pg_reports 0.5.0 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7f6e8be280967b6768f1646c2cdb0fa75b1d4da7d559151faa5f6f73dd4dfdb
-  data.tar.gz: 2121ea4314ec252406728fb6c5e98314b9703921b22d40a0b8483754dafd483c
+  metadata.gz: 05027e6e3278a707d98301a3d4a44dbce9930d26e963359d1afb01b57626df0c
+  data.tar.gz: 0c03b76ef459a04fa4ea732e062fd73020d814c5f11bcc6e3f0a771d17e66976
 SHA512:
-  metadata.gz: a3a5d23ca386675cc409a7f8536fcd2600d0a04f1576edd15ae0a939aa78e01226e25e776bbb0ed2c66dccf4b24121329c4263389f7b17a6ccc4cf7897063433
-  data.tar.gz: 411a3c78f3b45f3fa6c1a7a5bfee766cf0dd59bcab0bacf5e9b338971350b15d169413b1a6a99b540ecb850890bd2dafd60560e7d06e9990a023955310eba965
+  metadata.gz: a5e8a8eae451b10265dcbd3a9839f21d7c647d0876e7a41b7ac8e2a2219b87bbfbd45ec621f6ac552aba1c1cb8284005a114ca8758c3bd61e9cf3440ca6838d6
+  data.tar.gz: cf37e2c3458b8f24ca6bc548f7d58dea29af6547c14bf1c6db1468962fa1ec6e2095a9df8923045e5b8e86c6cf8c00e054e90e21cd803c7137d10db96e3f12de

data/CHANGELOG.md

@@ -7,6 +7,32 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.5.1] - 2026-02-09
+
+### Added
+
+- **Query Execution Security** - new configuration to control raw SQL execution from dashboard:
+  - New config option `allow_raw_query_execution` (default: `false`)
+  - Environment variable support: `PG_REPORTS_ALLOW_RAW_QUERY_EXECUTION`
+  - Security documentation in README with examples and best practices
+  - Frontend UI: disabled buttons with tooltips when feature is off
+  - JavaScript validation in `executeQuery()` and `executeExplainAnalyze()` functions
+  - Configuration tests for new security setting
+
+### Changed
+
+- **BREAKING CHANGE**: `execute_query` and `explain_analyze` endpoints now require explicit opt-in
+  - Both endpoints return 403 Forbidden when `allow_raw_query_execution` is `false` (default)
+  - Dashboard "Execute Query" and "EXPLAIN ANALYZE" buttons disabled by default
+  - To restore previous behavior, add to initializer: `config.allow_raw_query_execution = true`
+  - **Migration path**: Users must explicitly enable this feature if they were using Query Analyzer
+
+### Security
+
+- Raw SQL execution from dashboard is now **disabled by default** to prevent unauthorized data access
+- Recommended setup: only enable in development/staging environments
+- Existing safety measures (SELECT/SHOW only, automatic LIMIT) still apply when enabled
+
 ## [0.5.0] - 2026-02-07
 
