debugbundle 1.4.1 → 2.0.0

data/lib/debugbundle/client_event_support.rb

@@ -1,11 +1,16 @@
 # frozen_string_literal: true
 
+require 'debugbundle/safe_input'
+
 module DebugBundle
   class Client
     module EventSupport
       private
 
-      def capture_enabled? = config.enabled? && config.configured?
+      def capture_enabled?
+        ensure_current_process!
+        config.enabled? && config.configured?
+      end
 
       def merge_context(context)
         merged = @context.merge(stringify_hash(context || {}))
@@ -16,7 +21,8 @@ module DebugBundle
         return {} unless value.is_a?(Hash)
 
         value.each_with_object({}) do |(key, nested_value), result|
-          result[key.to_s] = nested_value
+          safe_key = SafeInput.key(key)
+          result[safe_key] = nested_value if safe_key
         end
       end
 
@@ -44,20 +50,78 @@ module DebugBundle
 
       def exception_causes(error)
         causes = []
-        current = error.cause
+        current = safe_exception_cause(error)
+        seen = {}.compare_by_identity
+        seen[error] = true
 
-        while current
+        while current && causes.length < 8 && !seen[current]
+          seen[current] = true
           causes << {
-            'name' => current.class.name,
-            'message' => current.message.to_s,
-            'stack' => Array(current.backtrace).join("\n")
+            'name' => safe_exception_name(current),
+            'message' => safe_exception_message(current),
+            'stack' => safe_exception_stack(current)
           }
-          current = current.cause
+          current = safe_exception_cause(current)
         end
 
         causes
       end
 
+      def safe_exception_message(error)
+        value = Exception.instance_method(:to_s).bind_call(error)
+        value.is_a?(String) ? value[0, 4096] : '[exception message unavailable]'
+      rescue StandardError
+        '[exception message unavailable]'
+      end
+
+      def safe_exception_name(error)
+        type = Object.instance_method(:class).bind_call(error)
+        value = Module.instance_method(:name).bind_call(type)
+        value.is_a?(String) && !value.empty? ? value[0, 256] : 'Exception'
+      rescue StandardError
+        'Exception'
+      end
+
+      def safe_exception_stack(error)
+        frames = Exception.instance_method(:backtrace).bind_call(error)
+        return '' unless frames.is_a?(Array)
+
+        frames.first(64).filter_map { |frame| frame[0, 512] if frame.is_a?(String) }.join("\n")[0, 16_384]
+      rescue StandardError
+        ''
+      end
+
+      def safe_exception_cause(error)
+        Exception.instance_method(:cause).bind_call(error)
+      rescue StandardError
+        nil
+      end
+
+      def safe_log_message(value)
+        is_a = Object.instance_method(:is_a?)
+        return String.instance_method(:[]).bind_call(value, 0, 16_384) if is_a.bind_call(value, String)
+
+        if is_a.bind_call(value, Integer)
+          return '[unsupported log message]' if Integer.instance_method(:bit_length).bind_call(value) > 4096
+
+          return Integer.instance_method(:to_s).bind_call(value)
+        end
+        return Float.instance_method(:to_s).bind_call(value) if is_a.bind_call(value, Float)
+
+        if is_a.bind_call(value, Symbol)
+          return '[unsupported log message]' if Symbol.instance_method(:length).bind_call(value) > 16_384
+
+          return Symbol.instance_method(:to_s).bind_call(value)
+        end
+        return TrueClass.instance_method(:to_s).bind_call(value) if is_a.bind_call(value, TrueClass)
+        return FalseClass.instance_method(:to_s).bind_call(value) if is_a.bind_call(value, FalseClass)
+        return '' if is_a.bind_call(value, NilClass)
+
+        '[unsupported log message]'
+      rescue StandardError
+        '[unsupported log message]'
+      end
+
       def probe_snapshot
         items = @probe_buffers.values.flatten.map do |entry|
           entry.merge('activation_id' => nil)
@@ -74,32 +138,35 @@ module DebugBundle
       end
 
       def normalize_probe_data(value)
-        redacted = @redactor.redact_value(value)
+        redacted = TelemetryPrivacy.protect(@redactor.redact_value(value), additional_fields: config.redact_fields)
         redacted.is_a?(Hash) ? redacted : { 'value' => redacted }
+      rescue StandardError
+        { 'value' => '[REDACTED]' }
       end
 
       def apply_before_send(event)
-        BeforeSend.apply(event, config.before_send)
-      end
+        protected = protect_event(event)
+        return nil unless protected
 
