fluent / fluent/fluentd

Replace WEBrick because it is no longer recommended for production use

Open
#4,648 14 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Ruby
Stars
13.6k
Forks
1.4k
Avg merge
1d 3h
Merged PRs (30d)
20

Description

### Describe the bug

Fluentd [depends on `webrick`](https://github.com/fluent/fluentd/blob/7e39526150963beb4bafe1a874a97b536b93095d/fluentd.gemspec#L35) and uses it in [quite a few places](https://github.com/search?q=repo%3Afluent%2Ffluentd%20webrick&type=code) and thus although it's no longer included in ruby, it is required (e.g. [the dockerfile](https://github.com/fluent/fluentd-docker-image/blob/a5280782e6b2682d6e05acd781440d648d90304c/v1.17/alpine/Dockerfile#L14) installs `ruby-webrick`).

There have been a fair few CVEs reported for webrick in recent years, but more worrying is that in response to a recent security vulnerability report, one of the maintainers [said "webrick is not for production"](https://github.com/ruby/webrick/issues/145#issuecomment-2372838285).

If fluentd contines to rely on this, it feels risky (e.g. maybe future reports may not be patched so quickly / at all).

Perhaps it would be wise to migrate each usage away from webrick to a production-suitable replacement?

### To Reproduce

Install fluentd - you will not be able to do this without also installing webrick.

### Expected behavior

We should move away from production use of a package which the maintainers no longer recommend for production use.

### Your Environment

```markdown
- Fluentd version: all recent versions
- Package version: N/A
- Operating system: N/A
- Kernel version: N/A
```

### Your Configuration

```apache
Any configuration.
```

### Your Error Log

```shell
N/A
```

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.