diff --git a/apisix/plugins/brotli.lua b/apisix/plugins/brotli.lua index f8522e98ae8a..e458ac57dc65 100644 --- a/apisix/plugins/brotli.lua +++ b/apisix/plugins/brotli.lua @@ -158,12 +158,15 @@ local function weak_etag_header() return end - local regex = [[^(W/)?"(.*)"$]] + local regex = [[^(W/)?"([^"]*)"$]] local matched, err = ngx.re.match(etag, regex, "jo") - if not matched or err then - -- not standard etag, no quote + if err then + core.log.error("failed to match etag: ", err) + end + if not matched then + -- non-standard etag (not quoted) or a match failure; it cannot be + -- weakened, so drop it core.response.set_header("Etag", nil) - core.log.error("no standard etag or regex match failed: ", err) return end diff --git a/t/plugin/brotli.t b/t/plugin/brotli.t index 7e83e1c7bad3..ae3e31254617 100644 --- a/t/plugin/brotli.t +++ b/t/plugin/brotli.t @@ -833,8 +833,8 @@ Content-Encoding: br Vary: Etag: Content-Length: ---- error_log -no standard etag or regex match failed: +--- no_error_log +[error] @@ -888,3 +888,22 @@ Vary: Etag: W/"123456789" Last-Modified: Thu, 27 Nov 2025 00:32:33 GMT Content-Length: + + + +=== TEST 37: etag with embedded quotes is non-standard, clear it +--- request +POST /echo +0123456789 +012345678 +--- more_headers +Accept-Encoding: br +Content-Type: text/html +Etag: "12"34" +--- response_headers +Content-Encoding: br +Vary: +Etag: +Content-Length: +--- no_error_log +[error]