rack-mini-profiler 2.3.1 → 2.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 287f0fe8da1845abde81f60250c960808168f0d278cf905786293c584fe78c23
-  data.tar.gz: c43613852efe89a7e59c642220b4609b086190473a0c2c5a83ead3b1abbdce9c
+  metadata.gz: 6021effb717c193c4c70b3ac7a3550fd99c9abfd19432ac0ab9db63f62b11321
+  data.tar.gz: 8bce19855d2f6d908339e3108201282c519b4d8ad99b8e7e90dad9d3f718c929
 SHA512:
-  metadata.gz: c4944a4bbf9021b4639dc18d5e13d6f901eef47785b1e66ac37b261307cf82f70dd5ebc242fb099fecada4c450594155e600150baedfd7cb2b1d7f7b7527ef69
-  data.tar.gz: ba0ee401a63f3fe3a27acc1812d790a1e11de26f6d6ffd38d34730bfec3ecf26c96f20f9912fe071917a31a346115c10cd959bff35516624d3f816c5aa84426c
+  metadata.gz: 0c4354c194a6fa6018c57162e24e1cee85de7f296e45cd6182360b39abeb803b29a14674e2dfe93b3ba5d9bcb192814de8d091ad6b7db20d71af95e2cddcf4eb
+  data.tar.gz: e3c7f4da5fd5c79bfdb4c3582b50a38346d38784bfd92c6e7ce3fa41713104c74b6ad5622084d42624011ef850533c403002664f44ad7f6e1b1ac16a245c633b

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # CHANGELOG
 
+## 2.3.4 - 2022-02-23
+
+- [FEATURE] Add cookie path support for subfolder sites
+- [FIX] Remove deprecated uses of Redis#pipelined
+
+## 2.3.3 - 2021-08-30
+
+- [FEATURE] Introduce `pp=flamegraph_mode`
+- [FEATURE] Richer CSP configuration options
+- [FEATURE] Add support for Hotwire Turbo Drive
+
+## 2.3.2 - 2021-04-30
+
+- [FEATURE] Introduce `pp=async-flamegraph` for asynchronous flamegraphs
+
 ## 2.3.1 - 2021-01-29
 
 - [FIX] compatability with Ruby 3.0

data/README.md

@@ -166,10 +166,14 @@ export RACK_MINI_PROFILER_PATCH="false"
 
 ### Flamegraphs
 
-To generate [flamegraphs](http://samsaffron.com/archive/2013/03/19/flame-graphs-in-ruby-miniprofiler):
+To generate [flamegraphs](http://samsaffron.com/archive/2013/03/19/flame-graphs-in-ruby-miniprofiler), add the [**stackprof**](https://rubygems.org/gems/stackprof) gem to your Gemfile.
 
-* add the [**stackprof**](https://rubygems.org/gems/stackprof) gem to your Gemfile
-* visit a page in your app with `?pp=flamegraph`
+Then, to view the flamegraph as a direct HTML response from your request, just visit any page in your app with `?pp=flamegraph` appended to the URL. 
+
+Conversely, if you want your regular response instead (which is specially useful for JSON and/or XHR requests), just append the `?pp=async-flamegraph` parameter to your request/fetch URL; the request will then return as normal, and the flamegraph data will be stored for later *async* viewing, both for this request and for all subsequent requests made by this page (based on the `REFERER` header). For viewing these async flamegraphs, use the 'flamegraph' link that will appear inside the MiniProfiler UI for these requests.
+
+Note: Mini Profiler will not record SQL timings for a request if it asks for a flamegraph. The rationale behind this is to keep
+Mini Profiler's methods that are responsible for generating the timings data out of the flamegraph.
 
 ### Memory Profiling
 
@@ -197,7 +201,7 @@ There are two additional `pp` options that can be used to analyze memory which d
 
 In a complex web application, it's possible for a request to trigger rare conditions that result in poor performance. Mini Profiler ships with a feature to help detect those rare conditions and fix them. It works by enabling invisible profiling on one request every N requests, and saving the performance metrics that are collected during the request (a.k.a snapshot of the request) so that they can be viewed later. To turn this feature on, set the `snapshot_every_n_requests` config to a value larger than 0. The larger the value is, the less frequently requests are profiled.
 