-      def enqueue_event(event)
-        return unless sampled_in?
-
-        @buffer_mutex.synchronize do
-          @buffer << event
-          @buffer.shift while @buffer.length > MAX_BUFFER_SIZE
-        end
+        prepared = BeforeSend.apply(protected, config.before_send)
+        prepared && protect_event(prepared)
       end
 
-      def buffered_batch
-        @buffer_mutex.synchronize { @buffer.dup }
-      end
+      def protect_event(event)
+        return nil unless TelemetryPrivacy.safe_event_identity?(event, additional_fields: config.redact_fields)
+
+        fields = TelemetryPrivacy.protect(
+          { 'service' => event['service'], 'payload' => event['payload'], 'context' => event['context'] },
+          additional_fields: config.redact_fields
+        )
+        return nil unless fields['service'].is_a?(Hash) && fields['payload'].is_a?(Hash)
+        return nil unless fields['service']['name'].is_a?(String) && fields['service']['environment'].is_a?(String)
 
-      def remove_buffered_events(events)
-        event_ids = events.map { |event| event['event_id'] }
-        @buffer_mutex.synchronize do
-          @buffer.reject! { |event| event_ids.include?(event['event_id']) }
+        event.merge('service' => fields['service'], 'payload' => fields['payload']).tap do |protected|
+          protected['context'] = fields['context'] if event.key?('context')
         end
+      rescue StandardError
+        nil
       end
 
       def sampled_in?
@@ -113,8 +180,7 @@ module DebugBundle
 
       def append_suppression_aggregates
         @suppression.drain_aggregates(now: monotonic_now).each do |aggregate|
-          event = apply_before_send(base_event('error_suppressed', aggregate, {}))
-          enqueue_event(event) if event
+          enqueue_event(base_event('error_suppressed', aggregate, {}))
         end
       end
 
@@ -192,17 +258,7 @@ module DebugBundle
       end
 
       def object_to_hash(value)
-        case value
-        when Hash
-          stringify_hash(value)
-        else
-          return stringify_hash(value.to_h) if value.respond_to?(:to_h)
-          return stringify_hash(value.to_hash) if value.respond_to?(:to_hash)
-
-          {}
-        end
-      rescue StandardError
-        {}
+        value.is_a?(Hash) ? stringify_hash(value) : {}
       end
 
       def sanitized_headers(headers)
@@ -222,6 +278,8 @@ module DebugBundle
       end
 
       def level_enabled?(level)
+        return false if @capture_policy.capture_logs == 'off'
+
         threshold = [normalize_level(config.log_level), policy_log_level].max_by do |entry|
           LOG_LEVEL_RANKS.fetch(entry)
         end

data/lib/debugbundle/client_process_support.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module DebugBundle
+  class Client
+    module ProcessSupport
+      private
+
+      def ensure_current_process!
+        current_pid = Process.pid
+        return if @owner_pid == current_pid
+
+        inherited_policy = @capture_policy
+        inherited_probes_enabled = @remote_config.probes_enabled
+        # A fork inherits buffers, locks, and an unusable sender thread. Reset them
+        # before touching any inherited synchronization object or captured event.
+        @buffer = []
+        @buffer_bytes = 0
+        @buffer_priority_counts = [0, 0, 0, 0]
+        @inflight_event_ids = Set.new
+        @inflight_priority_counts = [0, 0, 0, 0]
+        @event_sizes = {}
+        @pressure_drops = {}
+        @hook_bypass = Set.new
+        @finalized_events = {}
+        @buffer_mutex = Mutex.new
+        @flush_mutex = Mutex.new
+        @probe_buffers = {}
+        @context = {}
+        @suppression = Suppression::Tracker.new
+        @last_event_at = nil
+        @retry_at = nil
+        @consecutive_failures = 0
+        @acknowledgement_state = nil
+        @next_remote_config_poll_at = nil
+        @remote_config_etag = nil
+        @remote_config = RemoteConfig::Snapshot.default
+        @remote_config.probes_enabled = inherited_probes_enabled
+        @capture_policy = @config_fetcher ? inherited_policy : @remote_config.capture_policy
+        @remote_config.capture_policy = @capture_policy
+        @initial_remote_config_pending = !@config_fetcher.nil?
+        @delivery_worker = nil
+        @config_worker = nil
+        @owner_pid = current_pid
+        return unless config.enabled? && config.configured?
+
+        @delivery_worker = DeliveryWorker.new(
+          interval: config.flush_interval,
+          before_work: -> {},
+          &method(:flush_now)
+        )
+        if @config_fetcher
+          @config_worker = ConfigWorker.new(
+            next_wait_seconds: method(:next_remote_config_wait_seconds),
+            &method(:refresh_remote_config_on_worker)
+          )
+        end
+      rescue StandardError
+        # Capture must remain best-effort if a child cannot start a sender.
+        @delivery_worker = nil
+        @config_worker = nil
+      end
+    end
+  end
+end

