what

• add new rule for blocking Request-Range header
• added tests:

Positive Tests (17 tests - should trigger rule 920660):

1. Basic Request-Range usage (tests 1-4): Simple byte ranges, open-ended ranges, suffix ranges, and multiple ranges
2. Case variations (tests 5-6): Mixed case and uppercase variations of the header
3. Different HTTP methods (tests 7-9): GET, POST, HEAD, and PUT requests
4. Edge cases (tests 10-12): Whitespace in values, large ranges, zero ranges
5. Historical context (tests 13-14): Simulating old Netscape Navigator and MSIE 3 browsers from the 1990s
6. Malformed headers (tests 15-16): Invalid syntax and empty values (header still present)
7. Mixed scenarios (test 17): Both obsolete Request-Range and standard Range headers present

Negative Tests (13 tests - should NOT trigger):

1. Standard RFC 9110 Range header (tests 18-19): Modern, compliant Range headers
2. No range headers (tests 20-21): Normal requests without any range-related headers
3. Other range-related headers (tests 22-24): If-Range, Content-Range, Accept-Ranges
4. Modern browsers (tests 25-26): Chrome and Firefox with standard Range headers
5. Edge cases (tests 27-30): Query parameters, POST body content, custom headers (X-Request-Range), and HEAD requests without range headers

why

• it is obsolete

refs

• Block obsolete Request-Range HTTP header #4432