-Mini Profiler will exclude requests that are made to skippd paths (see `skip_paths` config below) from being sampled. Additionally, if profiling is enabled for a request that later finishes with a non-2xx status code, Mini Profiler will discard the snapshot and not save it (this behavior may change in the future).
+Mini Profiler will exclude requests that are made to skipped paths (see `skip_paths` config below) from being sampled. Additionally, if profiling is enabled for a request that later finishes with a non-2xx status code, Mini Profiler will discard the snapshot and not save it (this behavior may change in the future).
 
 After enabling snapshots sampling, you can see the snapshots that have been collected at `/mini-profiler-resources/snapshots` (or if you changed the `base_url_path` config, substitute `mini-profiler-resources` with your value of the config). You'll see on that page a table where each row represents a group of snapshots with the duration of the worst snapshot in that group. The worst snapshot in a group is defined as the snapshot whose request took longer than all of the snapshots in the same group. Snapshots grouped by HTTP method and path of the request, and if your application is a Rails app, Mini Profiler will try to convert the path to `controller#action` and group by that instead of request path. Clicking on a group will display the snapshots of that group sorted from worst to best. From there, you can click on a snapshot's ID to see the snapshot with all the performance metrics that were collected.
 
@@ -235,21 +239,21 @@ rack-mini-profiler is designed with production profiling in mind. To enable that
 
 Note:
 
-Out-of-the-box we will initialize the `authorization_mode` to `:whitelist` in production. However, in some cases we may not be able to do it:
+Out-of-the-box we will initialize the `authorization_mode` to `:allow_authorized` in production. However, in some cases we may not be able to do it:
 
-- If you are running in development or test we will not enable whitelist mode
+- If you are running in development or test we will not enable the explicit authorization mode
 - If you use `require: false` on rack_mini_profiler we are unlikely to be able to run the railtie
 - If you are running outside of rails we will not run the railtie
 
 In those cases use:
 
 ```ruby
-Rack::MiniProfiler.config.authorization_mode = :whitelist
+Rack::MiniProfiler.config.authorization_mode = :allow_authorized
 ```
 
 When deciding to fully profile a page mini profiler consults with the `authorization_mode`
 
-By default in production we attempt to set the authorization mode to `:whitelist` meaning that end user will only be able to see requests where somewhere `Rack::MiniProfiler.authorize_request` is invoked.
+By default in production we attempt to set the authorization mode to `:allow_authorized` meaning that end user will only be able to see requests where somewhere `Rack::MiniProfiler.authorize_request` is invoked.
 
 In development we run in the `:allow_all` authorization mode meaning every request is profiled and displayed to the end user.
 
@@ -343,19 +347,41 @@ Single page applications built using Ember, Angular or other frameworks need som
 On route transition always call:
 
 ```
-window.MiniProfiler.pageTransition();
+if (window.MiniProfiler !== undefined) {
+  window.MiniProfiler.pageTransition();
+}
 ```
 
 This method will remove profiling information that was related to previous page and clear aggregate statistics.
 