data/lib/debugbundle/client_queue_support.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+module DebugBundle
+  class Client
+    module QueueSupport
+      private
+
+      def preflight_capacity?(priority, kind)
+        @buffer_mutex.synchronize do
+          full = @buffer.length >= MAX_BUFFER_SIZE || @buffer_bytes >= MAX_BUFFER_BYTES
+          evictable = @buffer_priority_counts.take(priority).sum - @inflight_priority_counts.take(priority).sum
+          return true unless full && evictable.zero?
+
+          record_pressure_kind_locked(kind, Time.now.utc.iso8601)
+          false
+        end
+      end
+
+      def enqueue_event(event, skip_before_send: false, record_pressure: true)
+        event = protect_event(event)
+        return unless event
+        return unless sampled_in?
+
+        event_size = JSON.generate(event).bytesize
+        admitted, buffered = @buffer_mutex.synchronize do
+          unless admit_event_locked?(event, event_size)
+            record_pressure_drop_locked(event) if record_pressure
+            next [false, @buffer.length]
+          end
+
+          @buffer << event
+          @buffer_bytes += event_size
+          @buffer_priority_counts[event_priority(event)] += 1
+          @event_sizes[event['event_id']] = event_size
+          @hook_bypass.add(event['event_id']) if skip_before_send
+          [true, @buffer.length]
+        end
+        @delivery_worker&.wake if admitted && buffered >= config.batch_size
+        admitted
+      rescue JSON::GeneratorError, Encoding::InvalidByteSequenceError
+        nil
+      end
+
+      def admit_event_locked?(event, event_size)
+        return false if event_size > MAX_BUFFER_BYTES
+
+        while @buffer.length >= MAX_BUFFER_SIZE || @buffer_bytes + event_size > MAX_BUFFER_BYTES
+          index = evictable_event_index(event_priority(event))
+          return false unless index
+
+          removed = @buffer.delete_at(index)
+          remove_event_ownership_locked(removed)
+          record_pressure_drop_locked(removed)
+        end
+        true
+      end
+
+      def event_priority(event)
+        return 3 if event['event_type'] == 'backend_exception'
+        return 2 if event['event_type'] == 'error_suppressed'
+
+        if event['event_type'] == 'request_event'
+          status = event.dig('payload', 'response_status')
+          return status.is_a?(Integer) && status >= 400 ? 2 : 1
+        end
+        return 1 unless event['event_type'] == 'log_event'
+
+        level = normalize_level(event.dig('payload', 'level'))
+        LOG_LEVEL_RANKS.fetch(level) >= LOG_LEVEL_RANKS.fetch(:error) ? 2 : 0
+      end
+
+      def pressure_class(event)
+        return 'exception' if event['event_type'] == 'backend_exception'
+        return 'request' if event['event_type'] == 'request_event'
+        return 'other' unless event['event_type'] == 'log_event'
+
+        normalize_level(event.dig('payload', 'level')).to_s
+      end
+
+      def record_pressure_drop_locked(event)
+        record_pressure_kind_locked(pressure_class(event), event['occurred_at'])
+      end
+
+      def record_pressure_kind_locked(kind, occurred_at)
+        state = (@pressure_drops[kind] ||= { count: 0, first_seen: occurred_at, last_seen: nil })
+        state[:count] += 1
+        state[:last_seen] = occurred_at
+      end
+
+      def append_pressure_aggregates
+        pending = @buffer_mutex.synchronize { @pressure_drops.transform_values(&:dup) }
+        pending.each do |kind, state|
+          next unless state[:count].positive?
+          next if @buffer_mutex.synchronize { @buffer.length >= MAX_BUFFER_SIZE }
+
+          payload = {
+            'fingerprint' => Digest::SHA256.hexdigest("ruby-queue-pressure:#{kind}"),
+            'suppressed_count' => state[:count],
+            'window_seconds' => 60,
+            'first_seen' => state[:first_seen],
+            'last_seen' => state[:last_seen],
+            'reason' => 'queue_pressure',
+            'level' => kind
+          }
+          next unless enqueue_event(base_event('error_suppressed', payload, {}), record_pressure: false)
+
+          @buffer_mutex.synchronize do
+            current = @pressure_drops[kind]
+            current[:count] -= state[:count]
+            current[:first_seen] = current[:last_seen] if current[:count].positive?
+          end
+        end
+      end
+
+      def remove_event_ownership_locked(event)
+        event_id = event['event_id']
+        @buffer_bytes -= @event_sizes.delete(event_id).to_i
+        @buffer_priority_counts[event_priority(event)] -= 1
+        @inflight_priority_counts[event_priority(event)] -= 1 if @inflight_event_ids.delete?(event_id)
+        @hook_bypass.delete(event_id)
+        @finalized_events.delete(event_id)
+      end
+
+      def evictable_event_index(priority)
+        @buffer.index do |queued|
+          !@inflight_event_ids.include?(queued['event_id']) && event_priority(queued) < priority
+        end
+      end
+
+      def cache_finalized_event(event, finalized)
+        # The original stays available for acknowledgement identity and retries, so
+        # a distinct hook replacement owns additional bytes until removal.
+        extra_bytes = finalized.equal?(event) ? 0 : JSON.generate(finalized).bytesize
+        @buffer_mutex.synchronize do
+          while @buffer_bytes + extra_bytes > MAX_BUFFER_BYTES
+            index = evictable_event_index(event_priority(event))
+            unless index
+              record_pressure_drop_locked(event)
+              return nil
+            end
+            removed = @buffer.delete_at(index)
+            remove_event_ownership_locked(removed)
+            record_pressure_drop_locked(removed)
+          end
+          @buffer_bytes += extra_bytes
+          @event_sizes[event['event_id']] += extra_bytes
+          @finalized_events[event['event_id']] = finalized
+        end
+      end
+
+      def reserve_buffered_batch
+        @buffer_mutex.synchronize do
+          @inflight_event_ids = @buffer.to_set { |event| event['event_id'] }
+          @inflight_priority_counts = @buffer_priority_counts.dup
+          @buffer.dup
+        end
+      end
+
+      def release_buffered_batch
+        @buffer_mutex.synchronize do
+          @inflight_event_ids.clear
+          @inflight_priority_counts = [0, 0, 0, 0]
+        end
+      end
+
+      def buffered_batch
+        @buffer_mutex.synchronize { @buffer.dup }
+      end
+
+      def remove_buffered_events(events)
+        event_ids = events.to_set { |event| event['event_id'] }
+        @buffer_mutex.synchronize do
+          @buffer.reject! do |event|
+            next false unless event_ids.include?(event['event_id'])
+
+            remove_event_ownership_locked(event)
+            true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/debugbundle/config_worker.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module DebugBundle
+  # One owned config poller; a stalled fetch cannot hold the event sender.
+  class ConfigWorker
+    def initialize(next_wait_seconds:, &refresh)
+      @next_wait_seconds = next_wait_seconds
+      @refresh = refresh
+      @mutex = Mutex.new
+      @condition = ConditionVariable.new
+      @requested = false
+      @closed = false
+      @thread = Thread.new { run }
+    end
+
+    def wake
+      @mutex.synchronize do
+        return if @closed
+
+        @requested = true
+        @condition.signal
+      end
+    end
+
+    def close
+      @mutex.synchronize do
+        @closed = true
+        @condition.broadcast
+      end
+    end
+
+    private
+
+    def run
+      loop do
+        begin
+          @refresh.call
+        rescue StandardError
+          # A custom fetcher must not terminate the bounded poller.
+        end
+        break unless wait_for_next
+      end
+    end
+
+    def wait_for_next
+      delay = @next_wait_seconds.call
+      @mutex.synchronize do
+        return false if @closed
+
+        unless @requested
+          delay.nil? ? @condition.wait(@mutex) : @condition.wait(@mutex, [delay, 0].max)
+        end
+        @requested = false
+        !@closed
+      end
+    rescue StandardError
+      false
+    end
+  end
+end

