From d9540ee9f29a96ed5a60826ab1189e4816ca938e Mon Sep 17 00:00:00 2001 From: Jasmin Workman Date: Wed, 13 May 2026 16:34:20 -0600 Subject: [PATCH 1/3] Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR #1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) --- lib/react/server_rendering/webpacker_manifest_container.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/react/server_rendering/webpacker_manifest_container.rb b/lib/react/server_rendering/webpacker_manifest_container.rb index 2f15e5736..d1612b52c 100644 --- a/lib/react/server_rendering/webpacker_manifest_container.rb +++ b/lib/react/server_rendering/webpacker_manifest_container.rb @@ -15,7 +15,7 @@ def find_asset(logical_path) asset_path = Webpacker::Manifest.lookup(logical_path).to_s if asset_path.start_with?("http") # Get a file from the webpack-dev-server - dev_server_asset = open(asset_path).read + dev_server_asset = URI.open(asset_path).read # Remove `webpack-dev-server/client/index.js` code which causes ExecJS to 💥 dev_server_asset.sub!(CLIENT_REQUIRE, '//\0') dev_server_asset From d1b58a3149f0dff88d5f4f630c3cdd47ceff5cf0 Mon Sep 17 00:00:00 2001 From: Jasmin Workman Date: Wed, 13 May 2026 16:34:57 -0600 Subject: [PATCH 2/3] Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) --- README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/README.md b/README.md index 6aede515c..7500e9170 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,19 @@ # react-rails +> [!IMPORTANT] +> **This is the ezCater internal fork of `reactjs/react-rails`, and it is in a terminal state.** Read the Fork Status section below before making changes here. + +## Fork Status + +- **No functional commits since 2017-06-30** ([`43e07ac`](https://github.com/ezcater/react-rails/commit/43e07ac), "2.2.1"). Subsequent activity on `master` is GitHub Actions hygiene only (CodeQL, CODEOWNERS, action SHA pinning). +- **`ez-rails` consumes the `rails5` branch, not `master`.** `rails5` is pinned at gem v1.7.1 (`master` is at v2.2.1). The two branches do not contain the same files. +- **The `master` branch exists primarily to satisfy CodeQL scans on the default branch.** Patches landed on `master` (e.g. the CWE-78 URI.open fix) are here to clear GitHub code scanning alerts. They are not consumed by `ez-rails` directly. +- **Long-term plan: archive this fork.** Once `ez-rails` migrates off `react-rails` SSR entirely, this fork will be archived. That work is tracked separately as a 2027+ effort owned by Monolith Experience. See the [MX-1374 investigation](https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893) for the full context and decision. + +For questions, contact [#pb-s-monolith-experience](https://ezcater.slack.com/archives/C03TE7HHUFP). + +--- + [![Gem](https://img.shields.io/gem/v/react-rails.svg?style=flat-square)](http://rubygems.org/gems/react-rails) [![Build Status](https://img.shields.io/travis/reactjs/react-rails/master.svg?style=flat-square)](https://travis-ci.org/reactjs/react-rails) [![Gemnasium](https://img.shields.io/gemnasium/reactjs/react-rails.svg?style=flat-square)](https://gemnasium.com/reactjs/react-rails) From 0d0e0d295dfada76842bc75375d7ab823ca15eb1 Mon Sep 17 00:00:00 2001 From: Jasmin Workman Date: Wed, 13 May 2026 16:43:52 -0600 Subject: [PATCH 3/3] Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI().open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) --- lib/react/server_rendering/webpacker_manifest_container.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/react/server_rendering/webpacker_manifest_container.rb b/lib/react/server_rendering/webpacker_manifest_container.rb index d1612b52c..4f3f21d9b 100644 --- a/lib/react/server_rendering/webpacker_manifest_container.rb +++ b/lib/react/server_rendering/webpacker_manifest_container.rb @@ -15,7 +15,7 @@ def find_asset(logical_path) asset_path = Webpacker::Manifest.lookup(logical_path).to_s if asset_path.start_with?("http") # Get a file from the webpack-dev-server - dev_server_asset = URI.open(asset_path).read + dev_server_asset = URI(asset_path).open.read # Remove `webpack-dev-server/client/index.js` code which causes ExecJS to 💥 dev_server_asset.sub!(CLIENT_REQUIRE, '//\0') dev_server_asset