airbrake-ruby 4.7.0

data/spec/filters/sql_filter_spec.rb

@@ -0,0 +1,262 @@
+RSpec.describe Airbrake::Filters::SqlFilter do
+  shared_examples "query filtering" do |test|
+    test[:dialects].each do |dialect|
+      it "correctly filters SQL like `#{test[:input]}' (#{dialect} dialect)" do
+        filter = described_class.new(dialect)
+        q = OpenStruct.new(query: test[:input])
+        filter.call(q)
+        expect(q.query).to eq(test[:output])
+      end
+    end
+  end
+
+  shared_examples "query blacklisting" do |query, opts|
+    it "ignores '#{query}'" do
+      filter = described_class.new('postgres')
+      q = Airbrake::Query.new(
+        query: query, method: 'GET', route: '/', start_time: Time.now
+      )
+      filter.call(q)
+
+      expect(q.ignored?).to eq(opts[:should_ignore])
+    end
+  end
+
+  ALL_DIALECTS = %i[mysql postgres sqlite cassandra oracle].freeze
+
+  # rubocop:disable Metrics/LineLength
+  [
+    {
+      input: 'SELECT * FROM things;',
+      output: 'SELECT * FROM things;',
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT `t001`.`c2` FROM `t001` WHERE `t001`.`c2` = 'value' AND c3=\"othervalue\" LIMIT ?",
+      output: "SELECT `t001`.`c2` FROM `t001` WHERE `t001`.`c2` = ? AND c3=? LIMIT ?",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT * FROM t WHERE foo=\"bar/*\" AND baz=\"whatever */qux\"",
+      output: "SELECT * FROM t WHERE foo=? AND baz=?",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT * FROM t WHERE foo='bar/*' AND baz='whatever */qux'",
+      output: "SELECT * FROM t WHERE foo=? AND baz=?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT \"t001\".\"c2\" FROM \"t001\" WHERE \"t001\".\"c2\" = 'value' AND c3=1234 LIMIT 1",
+      output: "SELECT \"t001\".\"c2\" FROM \"t001\" WHERE \"t001\".\"c2\" = ? AND c3=? LIMIT ?",
+      dialects: %i[postgres oracle]
+    }, {
+      input: "SELECT * FROM t WHERE foo=\"bar--\" AND\n  baz=\"qux--\"",
+      output: "SELECT * FROM t WHERE foo=? AND\n  baz=?",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT * FROM t WHERE foo='bar--' AND\n  baz='qux--'",
+      output: "SELECT * FROM t WHERE foo=? AND\n  baz=?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM foo WHERE bar='baz' /* Hide Me */",
+      output: "SELECT * FROM foo WHERE bar=? ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM foobar WHERE password='hunter2'\n-- No peeking!",
+      output: "SELECT * FROM foobar WHERE password=?\n?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT foo, bar FROM baz WHERE password='hunter2' # Secret",
+      output: "SELECT foo, bar FROM baz WHERE password=? ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT \"col1\", \"col2\" from \"table\" WHERE \"col3\"=E'foo\\'bar\\\\baz' AND country=e'foo\\'bar\\\\baz'",
+      output: "SELECT \"col1\", \"col2\" from \"table\" WHERE \"col3\"=E?",
+      dialects: %i[postgres]
+    }, {
+      input: "INSERT INTO `X` values(\"test\",0, 1 , 2, 'test')",
+      output: "INSERT INTO `X` values(?)",
+      dialects: %i[mysql]
+    }, {
+      input: "INSERT INTO `X` values(\"test\",0, 1 , 2, 'test')",
+      output: "INSERT INTO `X` values(?)",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT c11.col1, c22.col2 FROM table c11, table c22 WHERE value='nothing'",
+      output: "SELECT c11.col1, c22.col2 FROM table c11, table c22 WHERE value=?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "INSERT INTO X VALUES(1, 23456, 123.456, 99+100)",
+      output: "INSERT INTO X VALUES(?)",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM table WHERE name=\"foo\" AND value=\"don't\"",
+      output: "SELECT * FROM table WHERE name=? AND value=?",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT * FROM table WHERE name='foo' AND value = 'bar'",
+      output: "SELECT * FROM table WHERE name=? AND value = ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM table WHERE col='foo\\''bar'",
+      output: "SELECT * FROM table WHERE col=?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM table WHERE col1='foo\"bar' AND col2='what\"ever'",
+      output: "SELECT * FROM table WHERE col1=? AND col2=?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "select * from accounts where accounts.name != 'dude\n newline' order by accounts.name",
+      output: "select * from accounts where accounts.name != ? order by accounts.name",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM table WHERE col1=\"don't\" AND col2=\"won't\"",
+      output: "SELECT * FROM table WHERE col1=? AND col2=?",
+      dialects: %i[mysql]
+    }, {
+      input: "INSERT INTO X values('', 'jim''s ssn',0, 1 , 'jim''s son''s son', \"\"\"jim''s\"\" hat\", \"\\\"jim''s secret\\\"\")",
+      output: "INSERT INTO X values(?, ?,?, ? , ?, ?, ?",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT * FROM table WHERE name='foo\\' AND color='blue'",
+      output: "SELECT * FROM table WHERE name=?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM table WHERE foo=\"this string ends with a backslash\\\\\"",
+      output: "SELECT * FROM table WHERE foo=?",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT * FROM table WHERE foo='this string ends with a backslash\\\\'",
+      output: "SELECT * FROM table WHERE foo=?",
+      dialects: ALL_DIALECTS
+    }, {
+      # TODO: fix this example.
