Fix Warning/Error Caused by Using 'open' Instead of 'URI.open' by ksylvest · Pull Request #1099 · reactjs/react-rails

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest · 2021-01-02T21:46:43Z

Summary

Using open via the following snippet:

require'open-uri'open('https//...')

In ruby 2 results in the following deprecation warning:

warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open

In ruby 3 results in the following exception being raised:

Errno::ENOENT (No such file or directory @ rb_sysopen - https://...)

The fixes by calling open through URI.

Using open via the following snippet: require 'open-uri' open('https//...') In ruby 2 results in the following deprecation warning: warning: calling URI.open via Kernel#open is deprecated call URI.open directly or use URI#open In ruby 3 results in the following exception: Errno::ENOENT (No such file or directory @ rb_sysopen - https://...) The fixes by calling open through URI.

OddEssay · 2021-06-10T21:00:57Z

I was going to suggest the exact same PR as this after spending way to long trying to pin down the issue in my local build 😅

BookOfGreg · 2021-06-16T14:15:04Z

Thanks!

…nel.open (#4) * Fix CWE-78: use URI.open instead of Kernel.open in WebpackerManifestContainer Resolves GitHub code scanning alert #1 (rb/non-constant-kernel-open, critical) in lib/react/server_rendering/webpacker_manifest_container.rb. Kernel.open interprets values beginning with `|` as shell commands; URI.open only resolves URI schemes (http/https/ftp), which is the only case this branch handles. Mirrors the upstream fix shipped in reactjs/react-rails v2.6.2 (PR reactjs#1099). See MX-1374 investigation: https://ezcater.atlassian.net/wiki/spaces/POL/pages/6311247893 Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add Fork Status section to README Document that this fork is in a terminal state, that ez-rails consumes the rails5 branch (not master), and that master exists primarily to satisfy CodeQL scans on the default branch. Links to the MX-1374 investigation for the full context and the long-term sunset plan. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Use URI(uri).open to clear follow-up CodeQL alert CodeQL flags URI.open with a non-constant value as well, recommending the explicit URI(<uri>).open form. URI(asset_path) parses the value into a URI::HTTP object (raising on invalid input) before any I/O occurs; the subsequent #open only fetches via HTTP. Functionally identical to the previous URI.open call (the branch is gated on asset_path.start_with?("http")), but matches the CodeQL-recommended pattern. Resolves https://github.com/ezcater/react-rails/security/code-scanning/6. Ticket: https://ezcater.atlassian.net/browse/MX-1385 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ksylvest changed the title ~~Fix Warning/Error Caused by URI.open instead of open~~Fix Warning/Error Caused by Using 'open' Instead of 'URI.open'Jan 2, 2021

BookOfGreg merged commit c8c57bb into reactjs:masterJun 16, 2021

j-sm-n mentioned this pull request May 13, 2026
Fix CWE-78 in WebpackerManifestContainer: use URI.open instead of Kernel.open ezcater/react-rails#4
Merged
3 tasks