 ### Added

data/README.md

@@ -128,6 +128,47 @@ PgReports.configure do |config|
 end
 ```
 
+### Query Execution Security
+
+⚠️ **Security Warning**: By default, the dashboard **does not allow** executing raw SQL queries via "Execute Query" and "EXPLAIN ANALYZE" buttons. This prevents accidental or malicious query execution in production environments.
+
+To enable query execution (only in secure environments):
+
+```ruby
+PgReports.configure do |config|
+  # Enable query execution from dashboard (default: false)
+  config.allow_raw_query_execution = true
+end
+```
+
+Or via environment variable:
+
+```bash
+export PG_REPORTS_ALLOW_RAW_QUERY_EXECUTION=true
+```
+
+**Recommended setup** (only enable in development/staging):
+
+```ruby
+# config/initializers/pg_reports.rb
+PgReports.configure do |config|
+  # Only allow query execution in development/staging
+  config.allow_raw_query_execution = Rails.env.development? || Rails.env.staging?
+
+  # Combine with authentication for additional security
+  config.dashboard_auth = -> {
+    authenticate_or_request_with_http_basic do |user, pass|
+      user == ENV["PG_REPORTS_USER"] && pass == ENV["PG_REPORTS_PASSWORD"]
+    end
+  }
+end
+```
+
+When disabled:
+- API endpoints `/execute_query` and `/explain_analyze` return 403 Forbidden
+- UI buttons are disabled with explanation tooltips
+- Existing safety measures (SELECT/SHOW only, automatic LIMIT) still apply when enabled
+
 ## Query Source Tracking
 
 PgReports automatically parses query annotations to show **where queries originated**. Works with:

data/app/controllers/pg_reports/dashboard_controller.rb

@@ -26,15 +26,40 @@ module PgReports
 
     def live_metrics
       threshold = params[:long_query_threshold]&.to_i || 60
-      data = Modules::System.live_metrics(long_query_threshold: threshold)
 
-      render json: {
-        success: true,
-        metrics: data,
-        timestamp: Time.current.to_i
-      }
-    rescue => e
-      render json: {success: false, error: e.message}, status: :unprocessable_entity
+      # Check if we have access to required statistics
+      begin
+        data = Modules::System.live_metrics(long_query_threshold: threshold)
+
+        # Validate that we got actual data
+        if data[:connections][:total].nil? && data[:transactions][:total].nil?
+          render json: {
+            success: false,
+            error: "Unable to fetch database statistics. Check database permissions.",
+            available: false
+          }, status: :service_unavailable
+          return
+        end
+
+        render json: {
+          success: true,
+          metrics: data,
+          timestamp: Time.current.to_i,
+          available: true
+        }
+      rescue PG::InsufficientPrivilege => e
+        render json: {
+          success: false,
+          error: "Insufficient database permissions to access statistics views",
+          available: false
+        }, status: :forbidden
+      rescue => e
+        render json: {
+          success: false,
+          error: e.message,
+          available: false
+        }, status: :unprocessable_entity
+      end
     end
 
     def show
@@ -73,11 +98,24 @@ module PgReports
       problem_fields = Dashboard::ReportsRegistry.problem_fields(report_key)
       problem_explanations = load_problem_explanations(category, report_key)
 
+      # Add query hashes for security
+      data_with_hashes = report.data.first(100).map do |row|
+        row_hash = row.dup
+
+        # If this row contains a query column, store it with a hash
+        if row_hash.key?("query") && row_hash["query"].present?
+          query_hash = store_query_with_hash(row_hash["query"])
+          row_hash["query_hash"] = query_hash
+        end
+
+        row_hash
+      end
+
       render json: {
         success: true,
         title: report.title,
         columns: report.columns,
-        data: report.data.first(100),
+        data: data_with_hashes,
         total: report.size,
         generated_at: report.generated_at.strftime("%Y-%m-%d %H:%M:%S"),
         thresholds: thresholds,
@@ -135,18 +173,42 @@ module PgReports
     end
 
     def explain_analyze
-      query = params[:query]
+      query_hash = params[:query_hash]
       query_params = params[:params] || {}
 
-      if query.blank?
-        render json: {success: false, error: "Query is required"}, status: :unprocessable_entity
+      if query_hash.blank?
+        render json: {success: false, error: "Query hash is required"}, status: :unprocessable_entity
         return
       end
 
-      # Security: Only allow SELECT queries for EXPLAIN ANALYZE (SHOW not supported by EXPLAIN)
-      normalized = query.strip.gsub(/\s+/, " ").downcase
-      unless normalized.start_with?("select")
-        render json: {success: false, error: "Only SELECT queries are allowed for EXPLAIN ANALYZE"}, status: :unprocessable_entity
+      # Security: Check if raw query execution is allowed
+      unless PgReports.config.allow_raw_query_execution
+        render json: {
+          success: false,
+          error: "Query execution from dashboard is disabled. Enable it in configuration with 'config.allow_raw_query_execution = true'"
+        }, status: :forbidden
+        return
+      end
+
+      # Security: Retrieve and validate query by hash
+      begin
+        query = retrieve_query_by_hash(query_hash)
+
+        if query.nil?
+          render json: {success: false, error: "Query not found or expired. Please refresh the page."}, status: :not_found
+          return
+        end
+      rescue SecurityError => e
+        render json: {success: false, error: "Security violation: #{e.message}"}, status: :forbidden
+        return
+      end
+
+      # Check for trigger variables (NEW, OLD) which are only available in trigger context
