Skip to content

Fix CWE-78 in WebpackerManifestContainer: use URI.open instead of Kernel.open #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
j-sm-n merged 3 commits into from
May 15, 2026
Merged

Fix CWE-78 in WebpackerManifestContainer: use URI.open instead of Kernel.open #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d9540ee
Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestC…
j-sm-n May 13, 2026
d1b58a3
Add Fork Status section to README
j-sm-n May 13, 2026
0d0e0d2
Use URI(uri).open to clear follow-up CodeQL alert
j-sm-n May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,19 @@
# react-rails

> [!IMPORTANT]
> **This is the ezCater internal fork of `reactjs/react-rails`, and it is in a terminal state.** Read the Fork Status section below before making changes here.

## Fork Status

- **No functional commits since 2017-06-30** ([`43e07ac`](https://github.com/ezcater/react-rails/commit/43e07ac), "2.2.1"). Subsequent activity on `master` is GitHub Actions hygiene only (CodeQL, CODEOWNERS, action SHA pinning).
- **`ez-rails` consumes the `rails5` branch, not `master`.** `rails5` is pinned at gem v1.7.1 (`master` is at v2.2.1). The two branches do not contain the same files.
- **The `master` branch exists primarily to satisfy CodeQL scans on the default branch.** Patches landed on `master` (e.g. the CWE-78 URI.open fix) are here to clear GitHub code scanning alerts. They are not consumed by `ez-rails` directly.
- **Long-term plan: archive this fork.** Once `ez-rails` migrates off `react-rails` SSR entirely, this fork will be archived. That work is tracked separately as a 2027+ effort owned by Monolith Experience. See the [MX-1374 investigation](https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893) for the full context and decision.

For questions, contact [#pb-s-monolith-experience](https://ezcater.slack.com/archives/C03TE7HHUFP).

---

[![Gem](https://img.shields.io/gem/v/react-rails.svg?style=flat-square)](http://rubygems.org/gems/react-rails)
[![Build Status](https://img.shields.io/travis/reactjs/react-rails/master.svg?style=flat-square)](https://travis-ci.org/reactjs/react-rails)
[![Gemnasium](https://img.shields.io/gemnasium/reactjs/react-rails.svg?style=flat-square)](https://gemnasium.com/reactjs/react-rails)
Expand Down
2 changes: 1 addition & 1 deletion lib/react/server_rendering/webpacker_manifest_container.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ def find_asset(logical_path)
asset_path = Webpacker::Manifest.lookup(logical_path).to_s
if asset_path.start_with?("http")
# Get a file from the webpack-dev-server
dev_server_asset = open(asset_path).read
dev_server_asset = URI(asset_path).open.read
# Remove `webpack-dev-server/client/index.js` code which causes ExecJS to 💥
dev_server_asset.sub!(CLIENT_REQUIRE, '//\0')
dev_server_asset
Expand Down