+      input: "SELECT * FROM table WHERE name='foo\'' AND color='blue'",
+      output: "Error: Airbrake::Query was not filtered",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "INSERT INTO X values('', 'a''b c',0, 1 , 'd''e f''s h')",
+      output: "INSERT INTO X values(?)",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM t WHERE -- '\n  bar='baz' -- '",
+      output: "SELECT * FROM t WHERE ?\n  bar=? ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM t WHERE /* ' */\n  bar='baz' -- '",
+      output: "SELECT * FROM t WHERE ?\n  bar=? ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM t WHERE -- '\n  /* ' */ c2='xxx' /* ' */\n  c='x\n  xx' -- '",
+      output: "SELECT * FROM t WHERE ?\n  ? c2=? ?\n  c=? ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM t WHERE -- '\n  c='x\n  xx' -- '",
+      output: "SELECT * FROM t WHERE ?\n  c=? ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM foo WHERE col='value1' AND /* don't */ col2='value1' /* won't */",
+      output: "SELECT * FROM foo WHERE col=? AND ? col2=? ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM table WHERE foo='bar' AND baz=\"nothing to see here'",
+      output: "Error: Airbrake::Query was not filtered",
+      dialects: %i[mysql]
+    }, {
+      input: "SELECT * FROM table WHERE foo='bar' AND baz='nothing to see here",
+      output: "Error: Airbrake::Query was not filtered",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "SELECT * FROM \"foo\" WHERE \"foo\" = $a$dollar quotes can be $b$nested$b$$a$ and bar = 'baz'",
+      output: "SELECT * FROM \"foo\" WHERE \"foo\" = ? and bar = ?",
+      dialects: %i[postgres]
+    }, {
+      input: "INSERT INTO \"foo\" (\"bar\", \"baz\", \"qux\") VALUES ($1, $2, $3) RETURNING \"id\"",
+      output: "INSERT INTO \"foo\" (?) RETURNING \"id\"",
+      dialects: %i[postgres]
+    }, {
+      input: "select * from foo where bar = 'some\\tthing' and baz = 10",
+      output: "select * from foo where bar = ? and baz = ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "select * from users where user = 'user1\\' password = 'hunter 2' -- ->don't count this quote",
+      output: "select * from users where user = ?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "select * from foo where bar=q'[baz's]' and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[oracle]
+    }, {
+      input: "select * from foo where bar=q'{baz's}' and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[oracle]
+    }, {
+      input: "select * from foo where bar=q'<baz's>' and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[oracle]
+    }, {
+      input: "select * from foo where bar=q'(baz's)' and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[oracle]
+    }, {
+      input: "select * from foo where bar=0xabcdef123 and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[cassandra sqlite]
+    }, {
+      input: "select * from foo where bar=0x2F and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[mysql cassandra sqlite]
+    }, {
+      input: "select * from foo where bar=1.234e-5 and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: ALL_DIALECTS
+    }, {
+      input: "select * from foo where bar=01234567-89ab-cdef-0123-456789abcdef and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[postgres cassandra]
+    }, {
+      input: "select * from foo where bar={01234567-89ab-cdef-0123-456789abcdef} and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[postgres]
+    }, {
+      input: "select * from foo where bar=0123456789abcdef0123456789abcdef and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[postgtes]
+    }, {
+      input: "select * from foo where bar={012-345678-9abc-def012345678-9abcdef} and x=5",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[postgres]
+    }, {
+      input: "select * from foo where bar=true and x=FALSE",
+      output: "select * from foo where bar=? and x=?",
+      dialects: %i[mysql postgres cassandra sqlite]
+    }
+  ].each do |test|
+    include_examples 'query filtering', test
+  end
+  # rubocop:enable Metrics/LineLength
+
+  [
+    'COMMIT',
+    'commit',
+    'BEGIN',
+    'begin',
+    'SET time zone ?',
+    'set time zone ?',