+      if query.match?(/\b(NEW|OLD)\./i)
+        render json: {
+          success: false,
+          error: "Cannot EXPLAIN ANALYZE queries with trigger variables (NEW, OLD). These are only available within trigger functions."
+        }, status: :unprocessable_entity
         return
       end
 
@@ -182,18 +244,33 @@ module PgReports
     end
 
     def execute_query
-      query = params[:query]
+      query_hash = params[:query_hash]
       query_params = params[:params] || {}
 
-      if query.blank?
-        render json: {success: false, error: "Query is required"}, status: :unprocessable_entity
+      if query_hash.blank?
+        render json: {success: false, error: "Query hash is required"}, status: :unprocessable_entity
         return
       end
 
-      # Security: Only allow SELECT and SHOW queries
-      normalized = query.strip.gsub(/\s+/, " ").downcase
-      unless normalized.start_with?("select", "show")
-        render json: {success: false, error: "Only SELECT and SHOW queries are allowed"}, status: :unprocessable_entity
+      # Security: Check if raw query execution is allowed
+      unless PgReports.config.allow_raw_query_execution
+        render json: {
+          success: false,
+          error: "Query execution from dashboard is disabled. Enable it in configuration with 'config.allow_raw_query_execution = true'"
+        }, status: :forbidden
+        return
+      end
+
+      # Security: Retrieve and validate query by hash
+      begin
+        query = retrieve_query_by_hash(query_hash)
+
+        if query.nil?
+          render json: {success: false, error: "Query not found or expired. Please refresh the page."}, status: :not_found
+          return
+        end
+      rescue SecurityError => e
+        render json: {success: false, error: "Security violation: #{e.message}"}, status: :forbidden
         return
       end
 
@@ -285,7 +362,7 @@ module PgReports
     end
 
     def start_query_monitoring
-      monitor = QueryMonitor.instance
+      monitor = PgReports::QueryMonitor.instance
 
       result = monitor.start
 
@@ -299,7 +376,7 @@ module PgReports
     end
 
     def stop_query_monitoring
-      monitor = QueryMonitor.instance
+      monitor = PgReports::QueryMonitor.instance
 
       result = monitor.stop
 
@@ -313,7 +390,7 @@ module PgReports
     end
 
     def query_monitor_status
-      monitor = QueryMonitor.instance
+      monitor = PgReports::QueryMonitor.instance
       status = monitor.status
 
       render json: {
@@ -327,7 +404,7 @@ module PgReports
     end
 
     def query_monitor_feed
-      monitor = QueryMonitor.instance
+      monitor = PgReports::QueryMonitor.instance
 
       unless monitor.enabled
         render json: {success: false, message: "Monitoring not active"}
@@ -349,9 +426,9 @@ module PgReports
     end
 
     def load_query_history
-      monitor = QueryMonitor.instance
+      monitor = PgReports::QueryMonitor.instance
 
-      limit = params[:limit]&.to_i || 100
+      limit = params[:limit]&.to_i || 50
       session_id = params[:session_id]
 
       queries = monitor.load_from_log(limit: limit, session_id: session_id)
@@ -366,7 +443,7 @@ module PgReports
     end
 
     def download_query_monitor
-      monitor = QueryMonitor.instance
+      monitor = PgReports::QueryMonitor.instance
 
       # Allow download even when monitoring is stopped, as long as there are queries
       queries = monitor.queries
@@ -510,6 +587,67 @@ module PgReports
       end
     end
 
+    # Generate a secure hash for a query and store it in cache
+    def store_query_with_hash(query)
+      require "digest"
+
+      # Generate SHA256 hash of the query
+      query_hash = Digest::SHA256.hexdigest(query)
+
+      # Store in Rails cache with 1 hour expiration
+      begin
+        Rails.cache.write("pg_reports:query:#{query_hash}", query, expires_in: 1.hour)
+      rescue => e
+        # Log cache error but don't fail - we'll catch it on retrieval
+        Rails.logger.warn("PgReports: Failed to store query hash in cache: #{e.message}") if defined?(Rails.logger)
+      end
+
+      query_hash
+    end
+
+    # Retrieve and validate a query by its hash
+    def retrieve_query_by_hash(query_hash)
+      return nil if query_hash.blank?
+
+      # Retrieve from cache with error handling
+      query = nil
+      begin
+        query = Rails.cache.read("pg_reports:query:#{query_hash}")
+      rescue => e
+        # Cache backend is unavailable
+        Rails.logger.error("PgReports: Failed to read from cache: #{e.message}") if defined?(Rails.logger)
+        raise SecurityError, "Cache system unavailable. Query execution temporarily disabled for security. Please ensure Redis/cache backend is running."
+      end
+
+      if query.blank?
+        # Query not found - either expired or was never stored
+        return nil
+      end
+
+      # Strict validation: must be a SELECT query only
+      normalized = query.strip.gsub(/\s+/, " ").downcase
+
+      # Check for semicolons (prevents multiple statements)
+      if query.include?(";")
+        raise SecurityError, "Multiple statements are not allowed (semicolons detected)"
+      end
+
+      # Must start with SELECT (case insensitive)
+      unless normalized.start_with?("select")
+        raise SecurityError, "Only SELECT queries are allowed. Found: #{normalized.split.first&.upcase || 'unknown'}"
+      end
+
+      # Check for dangerous keywords that might be in subqueries or CTEs
+      dangerous_keywords = %w[insert update delete drop alter create truncate grant revoke]
+      dangerous_keywords.each do |keyword|
+        if normalized.match?(/\b#{keyword}\b/)
+          raise SecurityError, "Dangerous keyword detected: #{keyword.upcase}"
+        end
+      end
+
+      query
+    end
+
     def generate_query_monitor_csv(queries)
       require "csv"