 #### MiniProfiler's speed badge on pages that are not generated via Rails
-You need to inject the following in your SPA to load MiniProfiler's speed badge ([extra details surrounding this script](https://github.com/MiniProfiler/rack-mini-profiler/issues/139#issuecomment-192880706)):
+You need to inject the following in your SPA to load MiniProfiler's speed badge ([extra details surrounding this script](https://github.com/MiniProfiler/rack-mini-profiler/issues/139#issuecomment-192880706) and [credit for the script tag](https://github.com/MiniProfiler/rack-mini-profiler/issues/479#issue-782488320) to [@ivanyv](https://github.com/ivanyv)):
 
 ```html
- <script async type="text/javascript" id="mini-profiler" src="/mini-profiler-resources/includes.js?v=12b4b45a3c42e6e15503d7a03810ff33" data-version="12b4b45a3c42e6e15503d7a03810ff33" data-path="/mini-profiler-resources/" data-current-id="redo66j4g1077kto8uh3" data-ids="redo66j4g1077kto8uh3" data-horizontal-position="left" data-vertical-position="top" data-trivial="false" data-children="false" data-max-traces="10" data-controls="false" data-authorized="true" data-toggle-shortcut="Alt+P" data-start-hidden="false" data-collapse-results="true"></script>
-```
-
-_Note:_ The GUID (`data-version` and the `?v=` parameter on the `src`) will change with each release of `rack_mini_profiler`. The MiniProfiler's speed badge will continue to work, although you will have to change the GUID to expire the script to fetch the most recent version.
+ <script type="text/javascript" id="mini-profiler"
+        src="/mini-profiler-resources/includes.js?v=12b4b45a3c42e6e15503d7a03810ff33"
+        data-css-url="/mini-profiler-resources/includes.css?v=12b4b45a3c42e6e15503d7a03810ff33"
+        data-version="12b4b45a3c42e6e15503d7a03810ff33"
+        data-path="/mini-profiler-resources/"
+        data-horizontal-position="left"
+        data-vertical-position="top"
+        data-ids=""
+        data-trivial="false"
+        data-children="false"
+        data-max-traces="20"
+        data-controls="false"
+        data-total-sql-count="false"
+        data-authorized="true"
+        data-toggle-shortcut="alt+p"
+        data-start-hidden="false"
+        data-collapse-results="true"
+        data-html-container="body"
+        data-hidden-custom-fields></script>
+```
+
+See an [example of how to do this in a React useEffect](https://gist.github.com/katelovescode/01cfc2b962c165193b160fd10af6c4d5).
+
+_Note:_ The GUID (`data-version` and the `?v=` parameter on the `src` and `data-css-url`) will change with each release of `rack_mini_profiler`. The MiniProfiler's speed badge will continue to work, although you will have to change the GUID to expire the script to fetch the most recent version.
 
 #### Using MiniProfiler's built in route for apps without HTML responses
 MiniProfiler also ships with a `/rack-mini-profiler/requests` route that displays the speed badge on a blank HTML page. This can be useful when profiling an application that does not render HTML.
@@ -394,12 +420,14 @@ toggle_shortcut|Alt+P|Keyboard shortcut to toggle the mini_profiler's visibility
 start_hidden|`false`|`false` to make mini_profiler visible on page load.
 backtrace_threshold_ms|`0`|Minimum SQL query elapsed time before a backtrace is recorded.
 flamegraph_sample_rate|`0.5`|How often to capture stack traces for flamegraphs in milliseconds.
+flamegraph_mode|`:wall`|The [StackProf mode](https://github.com/tmm1/stackprof#all-options) to pass to `StackProf.run`.
 base_url_path|`'/mini-profiler-resources/'`|Path for assets; added as a prefix when naming assets and sought when responding to requests.
+cookie_path|`'/'`|Set-Cookie header path for profile cookie
 collapse_results|`true`|If multiple timing results exist in a single page, collapse them till clicked.
 max_traces_to_show|20|Maximum number of mini profiler timing blocks to show on one page
 html_container|`body`|The HTML container (as a jQuery selector) to inject the mini_profiler UI into
 show_total_sql_count|`false`|Displays the total number of SQL executions.
-enable_advanced_debugging_tools|`false`|Enables sensitive debugging tools that can be used via the UI. In production we recommend keeping this disabled as memory and environment debugging tools can expose contents of memory that may contain passwords.
+enable_advanced_debugging_tools|`false`|Enables sensitive debugging tools that can be used via the UI. In production we recommend keeping this disabled as memory and environment debugging tools can expose contents of memory that may contain passwords. Defaults to `true` in development.
 assets_url|`nil`|See the "Register MiniProfiler's assets in the Rails assets pipeline" section above.
 snapshot_every_n_requests|`-1`|Determines how frequently snapshots are taken. See the "Snapshots Sampling" above for more details.
 snapshots_limit|`1000`|Determines how many snapshots Mini Profiler is allowed to keep.
@@ -408,13 +436,15 @@ snapshots_transport_destination_url|`nil`|Set this config to a valid URL to enab
 snapshots_transport_auth_key|`nil`|`POST` requests made by the snapshots transporter to the destination URL will have a `Mini-Profiler-Transport-Auth` header with the value of this config. Make sure you use a secure and random key for this config.
 snapshots_redact_sql_queries|`true`|When this is true, SQL queries will be redacted from sampling snapshots, but the backtrace and duration of each SQL query will be saved with the snapshot to keep debugging performance issues possible.
 snapshots_transport_gzip_requests|`false`|Make the snapshots transporter gzip the requests it makes to `snapshots_transport_destination_url`.
+content_security_policy_nonce|Rails: Current nonce<br>Rack: nil|Set the content security policy nonce to use when inserting MiniProfiler's script block.
+enable_hotwire_turbo_drive_support| `false` | Enable support for Hotwire TurboDrive page transitions.
 
 ### Using MiniProfiler with `Rack::Deflate` middleware
 
 If you are using `Rack::Deflate` with Rails and `rack-mini-profiler` in its default configuration,
 `Rack::MiniProfiler` will be injected (as always) at position 0 in the middleware stack,
 which means it will run after `Rack::Deflate` on response processing. To prevent attempting to inject
-HTML in already compressed response body MiniProfiler will suppress compression by setting 
+HTML in already compressed response body MiniProfiler will suppress compression by setting
 `identity` encoding in `Accept-Encoding` request header.
 
 ## Special query strings
@@ -457,20 +487,23 @@ end
 If you want to contribute to this project, that's great, thank you! You can run the following rake task:
 
