From 03adb51fe17f34048a854caa3cd737de09f421b0 Mon Sep 17 00:00:00 2001 From: Hiroshi SHIBATA Date: Wed, 22 Jul 2026 17:27:03 +0900 Subject: [PATCH] Clarify intended use and vulnerability handling policy The README and the rdoc discouraged production use but did not say how reports are handled. State that WEBrick is intended for testing and local development and is not intended to receive traffic from untrusted sources, and that while security issues are fixed in the open through the ordinary bug fixing process, the developers do not operate a vulnerability handling process and do not request CVE IDs. https://github.com/ruby/webrick/pull/199 Co-Authored-By: Claude Fable 5 --- README.md | 4 +++- lib/webrick.rb | 12 ++++++++++-- 2 files changed, 13 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 685dc84d..18fe5818 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,9 @@ A WEBrick server can be composed of multiple WEBrick servers or servlets to prov WEBrick also includes tools for daemonizing a process and starting a process at a higher privilege level and dropping permissions. -WEBrick is suitable for use in testing and for development. However, while the developers of WEBrick will attempt to fix security issues, they do not encourage the use of WEBrick to serve production web applications that may be subject to hostile input. +WEBrick is intended for use in testing and local development. It is not intended for production use, and it is not intended to receive traffic from untrusted sources. + +The developers of WEBrick will attempt to fix security issues, and they do so in the open, through the ordinary bug fixing process on GitHub. Because WEBrick is not intended to receive traffic from untrusted sources, the developers do not operate a vulnerability handling process for WEBrick. They do not treat reports against WEBrick as vulnerabilities and do not request CVE IDs for them. ## Installation diff --git a/lib/webrick.rb b/lib/webrick.rb index b854b68d..b23cef2a 100644 --- a/lib/webrick.rb +++ b/lib/webrick.rb @@ -17,8 +17,16 @@ # # == Security # -# *Warning:* WEBrick is not recommended for production. It only implements -# basic security checks. +# *Warning:* WEBrick is not intended for production use. It is intended for +# use in testing and local development, and it is not intended to receive +# traffic from untrusted sources. It only implements basic security checks. +# +# The developers of WEBrick will attempt to fix security issues, and they do +# so in the open, through the ordinary bug fixing process. Because WEBrick +# is not intended to receive traffic from untrusted sources, the developers +# do not operate a vulnerability handling process for WEBrick. They do not +# treat reports against WEBrick as vulnerabilities and do not request CVE +# IDs for them. # # == Starting an HTTP server #