data/lib/debugbundle/delivery_worker.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+module DebugBundle
+  # One owned sender and one coalesced wakeup, including interval delivery.
+  class DeliveryWorker
+    MAX_WAITERS = 64
+    EXPLICIT_WAIT_SECONDS = 5
+
+    def initialize(interval:, before_work:, &deliver)
+      @interval = interval
+      @before_work = before_work
+      @deliver = deliver
+      @mutex = Mutex.new
+      @condition = ConditionVariable.new
+      @waiters = []
+      @requested = false
+      @closed = false
+      @thread = Thread.new { run }
+    end
+
+    def wake
+      @mutex.synchronize do
+        return if @closed
+
+        @requested = true
+        @condition.signal
+      end
+    end
+
+    def flush
+      ticket = { done: false, result: false }
+      deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + EXPLICIT_WAIT_SECONDS
+      @mutex.synchronize do
+        return false if @closed || @waiters.length >= MAX_WAITERS
+
+        @waiters << ticket
+        @requested = true
+        @condition.signal
+        until ticket[:done]
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          break if remaining <= 0
+
+          @condition.wait(@mutex, remaining)
+        end
+        ticket[:result]
+      end
+    end
+
+    def close
+      @mutex.synchronize do
+        @closed = true
+        @waiters.each { |ticket| ticket[:done] = true }
+        @waiters.clear
+        @condition.broadcast
+      end
+    end
+
+    private
+
+    def run
+      @before_work.call
+    rescue StandardError
+      # A failed config fetch must not terminate the sender.
+    ensure
+      loop do
+        tickets = wait_for_work
+        break if tickets.nil?
+
+        result = perform_work
+        finish_waiters(tickets, result)
+      end
+    end
+
+    def wait_for_work
+      @mutex.synchronize do
+        @condition.wait(@mutex, @interval) unless @requested || @closed
+        return nil if @closed
+
+        @requested = false
+        tickets = @waiters
+        @waiters = []
+        tickets
+      end
+    end
+
+    def perform_work
+      @before_work.call
+      @deliver.call
+    rescue StandardError
+      false
+    end
+
+    def finish_waiters(tickets, result)
+      @mutex.synchronize do
+        tickets.each do |ticket|
+          ticket[:done] = true
+          ticket[:result] = result
+        end
+        @condition.broadcast
+      end
+    end
+  end
+end