 ```
+$ BUNDLE_GEMFILE=website/Gemfile bundle install
 $ bundle exec rake client_dev
 ```
 
-which will start a local Sinatra server at `http://localhost:9292` where you'll be able to preview your changes. Refreshing the page should be enough to see any changes you make to files in the `lib/html` directory.
+This will start a local Sinatra server at `http://localhost:9292` where you'll be able to preview your changes. Refreshing the page should be enough to see any changes you make to files in the `lib/html` directory.
+
+Make sure to prepend `bundle exec` before any Rake tasks you run.
 
 ## Running the Specs
 
+You need Memcached and Redis services running for the specs.
+
 ```
 $ rake build
 $ rake spec
 ```
 
-Additionally you can also run `autotest` if you like.
-
 ## Licence
 
 The MIT License (MIT)

data/lib/html/includes.css

@@ -69,8 +69,16 @@
   .profiler-result .custom-fields-title,
   .profiler-queries .custom-fields-title {
     color: #555;
-    font: Helvetica, Arial, sans-serif;
+    font-family: Helvetica, Arial, sans-serif;
     font-size: 14px; }
+  .mp-snapshots .ta-left,
+  .profiler-result .ta-left,
+  .profiler-queries .ta-left {
+    text-align: left; }
+  .mp-snapshots .ta-right,
+  .profiler-result .ta-right,
+  .profiler-queries .ta-right {
+    text-align: right; }
 
 .profiler-result {
   font-family: Helvetica, Arial, sans-serif; }
@@ -233,8 +241,6 @@
       left: 0px; }
       .profiler-results.profiler-top.profiler-left.profiler-no-controls .profiler-totals, .profiler-results.profiler-top.profiler-left.profiler-no-controls .profiler-result:last-child .profiler-button,
       .profiler-results.profiler-top.profiler-left .profiler-controls {
-        -webkit-border-bottom-right-radius: 10px;
-        -moz-border-radius-bottomright: 10px;
         border-bottom-right-radius: 10px; }
       .profiler-results.profiler-top.profiler-left .profiler-button,
       .profiler-results.profiler-top.profiler-left .profiler-controls {
@@ -243,8 +249,6 @@
       right: 0px; }
       .profiler-results.profiler-top.profiler-right.profiler-no-controls .profiler-totals, .profiler-results.profiler-top.profiler-right.profiler-no-controls .profiler-result:last-child .profiler-button,
       .profiler-results.profiler-top.profiler-right .profiler-controls {
-        -webkit-border-bottom-left-radius: 10px;
-        -moz-border-radius-bottomleft: 10px;
         border-bottom-left-radius: 10px; }
       .profiler-results.profiler-top.profiler-right .profiler-button,
       .profiler-results.profiler-top.profiler-right .profiler-controls {
@@ -255,8 +259,6 @@
       left: 0px; }
       .profiler-results.profiler-bottom.profiler-left.profiler-no-controls .profiler-totals, .profiler-results.profiler-bottom.profiler-left.profiler-no-controls .profiler-result:first-child .profiler-button,
       .profiler-results.profiler-bottom.profiler-left .profiler-controls {
-        -webkit-border-top-right-radius: 10px;
-        -moz-border-radius-topright: 10px;
         border-top-right-radius: 10px; }
       .profiler-results.profiler-bottom.profiler-left .profiler-button,
       .profiler-results.profiler-bottom.profiler-left .profiler-controls {
@@ -265,8 +267,6 @@
       right: 0px; }
       .profiler-results.profiler-bottom.profiler-right.profiler-no-controls .profiler-totals, .profiler-results.profiler-bottom.profiler-right.profiler-no-controls .profiler-result:first-child .profiler-button,
       .profiler-results.profiler-bottom.profiler-right .profiler-controls {
-        -webkit-border-bottom-top-radius: 10px;