+    'SHOW max_identifier_length',
+    'show max_identifier_length',
+
+    'WITH pk_constraint AS ( SELECT conrelid, unnest(conkey) AS connum ' \
+    'FROM pg_constraint WHERE contype = ? AND conrelid = ?::regclass ), ' \
+    'cons AS ( SELECT conrelid, connum, row_number() OVER() AS rownum FROM ' \
+    'pk_constraint ) SELECT attr.attname FROM pg_attribute attr INNER JOIN ' \
+    'cons ON attr.attrelid = cons.conrelid AND attr.attnum = cons.connum ' \
+    'ORDER BY cons.rownum'
+
+  ].each do |query|
+    include_examples 'query blacklisting', query, should_ignore: true
+  end
+
+  [
+    'UPDATE "users" SET "last_sign_in_at" = ? WHERE "users"."id" = ?'
+  ].each do |query|
+    include_examples 'query blacklisting', query, should_ignore: false
+  end
+end

data/spec/filters/system_exit_filter_spec.rb

@@ -0,0 +1,14 @@
+RSpec.describe Airbrake::Filters::SystemExitFilter do
+  it "marks SystemExit exceptions as ignored" do
+    notice = Airbrake::Notice.new(SystemExit.new)
+    expect { subject.call(notice) }.to(
+      change { notice.ignored? }.from(false).to(true)
+    )
+  end
+
+  it "doesn't mark non SystemExit exceptions as ignored" do
+    notice = Airbrake::Notice.new(AirbrakeTestError.new)
+    expect(notice).not_to be_ignored
+    expect { subject.call(notice) }.not_to(change { notice.ignored? })
+  end
+end

data/spec/filters/thread_filter_spec.rb

@@ -0,0 +1,277 @@
+RSpec.describe Airbrake::Filters::ThreadFilter do
+  let(:notice) { Airbrake::Notice.new(AirbrakeTestError.new) }
+
+  def new_thread
+    Thread.new do
+      th = Thread.current
+
+      # Ensure a thread always has some variable to make sure the
+      # :fiber_variables Hash is always present.
+      th[:random_var] = 42
+      yield(th)
+    end.join
+  end
+
+  describe "thread variables" do
+    shared_examples "expected thread variable" do |var|
+      it "attaches the thread variable" do
+        new_thread do |th|
+          th.thread_variable_set(:bingo, var)
+          subject.call(notice)
+        end
+
+        expect(notice[:params][:thread][:thread_variables][:bingo]).to eq(var)
+      end
+    end
+
+    context "given nil" do
+      include_examples "expected thread variable", nil
+    end
+
+    context "given true" do
+      include_examples "expected thread variable", true
+    end
+
+    context "given false" do
+      include_examples "expected thread variable", false
+    end
+
+    context "given a String" do
+      include_examples "expected thread variable", 'bango'
+    end
+
+    context "given a Symbol" do
+      include_examples "expected thread variable", :bango
+    end
+
+    context "given a Regexp" do
+      include_examples "expected thread variable", /bango/
+    end
+
+    context "given an Integer" do
+      include_examples "expected thread variable", 1
+    end
+
+    context "given a Float" do
+      include_examples "expected thread variable", 1.01
+    end
+
+    context "given an Object" do
+      it "converts it to a String and attaches" do
+        new_thread do |th|
+          th.thread_variable_set(:bingo, Object.new)
+          subject.call(notice)
+        end
+
+        vars = notice[:params][:thread][:thread_variables]
+        expect(vars[:bingo]).to match(/\A#<Object:.+>\z/)
+      end
+    end
+
+    context "given an Array of nested Hashes with complex objects" do
+      let(:var) do
+        [
+          {
+            bango: {
+              bongo: [
+                {
+                  bish: {
+                    bash: 'foo',
+                    bosh: Object.new
+                  }
+                }
+              ]
+            }
+          },
+          123
+        ]
+      end
+
+      it "converts objects to a safe objects" do
+        new_thread do |th|
+          th.thread_variable_set(:bingo, var)
+          subject.call(notice)
+        end
+
+        vars = notice[:params][:thread][:thread_variables]
+        expect(vars[:bingo]).to(
+          match(
+            [
+              {
+                bango: {
+                  bongo: [
+                    {
+                      bish: {
+                        bash: 'foo',
+                        bosh: /\A#<Object:.+>\z/
