CVE-2022-45442: Sinatra vulnerable to Reflected File Download attack

The vulnerability stems from improper escaping in the Content-Disposition header's filename parameter. The GitHub patch shows the attachment method in lib/sinatra/base.rb was modified to add escaping via gsub(/["\r\n]/). The commit message explicitly references fixing filename escaping for multipart form data compliance. The test case added in test/helpers_test.rb demonstrates the attack scenario where a filename containing ;\r\n is sanitized, confirming this function's role. No other functions in the diff appear to handle user-controlled filename input for headers.