-        -moz-border-radius-topleft: 10px;
         border-top-left-radius: 10px; }
       .profiler-results.profiler-bottom.profiler-right .profiler-button,
       .profiler-results.profiler-bottom.profiler-right .profiler-controls {
@@ -324,8 +324,6 @@
     text-align: left;
     line-height: 18px;
     overflow: auto;
-    -moz-box-shadow: 0px 1px 15px #555;
-    -webkit-box-shadow: 0px 1px 15px #555;
     box-shadow: 0px 1px 15px #555; }
     .profiler-results .profiler-popup .profiler-info {
       margin-bottom: 3px;

data/lib/html/includes.js

@@ -401,7 +401,7 @@ var _MiniProfiler = (function() {
     var px = button.offsetTop - 1,
       // position next to the button we clicked
       windowHeight = window.innerHeight,
-      maxHeight = windowHeight - 40; // make sure the popup doesn't extend below the fold
+      maxHeight = windowHeight - px - 40; // make sure the popup doesn't extend below the fold
 
     popup.style[options.renderVerticalPosition] = "".concat(px, "px");
     popup.style.maxHeight = "".concat(maxHeight, "px");
@@ -495,6 +495,19 @@ var _MiniProfiler = (function() {
     }, 3000);
   };
 
+  var onTurboBeforeVisit = function onTurboBeforeVisit(e) {
+    if(!e.defaultPrevented) {
+      window.MiniProfilerContainer = document.querySelector('body > .profiler-results')
+      window.MiniProfiler.pageTransition()
+    }
+  }
+
+  var onTurboLoad = function onTurboLoad(e) {
+    if(window.MiniProfilerContainer) {
+      document.body.appendChild(window.MiniProfilerContainer)
+    }
+  }
+
   var onClickEvents = function onClickEvents(e) {
     // this happens on every keystroke, and :visible is crazy expensive in IE <9
     // and in this case, the display:none check is sufficient.
@@ -652,6 +665,11 @@ var _MiniProfiler = (function() {
         turbolinksSkipResultsFetch
       );
     }
+
+    if (options.hotwireTurboDriveSupport) {
+      document.addEventListener("turbo:before-visit", onTurboBeforeVisit)
+      document.addEventListener("turbo:load", onTurboLoad)
+    }
   };
 
   var unbindDocumentEvents = function unbindDocumentEvents() {
@@ -664,6 +682,8 @@ var _MiniProfiler = (function() {
       "turbolinks:request-start",
       turbolinksSkipResultsFetch
     );
+    document.removeEventListener("turbo:before-visit", onTurboBeforeVisit);
+    document.removeEventListener("turbo:load", onTurboLoad);
   };
 
   var initFullView = function initFullView() {
@@ -1033,6 +1053,8 @@ var _MiniProfiler = (function() {
           .getAttribute("data-hidden-custom-fields")
           .toLowerCase()
           .split(",");
+        var hotwireTurboDriveSupport = script
+          .getAttribute('data-turbo-permanent') === "true";
         return {
           ids: ids,
           path: path,
@@ -1051,7 +1073,8 @@ var _MiniProfiler = (function() {
           collapseResults: collapseResults,
           htmlContainer: htmlContainer,
           cssUrl: cssUrl,
-          hiddenCustomFields: hiddenCustomFields
+          hiddenCustomFields: hiddenCustomFields,
+          hotwireTurboDriveSupport: hotwireTurboDriveSupport
         };
       })();
 
@@ -1213,6 +1236,9 @@ var _MiniProfiler = (function() {
     shareUrl: function shareUrl(id) {
       return options.path + "results?id=" + id;
     },
+    flamegraphUrl: function flamegrapgUrl(id) {
+      return options.path + "flamegraph?id=" + id;
+    },
     moreUrl: function moreUrl(requestName) {
       var requestParts = requestName.split(" ");
       var linkSrc =

data/lib/html/includes.scss

@@ -1,6 +1,4 @@
 @mixin box-shadow($dx, $dy, $radius, $color) {
