better_errors 1.0.0 → 2.9.1

data/lib/better_errors/middleware.rb

@@ -1,6 +1,8 @@
 require "json"
 require "ipaddr"
+require "securerandom"
 require "set"
+require "rack"
 
 module BetterErrors
   # Better Errors' error handling middleware. Including this in your middleware
@@ -32,12 +34,14 @@ module BetterErrors
     # Adds an address to the set of IP addresses allowed to access Better
     # Errors.
     def self.allow_ip!(addr)
-      ALLOWED_IPS << IPAddr.new(addr)
+      ALLOWED_IPS << (addr.is_a?(IPAddr) ? addr : IPAddr.new(addr))
     end
 
     allow_ip! "127.0.0.0/8"
     allow_ip! "::1/128" rescue nil # windows ruby doesn't have ipv6 support
 
+    CSRF_TOKEN_COOKIE_NAME = "BetterErrors-#{BetterErrors::VERSION}-CSRF-Token"
+
     # A new instance of BetterErrors::Middleware
     #
     # @param app      The Rack app/middleware to wrap with Better Errors
@@ -62,17 +66,16 @@ module BetterErrors
   private
 
     def allow_ip?(env)
-      # REMOTE_ADDR is not in the rack spec, so some application servers do
-      # not provide it.
-      return true unless env["REMOTE_ADDR"] and !env["REMOTE_ADDR"].strip.empty?
-      ip = IPAddr.new env["REMOTE_ADDR"].split("%").first
+      request = Rack::Request.new(env)
+      return true unless request.ip and !request.ip.strip.empty?
+      ip = IPAddr.new request.ip.split("%").first
       ALLOWED_IPS.any? { |subnet| subnet.include? ip }
     end
 
     def better_errors_call(env)
       case env["PATH_INFO"]
-      when %r{/__better_errors/(?<oid>-?\d+)/(?<method>\w+)\z}
-        internal_call env, $~
+      when %r{/__better_errors/(?<id>.+?)/(?<method>\w+)\z}
+        internal_call(env, $~[:id], $~[:method])
       when %r{/__better_errors/?\z}
         show_error_page env
       else
@@ -89,53 +92,130 @@ module BetterErrors
     end
 
     def show_error_page(env, exception=nil)
+      request = Rack::Request.new(env)
+      csrf_token = request.cookies[CSRF_TOKEN_COOKIE_NAME] || SecureRandom.uuid
+
       type, content = if @error_page
         if text?(env)
           [ 'plain', @error_page.render('text') ]
         else
-          [ 'html', @error_page.render ]
+          [ 'html', @error_page.render('main', csrf_token) ]
         end
       else
         [ 'html', no_errors_page ]
       end
 
       status_code = 500
-      if defined? ActionDispatch::ExceptionWrapper
+      if defined?(ActionDispatch::ExceptionWrapper) && exception
         status_code = ActionDispatch::ExceptionWrapper.new(env, exception).status_code
       end
 
-      [status_code, { "Content-Type" => "text/#{type}; charset=utf-8" }, [content]]
+      response = Rack::Response.new(content, status_code, { "Content-Type" => "text/#{type}; charset=utf-8" })
+
+      unless request.cookies[CSRF_TOKEN_COOKIE_NAME]
+        response.set_cookie(CSRF_TOKEN_COOKIE_NAME, value: csrf_token, path: "/", httponly: true, same_site: :strict)
+      end
+
+      # In older versions of Rack, the body returned here is actually a Rack::BodyProxy which seems to be a bug.
+      # (It contains status, headers and body and does not act like an array of strings.)
+      # Since we already have status code and body here, there's no need to use the ones in the Rack::Response.
+      (_status_code, headers, _body) = response.finish
+      [status_code, headers, [content]]
     end
 
     def text?(env)
       env["HTTP_X_REQUESTED_WITH"] == "XMLHttpRequest" ||
-      !env["HTTP_ACCEPT"].to_s.include?('html')
+        !env["HTTP_ACCEPT"].to_s.include?('html')
     end
 
     def log_exception
       return unless BetterErrors.logger
 
-      message = "\n#{@error_page.exception.class} - #{@error_page.exception.message}:\n"
-      @error_page.backtrace_frames.each do |frame|
-        message << "  #{frame}\n"
-      end
+      message = "\n#{@error_page.exception_type} - #{@error_page.exception_message}:\n"
+      message += backtrace_frames.map { |frame| "  #{frame}\n" }.join
 