data/lib/debugbundle/rack/middleware.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'cgi'
+require 'uri'
 
 module DebugBundle
   module Rack
@@ -65,9 +65,19 @@ module DebugBundle
       end
 
       def parse_query(query_string)
-        CGI.parse(query_string.to_s).transform_values do |values|
-          values.length == 1 ? values.first : values
+        raw_query = query_string.to_s
+        return {} if raw_query.bytesize > 16_384
+
+        URI.decode_www_form(raw_query.tr(';', '&')).each_with_object({}) do |(key, value), result|
+          result[key] = if result.key?(key)
+                          Array(result[key]) << value
+                        else
+                          value
+                        end
         end
+      rescue StandardError
+        # Broken request metadata must never interrupt the host application.
+        {}
       end
 
       def route_template(env)

data/lib/debugbundle/redaction.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'date'
+require 'debugbundle/safe_input'
 
 module DebugBundle
   module Redaction
@@ -8,6 +9,7 @@ module DebugBundle
     CIRCULAR_VALUE = '[Circular]'
     TRUNCATED_DEPTH_VALUE = '[Truncated:depth]'
     TRUNCATED_COLLECTION_VALUE = '[Truncated:collection]'
+    UNSUPPORTED_VALUE = '[unsupported value]'
     DEFAULT_MAX_DEPTH = 5
     DEFAULT_MAX_STRING_LENGTH = 1_024
     DEFAULT_MAX_ARRAY_LENGTH = 50
@@ -84,13 +86,8 @@ module DebugBundle
           mark_seen(value, seen)
           sanitize_hash(value, depth: depth + 1, seen: seen)
         else
-          if value.respond_to?(:to_h)
-            sanitize(value.to_h, depth: depth + 1, seen: seen)
-          elsif value.respond_to?(:to_hash)
-            sanitize(value.to_hash, depth: depth + 1, seen: seen)
-          else
-            truncate_string(value.to_s)
-          end
+          # Application conversion methods can block or raise on the capture caller.
+          UNSUPPORTED_VALUE
         end
       end
 
@@ -98,7 +95,9 @@ module DebugBundle
         value.each_with_index.with_object({}) do |((key, nested_value), index), result|
           break result if index >= @max_hash_keys
 
-          key_string = key.to_s
+          key_string = SafeInput.key(key)
+          next unless key_string
+
           result[key_string] =
             sensitive_key?(key_string) ? REDACTED_VALUE : sanitize(nested_value, depth: depth, seen: seen)
         end.tap do |result|