Repository navigation
Replace WEBrick because it is no longer recommended for production use #4648
Description
Describe the bug
Fluentd depends on webrick and uses it in quite a few places and thus although it's no longer included in ruby, it is required (e.g. the dockerfile installs ruby-webrick).
There have been a fair few CVEs reported for webrick in recent years, but more worrying is that in response to a recent security vulnerability report, one of the maintainers said "webrick is not for production".
If fluentd contines to rely on this, it feels risky (e.g. maybe future reports may not be patched so quickly / at all).
Perhaps it would be wise to migrate each usage away from webrick to a production-suitable replacement?
To Reproduce
Install fluentd - you will not be able to do this without also installing webrick.
Expected behavior
We should move away from production use of a package which the maintainers no longer recommend for production use.
Your Environment
- Fluentd version: all recent versions
- Package version: N/A
- Operating system: N/A
- Kernel version: N/AYour Configuration
Any configuration.Your Error Log
N/AAdditional context
No response
Activity
[-]Fluentd relies on webrick which is no longer recommended for production use[/-][+]Replace WEBrick because it is no longer recommended for production use[/+]daipom commentedon Sep 27, 2024
Thanks for your report.
This is more likely
enhancement requestrather thanbug report.I think we need more opinions and ideas.
Athishpranav2003 commentedon Sep 27, 2024
@daipom i saw this alternative
https://github.com/socketry/falcon
Not sure if there are other alternatives, need to research more
daipom commentedon Oct 2, 2024
@Athishpranav2003 Thanks!
So, Falcon is an option for us!
Sorry, since I'm unfamiliar with these libraries and don't have much time this month, I cannot say for sure about the direction now.
Athishpranav2003 commentedon Oct 2, 2024
It's similar for me
Maybe others active in Ruby community can give some comments on this
@Watson1978 ?
Watson1978 commentedon Oct 2, 2024
Fluentd has been used async-http and webrick for http server in in_http and RPC.
I think it would be better to integrate them into one library (async-http, falcon or another).
dentarg commentedon Oct 2, 2024
The most popular Ruby web server is Puma: https://github.com/puma/puma
Leodau commentedon Feb 5, 2025
Can we please get an update on this one?
https://security.snyk.io/vuln/SNYK-RUBY-WEBRICK-8068535
Watson1978 commentedon Feb 6, 2025
@Leodau Seems that the latest fluent-package LTS v5.0.5 contains webrick v1.8.2.
https://github.com/fluent/fluent-package-builder/releases/tag/v5.0.5
daipom commentedon Apr 10, 2025
Fluentd uses WEBrick for the following features mainly:
asyncis not installed, the feature is fallbacked to WEBrick)We should remove the fallback feature of
http_serverplugin helper.It was made for supporting environments whose Ruby version < 2.3.
For the RPC server, we should consider using http_server plugin helper.
9 remaining items
in_monitor_agent: remove needless require (fluent#4898)
http_server: stop fallback to WEBrick (fluent#4899)
daipom commentedon Apr 10, 2025
Remaining:
in_http(WEBrick::HTTPUtils)I have no idea how to replace
multipart/form-datahandling inin_http.fluentd/lib/fluent/plugin/in_http.rb
Lines 539 to 541 in 46372dd
It may not be important to avoid using
WEBrick::HTTPUtilssince it is just utils.kenhys commentedon Jun 25, 2025
If the remaining issues could be also fixed in a timely for v1.19,
it is okay to merge #4900 .
daipom commentedon Jun 25, 2025
Remaining issues except for #4900:
in_http:multipart/form-datain_http: replace WEBrick::HTTPUtils.parse_query with URI (fluent#4900)
daipom commentedon Jul 30, 2025
#4900 is merged.
Remaining:
Leodau commentedon Sep 3, 2025
Awesome thanks!