+                      }
+                    }
+                  ]
+                }
+              },
+              123
+            ]
+          )
+        )
+      end
+    end
+
+    it "ignores thread variables starting with an underscore" do
+      var = :__recursive_key__
+
+      new_thread do |th|
+        th.thread_variable_set(var, :bingo)
+        subject.call(notice)
+      end
+
+      thread_variables = notice[:params][:thread][:thread_variables]
+      expect(thread_variables).to be_nil
+    end
+  end
+
+  describe "fiber variables" do
+    shared_examples "expected fiber variable" do |var|
+      it "attaches the fiber variable" do
+        new_thread do |th|
+          th[:bingo] = var
+          subject.call(notice)
+        end
+
+        expect(notice[:params][:thread][:fiber_variables][:bingo]).to eq(var)
+      end
+    end
+
+    context "given nil" do
+      include_examples "expected fiber variable", nil
+    end
+
+    context "given true" do
+      include_examples "expected fiber variable", true
+    end
+
+    context "given false" do
+      include_examples "expected fiber variable", false
+    end
+
+    context "given a String" do
+      include_examples "expected fiber variable", 'bango'
+    end
+
+    context "given a Symbol" do
+      include_examples "expected fiber variable", :bango
+    end
+
+    context "given a Regexp" do
+      include_examples "expected fiber variable", /bango/
+    end
+
+    context "given an Integer" do
+      include_examples "expected fiber variable", 1
+    end
+
+    context "given a Float" do
+      include_examples "expected fiber variable", 1.01
+    end
+
+    context "given an Object" do
+      it "converts it to a String and attaches" do
+        new_thread do |th|
+          th[:bingo] = Object.new
+          subject.call(notice)
+        end
+
+        vars = notice[:params][:thread][:fiber_variables]
+        expect(vars[:bingo]).to match(/\A#<Object:.+>\z/)
+      end
+    end
+
+    context "given an Array of nested Hashes with complex objects" do
+      let(:var) do
+        [
+          {
+            bango: {
+              bongo: [
+                {
+                  bish: {
+                    bash: 'foo',
+                    bosh: Object.new
+                  }
+                }
+              ]
+            }
+          },
+          123
+        ]
+      end
+
+      it "converts objects to a safe objects" do
+        new_thread do |th|
+          th[:bingo] = var
+          subject.call(notice)
+        end
+
+        vars = notice[:params][:thread][:fiber_variables]
+        expect(vars[:bingo]).to(
+          match(
+            [
+              {
+                bango: {
+                  bongo: [
+                    {
+                      bish: {
+                        bash: 'foo',
+                        bosh: /\A#<Object:.+>\z/
+                      }
+                    }
+                  ]
+                }
+              },
+              123
+            ]
+          )
+        )
+      end
+    end
+  end
+
+  it "appends name", skip: !Thread.current.respond_to?(:name) do
+    new_thread do |th|
+      th.name = 'bingo'
+      subject.call(notice)
+    end
+
+    expect(notice[:params][:thread][:name]).to eq('bingo')
+  end
+
+  it "appends thread inspect (self)" do
+    subject.call(notice)
+    expect(notice[:params][:thread][:self]).to match(/\A#<Thread:.+>\z/)
+  end
+
+  it "appends thread group" do
+    subject.call(notice)
+    expect(notice[:params][:thread][:group][0]).to match(/\A#<Thread:.+>\z/)
+  end
+
+  it "appends priority" do
+    subject.call(notice)
+    expect(notice[:params][:thread][:priority]).to eq(0)
+  end
+
+  it "appends safe_level", skip: Airbrake::JRUBY do
+    subject.call(notice)
+    expect(notice[:params][:thread][:safe_level]).to eq(0)
+  end
+
+  it "ignores fiber variables starting with an underscore" do
+    key = :__recursive_key__
+
+    new_thread do |th|
+      th[key] = :bingo
+      subject.call(notice)
+    end
+
+    fiber_variables = notice[:params][:thread][:fiber_variables]
+    expect(fiber_variables[key]).to be_nil
+  end
+end