#302 anchor Content-Range guard regexes with \A and \z

lib/baza-rb.rb

@@ -852,9 +852,9 @@ def download(uri, file)
         break if ret.code == 200
         _, v = ret.headers['Content-Range'].split
         range, total = v.split('/')
-        raise "Total size is not valid (#{total.inspect})" unless total.match?(/^\*|[0-9]+$/)
+        raise "Total size is not valid (#{total.inspect})" unless total.match?(/\A(?:\*|[0-9]+)\z/)
         _b, e = range.split('-')
-        raise "Range is not valid (#{range.inspect})" unless e.match?(/^[0-9]+$/)
+        raise "Range is not valid (#{range.inspect})" unless e.match?(/\A[0-9]+\z/)
         len = ret.headers['Content-Length'].to_i
         break if e.to_i == total.to_i - 1
         break if total == '0'

test/test_baza_edge.rb

@@ -452,6 +452,29 @@ def test_lock_raises_when_owner_is_empty
     assert_equal('The "owner" of the lock may not be empty', error.message)
   end
 
+  def test_download_rejects_malformed_content_range_total
+    WebMock.disable_net_connect!
+    ['*malformed', 'abc123', '0xff', '-5'].each do |total|
+      Dir.mktmpdir do |dir|
+        file = File.join(dir, 'out.bin')
+        host = 'example.org'
+        stub_request(:get, "https://#{host}:443/file")
+          .with(headers: { 'Range' => 'bytes=0-' })
+          .to_return(
+            status: 206,
+            body: 'first ',
+            headers: { 'Content-Range' => "bytes 0-5/#{total}" }
+          )
+        baza = BazaRb.new(host, 443, '000', loog: Loog::NULL, compress: false)
+        error =
+          assert_raises(RuntimeError) do
+            baza.send(:download, baza.send(:home).append('file'), file)
+          end
+        assert_equal("Total size is not valid (#{total.inspect})", error.message)
+      end
+    end
+  end
+
   def test_upload_switches_host_mid_chunks
     WebMock.disable_net_connect!
     Dir.mktmpdir do |dir|