fix: ignore the Range header on non-GET requests in the axum extractor

RFC 9110 Section 14.2 defines range handling for the GET method only
and requires servers to ignore the Range header received with any
other method. The extractor previously extracted a range regardless
of the request method. Return `None` unless the method is GET, and
correct the doc comment that claimed servers "must" ignore malformed
Range headers: the spec says they may ignore or reject them.

Author: paolobarbolini

src/headers/range.rs

@@ -91,17 +91,22 @@ where
 
     /// Extracts an optional [`HttpRange`] from the request's `Range` header.
     ///
-    /// Per [RFC 9110 Section 14.2], a server that receives a `Range` header it
-    /// cannot parse or does not support (unknown range unit, multiple ranges,
-    /// malformed values) **must** ignore the header and serve the full
-    /// representation. This extractor returns `Ok(None)` in all such cases
-    /// instead of rejecting the request.
+    /// Per [RFC 9110 Section 14.2], range handling is only defined for the
+    /// GET method, and a server may ignore a `Range` header it cannot parse
+    /// or does not support (unknown range unit, multiple ranges, malformed
+    /// values). This extractor returns `Ok(None)` for non-GET requests and
+    /// in all such cases instead of rejecting the request, so that the full
+    /// representation is served.
     ///
     /// [RFC 9110 Section 14.2]: https://www.rfc-editor.org/rfc/rfc9110#section-14.2
     async fn from_request_parts(
         parts: &mut http::request::Parts,
         _state: &S,
     ) -> Result<Option<Self>, Self::Rejection> {
+        if parts.method != http::Method::GET {
+            return Ok(None);
+        }
+
         let range = parts
             .headers
             .get(http::header::RANGE)

src/headers/tests.rs

@@ -692,6 +692,59 @@ mod serve_file {
     }
 }
 
+#[cfg(feature = "axum")]
+mod axum_range_extractor {
+    use std::{
+        pin::pin,
+        task::{Context, Poll, Waker},
+    };
+
+    use axum_core::extract::OptionalFromRequestParts;
+    use http::{Method, Request, header::RANGE};
+
+    use crate::headers::{OrderedRange, range::HttpRange};
+
+    fn extract(method: Method, range: Option<&str>) -> Option<HttpRange> {
+        let mut builder = Request::builder().method(method);
+        if let Some(range) = range {
+            builder = builder.header(RANGE, range);
+        }
+        let (mut parts, ()) = builder.body(()).unwrap().into_parts();
+
+        let fut =
+            pin!(<HttpRange as OptionalFromRequestParts<()>>::from_request_parts(&mut parts, &()));
+        match fut.poll(&mut Context::from_waker(Waker::noop())) {
+            Poll::Ready(Ok(range)) => range,
+            Poll::Ready(Err(infallible)) => match infallible {},
+            Poll::Pending => unreachable!("the extractor never awaits"),
+        }
+    }
+
+    #[test]
+    fn get_request_extracts_range() {
+        assert_eq!(
+            extract(Method::GET, Some("bytes=0-10")),
+            Some(HttpRange::Range(OrderedRange::new(0..=10).unwrap()))
+        );
+    }
+
+    #[test]
+    fn non_get_request_ignores_range() {
+        assert_eq!(extract(Method::POST, Some("bytes=0-10")), None);
+        assert_eq!(extract(Method::PUT, Some("bytes=0-10")), None);
+    }
+
+    #[test]
+    fn missing_range_extracts_none() {
+        assert_eq!(extract(Method::GET, None), None);
+    }
+
+    #[test]
+    fn malformed_range_is_ignored() {
+        assert_eq!(extract(Method::GET, Some("bytes=10-0")), None);
+    }
+}
+
 #[cfg(test)]
 mod if_range {
     use http::HeaderValue;