fix(media-server): reject malformed range headers

electron/mediaServer.test.ts

@@ -72,6 +72,13 @@ describe("media server path policy", () => {
 });
 
 describe("resolveHttpByteRange", () => {
+	it("rejects malformed and multi-range headers", async () => {
+		const { resolveHttpByteRange } = await import("./mediaServer");
+
+		expect(resolveHttpByteRange("bytes=0-1,2-3", 100)).toBeNull();
+		expect(resolveHttpByteRange("bytes=0-1foo", 100)).toBeNull();
+	});
+
 	it("clamps oversized explicit end offsets to EOF", async () => {
 		const { resolveHttpByteRange } = await import("./mediaServer");
 

electron/mediaServer.ts

@@ -12,7 +12,7 @@ export function resolveHttpByteRange(
 	rangeHeader: string,
 	fileSize: number,
 ): { start: number; end: number } | null {
-	const match = rangeHeader.match(/bytes=(\d*)-(\d*)/);
+	const match = rangeHeader.trim().match(/^bytes=(\d*)-(\d*)$/);
 	if (!match || (!match[1] && !match[2])) {
 		return null;
 	}