       BetterErrors.logger.fatal message
     end
 
-    def internal_call(env, opts)
-      if opts[:oid].to_i != @error_page.object_id
-        return [200, { "Content-Type" => "text/plain; charset=utf-8" }, [JSON.dump(error: "Session expired")]]
+    def backtrace_frames
+      if defined?(Rails) && defined?(Rails.backtrace_cleaner)
+        Rails.backtrace_cleaner.clean @error_page.backtrace_frames.map(&:to_s)
+      else
+        @error_page.backtrace_frames
       end
+    end
+
+    def internal_call(env, id, method)
+      return not_found_json_response unless %w[variables eval].include?(method)
+      return no_errors_json_response unless @error_page
+      return invalid_error_json_response if id != @error_page.id
+
+      request = Rack::Request.new(env)
+      return invalid_csrf_token_json_response unless request.cookies[CSRF_TOKEN_COOKIE_NAME]
+
+      request.body.rewind
+      body = JSON.parse(request.body.read)
+      return invalid_csrf_token_json_response unless request.cookies[CSRF_TOKEN_COOKIE_NAME] == body['csrfToken']
+
+      return not_acceptable_json_response unless request.content_type == 'application/json'
 
-      env["rack.input"].rewind
-      response = @error_page.send("do_#{opts[:method]}", JSON.parse(env["rack.input"].read))
-      [200, { "Content-Type" => "text/plain; charset=utf-8" }, [JSON.dump(response)]]
+      response = @error_page.send("do_#{method}", body)
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(response)]]
     end
 
     def no_errors_page
       "<h1>No errors</h1><p>No errors have been recorded yet.</p><hr>" +
       "<code>Better Errors v#{BetterErrors::VERSION}</code>"
     end
+
+    def no_errors_json_response
+      explanation = if defined? Middleman
+        "Middleman reloads all dependencies for each request, " +
+          "which breaks Better Errors."
+      elsif defined?(Shotgun) && defined?(Hanami)
+        "Hanami is likely running with code-reloading enabled, which is the default. " +
+          "You can disable this by running hanami with the `--no-code-reloading` option."
+      elsif defined? Shotgun
+        "The shotgun gem causes everything to be reloaded for every request. " +
+          "You can disable shotgun in the Gemfile temporarily to use Better Errors."
+      else
+        "The application has been restarted since this page loaded, " +
+          "or the framework is reloading all gems before each request "
+      end
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: 'No exception information available',
+        explanation: explanation,
+      )]]
+    end
+
+    def invalid_error_json_response
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Session expired",
+        explanation: "This page was likely opened from a previous exception, " +
+          "and the exception is no longer available in memory.",
+      )]]
+    end
+
+    def invalid_csrf_token_json_response
+      [200, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Invalid CSRF Token",
+        explanation: "The browser session might have been cleared, " +
+          "or something went wrong.",
+      )]]
+    end
+
+    def not_found_json_response
+      [404, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Not found",
+        explanation: "Not a recognized internal call.",
+      )]]
+    end
+
+    def not_acceptable_json_response
+      [406, { "Content-Type" => "application/json; charset=utf-8" }, [JSON.dump(
+        error: "Request not acceptable",
+        explanation: "The internal request did not match an acceptable content type.",
+      )]]
+    end
   end
 end

