From a506566fc4b49da4f51c844f057c65e7e214387d Mon Sep 17 00:00:00 2001
From: Daniel Lockyer <hi@daniellockyer.com>
Date: Mon, 11 Mar 2024 17:35:25 +0100
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Fixed=20HTTP=20500=20error=20whe?=
 =?UTF-8?q?n=20given=20incorrect=20Range=20header?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ref ENG-729
ref https://linear.app/tryghost/issue/ENG-729/incorrect-range-header-leads-to-http-500-errors

- we didn't have handling here for the `RangeNotSatisfiableError` that
  can come from express/serve-static/send
- as a result, passing an invalid range would cause a 500 error
- this prevents that and adds a breaking test
---
 .../adapters/storage/LocalStorageBase.js      |  4 ++++
 .../adapters/storage/LocalBaseStorage.test.js | 21 +++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/ghost/core/core/server/adapters/storage/LocalStorageBase.js b/ghost/core/core/server/adapters/storage/LocalStorageBase.js
index 6a0e3372f801..274247fbfaf3 100644
--- a/ghost/core/core/server/adapters/storage/LocalStorageBase.js
+++ b/ghost/core/core/server/adapters/storage/LocalStorageBase.js
@@ -149,6 +149,10 @@ class LocalStorageBase extends StorageBase {
                         return next(new errors.NoPermissionError({err: err}));
                     }
 
+                    if (err.name === 'RangeNotSatisfiableError') {
+                        return next(new errors.RangeNotSatisfiableError({err}));
+                    }
+
                     return next(new errors.InternalServerError({err: err}));
                 }
 
diff --git a/ghost/core/test/unit/server/adapters/storage/LocalBaseStorage.test.js b/ghost/core/test/unit/server/adapters/storage/LocalBaseStorage.test.js
index dd0724ee247d..204878cf3f85 100644
--- a/ghost/core/test/unit/server/adapters/storage/LocalBaseStorage.test.js
+++ b/ghost/core/test/unit/server/adapters/storage/LocalBaseStorage.test.js
@@ -2,6 +2,27 @@ const should = require('should');
 const LocalStorageBase = require('../../../../../core/server/adapters/storage/LocalStorageBase');
 
 describe('Local Storage Base', function () {
+    describe('serve', function () {
+        it('returns a 416 RangeNotSatisfiableError if given an invalid range', function(done) {
+            const localStorageBase = new LocalStorageBase({
+                storagePath: '/media-storage/path/',
+                staticFileURLPrefix: 'content/media',
+                siteUrl: 'http://example.com/blog/'
+            });
+
+            ???????????
+
+            req.headers = {
+                range: 'bytes=1000-999'
+            };
+
+            localStorageBase.serve()(req, res, () => {
+                // TODO: check this is a 416 RangeNotSatisfiableError
+                done();
+            });
+        });
+    });
+
     describe('urlToPath', function () {
         it('returns path from url', function () {
             let localStorageBase = new LocalStorageBase({