From 3fe8c38dc405586f7ad8f2ac748aa53e9c3615bd Mon Sep 17 00:00:00 2001
From: gecunps <geraldineelaine.cu@nelnet.net>
Date: Wed, 8 Oct 2025 22:50:03 +0800
Subject: [PATCH] Fix regex in `etag_matches?` to prevent ReDoS (#2121)
---
 lib/sinatra/base.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/sinatra/base.rb b/lib/sinatra/base.rb
index 5004f22..2a0e3c5 100644
--- a/lib/sinatra/base.rb
+++ b/lib/sinatra/base.rb
@@ -646,7 +646,7 @@ module Sinatra
     # Helper method checking if a ETag value list includes the current ETag.
     def etag_matches?(list, new_resource = request.post?)
       return !new_resource if list == '*'
-      list.to_s.split(/\s*,\s*/).include? response['ETag']
+      list.to_s.split(',').map(&:strip).include?(response['ETag'])
     end

     def with_params(temp_params)
-- 
2.46.0