data/lib/better_errors/raised_exception.rb

@@ -0,0 +1,89 @@
+require 'better_errors/exception_hint'
+
+# @private
+module BetterErrors
+  class RaisedException
+    attr_reader :exception, :message, :backtrace, :hint
+
+    def initialize(exception)
+      if exception.class.name == "ActionView::Template::Error" && exception.respond_to?(:cause)
+        # Rails 6+ exceptions of this type wrap the "real" exception, and the real exception
+        # is actually more useful than the ActionView-provided wrapper. Once Better Errors
+        # supports showing all exceptions in the cause stack, this should go away. Or perhaps
+        # this can be changed to provide guidance by showing the second error in the cause stack
+        # under this condition.
+        exception = exception.cause if exception.cause
+      elsif exception.respond_to?(:original_exception) && exception.original_exception
+        # This supports some specific Rails exceptions, and this is not intended to act the same as
+        # the Ruby's {Exception#cause}.
+        # It's possible this should only support ActionView::Template::Error, but by not changing
+        # this we're preserving longstanding behavior of Better Errors with Rails < 6.
+        exception = exception.original_exception
+      end
+
+      @exception = exception
+      @message = exception.message
+
+      setup_backtrace
+      setup_hint
+      massage_syntax_error
+    end
+
+    def type
+      exception.class
+    end
+
+  private
+    def has_bindings?
+      exception.respond_to?(:__better_errors_bindings_stack) && exception.__better_errors_bindings_stack.any?
+    end
+
+    def setup_backtrace
+      if has_bindings?
+        setup_backtrace_from_bindings
+      else
+        setup_backtrace_from_backtrace
+      end
+    end
+
+    def setup_backtrace_from_bindings
+      @backtrace = exception.__better_errors_bindings_stack.map { |binding|
+        if binding.respond_to?(:source_location) # Ruby >= 2.6
+          file = binding.source_location[0]
+          line = binding.source_location[1]
+        else
+          file = binding.eval "__FILE__"
+          line = binding.eval "__LINE__"
+        end
+        name = binding.frame_description
+        StackFrame.new(file, line, name, binding)
+      }
+    end
+
+    def setup_backtrace_from_backtrace
+      @backtrace = (exception.backtrace || []).map { |frame|
+        if /\A(?<file>.*?):(?<line>\d+)(:in `(?<name>.*)')?/ =~ frame
+          StackFrame.new(file, line.to_i, name)
+        end
+      }.compact
+    end
+
+    def massage_syntax_error
+      case exception.class.to_s
+      when "Haml::SyntaxError", "Sprockets::Coffeelint::Error"
+        if /\A(.+?):(\d+)/ =~ exception.backtrace.first
+          backtrace.unshift(StackFrame.new($1, $2.to_i, ""))
+        end
+      when "SyntaxError"
+        if /\A(.+?):(\d+): (.*)/m =~ exception.message
+          backtrace.unshift(StackFrame.new($1, $2.to_i, ""))
+          @message = $3
+        end
+      end
+    end
+
+    def setup_hint
+      @hint = ExceptionHint.new(exception).hint
+    end
+  end
+end

data/lib/better_errors/repl/basic.rb

@@ -1,14 +1,14 @@
 module BetterErrors
   module REPL
     class Basic
-      def initialize(binding)
+      def initialize(binding, _exception)
         @binding = binding
       end
-    
+
       def send_input(str)
         [execute(str), ">>", ""]
       end
-    
+
     private
       def execute(str)
         "=> #{@binding.eval(str).inspect}\n"

