Allow particular Range header values without a CORS preflight

The allowed format aligns with the values the browser uses when requesting media and resuming downloads.

Tests: web-platform-tests/wpt#31058.

Fixes #1310.

Author: jakearchibald

fetch.bs

@@ -777,6 +777,9 @@ production as
 <ol>
  <li><p>Let <var>value</var> be <var>header</var>'s <a for=header>value</a>.
 
+ <li><p>If <var>value</var>'s <a for="byte sequence">length</a> is greater than 128, then return
+ false.
+
  <li>
   <p><a>Byte-lowercase</a> <var>header</var>'s <a for=header>name</a> and switch on the result:
 
@@ -829,13 +832,13 @@ fetch("https://victim.example/naïve-endpoint", {
 </code></pre>
     </div>
 
+   <dt>`<code>range</code>`
+   <dd><p>If <var>value</var> is not a <a>simple range header value</a>, then return false.
+
    <dt>Otherwise
    <dd><p>Return false.
   </dl>
 
- <li><p>If <var>value</var>'s <a for="byte sequence">length</a> is greater than 128, then return
- false.
-
  <li><p>Return true.
 </ol>
 
@@ -1045,6 +1048,46 @@ run these steps:
  <li><p>Return <var>values</var>.
 </ol>
 
+<p>To determine if a <a>byte sequence</a> <var>value</var> is a
+<dfn>simple range header value</dfn>, perform the following steps. They return a <a>boolean</a>.
+
+<ol>
+ <li><p>Let <var>data</var> be the <a>isomorphic decoding</a> of <var>value</var>.
+
+ <li><p>If <var>data</var> does not <a for=string>start with</a> "<code>bytes=</code>", then return
+ false.
+
+ <li><p>Let <var>position</var> be a <a>position variable</a> for <var>data</var>, initially
+ pointing at the 6th <a>code point</a> of <var>data</var>.
+
+ <li><p>Let <var>rangeStart</var> be the result of <a>collecting a sequence of code points</a> that
+ are <a>ASCII digits</a>, from <var>data</var> given <var>position</var>.
+
+ <li><p>If the <a>code point</a> at <var>position</var> within <var>data</var> is not U+002D (-),
+ then return false.
+
+ <li><p>Advance <var>position</var> by 1.
+
+ <li><p>Let <var>rangeEnd</var> be the result of <a>collecting a sequence of code points</a> that
+ are <a>ASCII digits</a>, from <var>data</var> given <var>position</var>.
+
+ <li><p>If <var>position</var> is not past the end of <var>data</var>, then return false.
+
+ <li>
+  <p>If <var>rangeEnd</var>'s <a for=string>length</a> is 0, then return true.
+
+  <p class="note">The range end can be omitted, e.g., `<code>bytes 0-</code>` is valid.
+
+ <li><p>If <var>rangeStart</var>, interpreted as decimal number, is greater than
+ <var>rangeEnd</var>, interpreted as decimal number, then return false.
+
+ <li><p>Return true.
+</ol>
+
+<p class="note">A <a>simple range header value</a> is a subset of allowed range header values, but
+it is the most common form used by user agents when requesting media or resuming downloads. This
+format of range header value can be set using <a>add a range header</a>.
+
 <hr>
 
 <p>A <dfn id=default-user-agent-value export>default `<code>User-Agent</code>` value</dfn> is a
@@ -1854,7 +1897,10 @@ is to return the result of <a>serializing a request origin</a> with <var>request
 <var>last</var>, run these steps:
 
 <ol>
- <li><p>Let <var>rangeValue</var> be `<code>bytes </code>`.
+ <li><p>Assert: <var>last</var> is not given, or <var>first</var> is less than or equal to
+ <var>last</var>.
+
+ <li><p>Let <var>rangeValue</var> be `<code>bytes=</code>`.
 
  <li><p><a lt="serialize an integer">Serialize</a> and <a>isomorphic encode</a> <var>first</var>,
  and append the result to <var>rangeValue</var>.