Replace WEBrick because it is no longer recommended for production use

sparrowt commented 5 days ago

Describe the bug

Fluentd depends on webrick and uses it in quite a few places and thus although it's no longer included in ruby, it is required (e.g. the dockerfile installs ruby-webrick).

There have been a fair few CVEs reported for webrick in recent years, but more worrying is that in response to a recent security vulnerability report, one of the maintainers said "webrick is not for production".

If fluentd contines to rely on this, it feels risky (e.g. maybe future reports may not be patched so quickly / at all).

Perhaps it would be wise to migrate each usage away from webrick to a production-suitable replacement?

To Reproduce

Install fluentd - you will not be able to do this without also installing webrick.

Expected behavior

We should move away from production use of a package which the maintainers no longer recommend for production use.

Your Environment

- Fluentd version: all recent versions
- Package version: N/A
- Operating system: N/A
- Kernel version: N/A

Your Configuration

Any configuration.

Your Error Log

N/A

Additional context

No response

daipom commented 5 days ago

Thanks for your report. This is more likely enhancement request rather than bug report. I think we need more opinions and ideas.

Athishpranav2003 commented 4 days ago

@daipom i saw this alternative https://github.com/socketry/falcon

Not sure if there are other alternatives, need to research more

fluent / fluentd