data/lib/better_errors/repl/pry.rb

@@ -9,40 +9,50 @@ module BetterErrors
           Fiber.yield
         end
       end
-      
+
       class Output
         def initialize
           @buffer = ""
         end
-        
+
         def puts(*args)
           args.each do |arg|
             @buffer << "#{arg.chomp}\n"
           end
         end
-        
+
         def tty?
           false
         end
-        
+
         def read_buffer
           @buffer
         ensure
           @buffer = ""
         end
+
+        def print(*args)
+          @buffer << args.join(' ')
+        end
       end
-      
-      def initialize(binding)
+
+      def initialize(binding, exception)
         @fiber = Fiber.new do
           @pry.repl binding
         end
-        @input = Input.new
-        @output = Output.new
+        @input = BetterErrors::REPL::Pry::Input.new
+        @output = BetterErrors::REPL::Pry::Output.new
         @pry = ::Pry.new input: @input, output: @output
         @pry.hooks.clear_all if defined?(@pry.hooks.clear_all)
+        store_last_exception exception
         @fiber.resume
       end
-    
+
+      def store_last_exception(exception)
+        return unless defined? ::Pry::LastException
+        @pry.instance_variable_set(:@last_exception, ::Pry::LastException.new(exception.exception))
+      end
+
       def send_input(str)
         local ::Pry.config, color: false, pager: false do
           @fiber.resume "#{str}\n"
@@ -59,7 +69,7 @@ module BetterErrors
       rescue
         [">>", ""]
       end
-      
+
     private
       def local(obj, attrs)
         old_attrs = {}

data/lib/better_errors/repl.rb

@@ -9,19 +9,21 @@ module BetterErrors
     def self.provider
       @provider ||= const_get detect[:const]
     end
-    
+
     def self.provider=(prov)
       @provider = prov
     end
-    
+
     def self.detect
       PROVIDERS.find { |prov|
         test_provider prov
       }
     end
-    
+
     def self.test_provider(provider)
-      require provider[:impl]
+      # We must load this file instead of `require`ing it, since during our tests we want the file
+      # to be reloaded. In practice, this will only be called once, so `require` is not necessary.
+      load "#{provider[:impl]}.rb"
       true
     rescue LoadError
       false

data/lib/better_errors/stack_frame.rb

@@ -4,67 +4,26 @@ module BetterErrors
   # @private
   class StackFrame
     def self.from_exception(exception)
-      if has_binding_stack?(exception)
-        list = exception.__better_errors_bindings_stack.map { |binding|
-          file = binding.eval "__FILE__"
-          line = binding.eval "__LINE__"
-          name = binding.frame_description
-          StackFrame.new(file, line, name, binding)
-        }
-      else
-        list = (exception.backtrace || []).map { |frame|
-          next unless md = /\A(?<file>.*?):(?<line>\d+)(:in `(?<name>.*)')?/.match(frame)
-          StackFrame.new(md[:file], md[:line].to_i, md[:name])
-        }.compact
-      end
-
-      if syntax_error?(exception)
-        if trace = exception.backtrace and trace.first =~ /\A(.*):(\d+)/
-          list.unshift StackFrame.new($1, $2.to_i, "")
-        end
-      end
-
-      list
-    end
-
-    def self.syntax_error_classes
-      # Better Errors may be loaded before some of the gems that provide these
-      # classes, so we lazily set up the set of syntax error classes at runtime
-      # after everything has hopefully had a chance to load.
-      #
-      @syntax_error_classes ||= begin
-        class_names = %w[
-          Haml::SyntaxError
-        ]
-
-        Set.new(class_names.map { |klass| eval(klass) rescue nil }.compact)
-      end
+      RaisedException.new(exception).backtrace
     end
 
