN;
+  }
+  return Date.parse(value);
+}
+
 function parseDecimalInteger(value: string): number | null {
   if (!/^\d+$/.test(value)) return null;
   const parsed = Number(value);

tests/http-range.test.ts

@@ -54,5 +54,12 @@ describe("ifRangeAllowsRange", () => {
   it("rejects stale or invalid dates", () => {
     expect(ifRangeAllowsRange("Wed, 31 Dec 2025 23:59:59 GMT", '"asset"', mtimeMs)).toBe(false);
     expect(ifRangeAllowsRange("not-a-date", '"asset"', mtimeMs)).toBe(false);
+    expect(ifRangeAllowsRange("12/31/2099", '"asset"', mtimeMs)).toBe(false);
+    expect(ifRangeAllowsRange("2099-12-31", '"asset"', mtimeMs)).toBe(false);
+  });
+
+  it("accepts obsolete HTTP-date formats required for recipients", () => {
+    expect(ifRangeAllowsRange("Thursday, 01-Jan-26 00:00:01 GMT", '"asset"', mtimeMs)).toBe(true);
+    expect(ifRangeAllowsRange("Thu Jan  1 00:00:01 2026", '"asset"', mtimeMs)).toBe(true);
   });
 });