Fix CWE-78 in WebpackerManifestContainer: use URI.open instead of Kernel.open#4
Merged
j-sm-n merged 3 commits intoMay 15, 2026
Conversation
…ontainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
CodeQL flags URI.open with a non-constant value as well, recommending the
explicit URI(<uri>).open form. URI(asset_path) parses the value into a
URI::HTTP object (raising on invalid input) before any I/O occurs; the
subsequent #open only fetches via HTTP.
Functionally identical to the previous URI.open call (the branch is gated
on asset_path.start_with?("http")), but matches the CodeQL-recommended
pattern.
Resolves https://github.com/ezcater/react-rails/security/code-scanning/6.
Ticket: https://ezcater.atlassian.net/browse/MX-1385
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
bray
approved these changes
May 15, 2026
bray
left a comment
bray
left a comment
There was a problem hiding this comment.
Public repo, so codeowners error again :(
Author
I can still merge it, thankfully! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
master(alert #1) —rb/non-constant-kernel-openatlib/react/server_rendering/webpacker_manifest_container.rb:18.Kernel.openinterprets values beginning with|as shell commands.URI.openonly resolves URI schemes (http/https/ftp), which is the only case this branch handles (asset_path.start_with?("http")).README.mddocumenting that this fork is in a terminal state, that ez-rails consumes therails5branch (notmaster), and thatmasterexists primarily to satisfy CodeQL scans on the default branch.Context
This is the surgical patch chosen in the MX-1374 investigation. ez-rails is not exposed to the vulnerability — it pins the
rails5branch (704cf3a) which does not containwebpacker_manifest_container.rb, and theEzReactAssetContaineroverride in ez-rails would prevent this class from being instantiated even on later versions. No ez-rails change is required for this PR.The longer-term plan is to sunset this fork once ez-rails migrates off
react-railsSSR entirely; tracked separately as a 2027+ effort.Ticket: MX-1385
Test plan
ez-rails/Gemfile.lock:axlsxandreact-railsentries;react-railsis pinned tobranch: "rails5"which is untouched by this PR.🤖 Generated with Claude Code