-    def self.syntax_error?(exception)
-      exception.is_a?(SyntaxError) || syntax_error_classes.include?(exception.class)
-    end
-
-    def self.has_binding_stack?(exception)
-      exception.respond_to?(:__better_errors_bindings_stack) && exception.__better_errors_bindings_stack.any?
-    end
-    
     attr_reader :filename, :line, :name, :frame_binding
-    
+
     def initialize(filename, line, name, frame_binding = nil)
       @filename       = filename
       @line           = line
       @name           = name
       @frame_binding  = frame_binding
-      
+
       set_pretty_method_name if frame_binding
     end
-    
+
     def application?
-      root = BetterErrors.application_root
-      filename.index(root) == 0 if root
+      if root = BetterErrors.application_root
+        filename.index(root) == 0 && filename.index("#{root}/vendor") != 0
+      end
     end
-    
+
     def application_path
       filename[(BetterErrors.application_root.length+1)..-1]
     end
@@ -72,9 +31,9 @@ module BetterErrors
     def gem?
       Gem.path.any? { |path| filename.index(path) == 0 }
     end
-    
+
     def gem_path
-      if path = Gem.path.detect { |path| filename.index(path) == 0 }
+      if path = Gem.path.detect { |p| filename.index(p) == 0 }
         gem_name_and_version, path = filename.sub("#{path}/gems/", "").split("/", 2)
         /(?<gem_name>.+)-(?<gem_version>[\w.]+)/ =~ gem_name_and_version
         "#{gem_name} (#{gem_version}) #{path}"
@@ -88,7 +47,7 @@ module BetterErrors
     def method_name
       @method_name || @name
     end
-    
+
     def context
       if gem?
         :gem
@@ -98,7 +57,7 @@ module BetterErrors
         :dunno
       end
     end
-    
+
     def pretty_path
       case context
       when :application;  application_path
@@ -106,23 +65,30 @@ module BetterErrors
       else                filename
       end
     end
-    
+
     def local_variables
       return {} unless frame_binding
-      frame_binding.eval("local_variables").each_with_object({}) do |name, hash|
-        begin
-          if defined?(frame_binding.local_variable_get)
-            hash[name] = frame_binding.local_variable_get(name)
-          else
-            hash[name] = frame_binding.eval(name.to_s)
-          end
-        rescue NameError => e
-          # local_variables sometimes returns broken variables.
-          # https://bugs.ruby-lang.org/issues/7536
-        end
+
+      lv = frame_binding.eval("local_variables")
+      return {} unless lv
+
+      lv.each_with_object({}) do |name, hash|
+        # Ruby 2.2's local_variables will include the hidden #$! variable if
+        # called from within a rescue context. This is not a valid variable name,
+        # so the local_variable_get method complains. This should probably be
+        # considered a bug in Ruby itself, but we need to work around it.
+        next if name == :"\#$!"
+
+        hash[name] = local_variable(name)
       end
     end
-    
+
+    def local_variable(name)
+      get_local_variable(name) || eval_local_variable(name)
+    rescue NameError => ex
+      "#{ex.class}: #{ex.message}"
+    end
+
     def instance_variables
       return {} unless frame_binding
       Hash[visible_instance_variables.map { |x|
@@ -131,23 +97,24 @@ module BetterErrors
     end
 
     def visible_instance_variables
-      frame_binding.eval("instance_variables") - BetterErrors.ignored_instance_variables
+      iv = frame_binding.eval("instance_variables")
+      return {} unless iv
+
+      iv - BetterErrors.ignored_instance_variables
     end
 
     def to_s
       "#{pretty_path}:#{line}:in `#{name}'"
     end
-    
+
   private
     def set_pretty_method_name
-      return if RUBY_VERSION < "2.0.0"
-
       name =~ /\A(block (\([^)]+\) )?in )?/
       recv = frame_binding.eval("self")
 
       return unless method_name = frame_binding.eval("::Kernel.__method__")
 
-      if Kernel.instance_method(:is_a?).bind(recv).call Module
+      if Module === recv
         @class_name = "#{$1}#{recv}"
         @method_name = ".#{method_name}"
       else
@@ -155,5 +122,15 @@ module BetterErrors
         @method_name = "##{method_name}"
       end
     end
+
+    def get_local_variable(name)
+      if defined?(frame_binding.local_variable_get)
+        frame_binding.local_variable_get(name)
+      end
+    end
+
+    def eval_local_variable(name)
+      frame_binding.eval(name.to_s)
+    end
   end
 end