Avoid regex backtracking on If-None-Match header

[CVE-2023-22795]
rails · Jan 17, 2023 · 8dc4595 · 8dc4595
1 parent a7cda7e
commit 8dc4595
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/actionpack/lib/action_dispatch/http/cache.rb b/actionpack/lib/action_dispatch/http/cache.rb
@@ -18,7 +18,7 @@ def if_none_match
         end
 
         def if_none_match_etags
-          if_none_match ? if_none_match.split(/\s*,\s*/) : []
+          if_none_match ? if_none_match.split(",").each(&:strip!) : []
         end
 
         def not_modified?(modified_at)