-  -moz-box-shadow: $dx $dy $radius $color;
-  -webkit-box-shadow: $dx $dy $radius $color;
   box-shadow: $dx $dy $radius $color;
 }
 
@@ -58,9 +56,11 @@ $zindex: 2147483640; // near 32bit max 2147483647
   }
   .custom-fields-title {
     color: $textColor;
-    font: $normalFonts;
+    font-family: $normalFonts;
     font-size: 14px;
   }
+  .ta-left  { text-align: left;  }
+  .ta-right { text-align: right; }
 }
 
 // styles shared between popup view and full view
@@ -326,8 +326,6 @@ $zindex: 2147483640; // near 32bit max 2147483647
       &.profiler-no-controls .profiler-totals,
       &.profiler-no-controls .profiler-result:last-child .profiler-button,
       .profiler-controls {
-        -webkit-border-bottom-right-radius: $radius;
-        -moz-border-radius-bottomright: $radius;
         border-bottom-right-radius: $radius;
       }
 
@@ -343,8 +341,6 @@ $zindex: 2147483640; // near 32bit max 2147483647
       &.profiler-no-controls .profiler-totals,
       &.profiler-no-controls .profiler-result:last-child .profiler-button,
       .profiler-controls {
-        -webkit-border-bottom-left-radius: $radius;
-        -moz-border-radius-bottomleft: $radius;
         border-bottom-left-radius: $radius;
       }
 
@@ -364,8 +360,6 @@ $zindex: 2147483640; // near 32bit max 2147483647
       &.profiler-no-controls .profiler-totals,
       &.profiler-no-controls .profiler-result:first-child .profiler-button,
       .profiler-controls {
-        -webkit-border-top-right-radius: $radius;
-        -moz-border-radius-topright: $radius;
         border-top-right-radius: $radius;
       }
 
@@ -381,8 +375,6 @@ $zindex: 2147483640; // near 32bit max 2147483647
       &.profiler-no-controls .profiler-totals,
       &.profiler-no-controls .profiler-result:first-child .profiler-button,
       .profiler-controls {
-        -webkit-border-bottom-top-radius: $radius;
-        -moz-border-radius-topleft: $radius;
         border-top-left-radius: $radius;
       }
 

data/lib/html/includes.tmpl

@@ -117,8 +117,8 @@
         <table>
         <thead>
           <tr>
-            <th style="text-align:right">step<br />time from start<br />query type<br />duration</th>
-            <th style="text-align:left">call stack<br />query</th>
+            <th class="ta-right">step<br />time from start<br />query type<br />duration</th>
+            <th class="ta-left">call stack<br />query</th>
           </tr>
         </thead>
         <tbody>
@@ -142,6 +142,9 @@
 <script id="linksTemplate" type="text/x-dot-tmpl">
   <a href="{{= MiniProfiler.shareUrl(it.page.id) }}" class="profiler-share-profiler-results" target="_blank">share</a>
   <a href="{{= MiniProfiler.moreUrl(it.timing.name) }}" class="profiler-more-actions">more</a>
+  {{? it.page.has_flamegraph}}
+    <a href="{{= MiniProfiler.flamegraphUrl(it.page.id) }}" class="profiler-show-flamegraph" target="_blank">flamegraph</a>
+  {{?}}
   {{? it.custom_link}}
     <a href="{{= it.custom_link }}" class="profiler-custom-link" target="_blank">{{= it.custom_link_name }}</a>
   {{?}}

data/lib/html/profile_handler.js

@@ -1 +1 @@
-<script async type="text/javascript" id="mini-profiler" src="{url}" data-css-url="{cssUrl}" data-version="{version}" data-path="{path}" data-current-id="{currentId}" data-ids="{ids}" data-horizontal-position="{horizontalPosition}" data-vertical-position="{verticalPosition}" data-trivial="{showTrivial}" data-children="{showChildren}" data-max-traces="{maxTracesToShow}" data-controls="{showControls}" data-total-sql-count="{showTotalSqlCount}" data-authorized="{authorized}" data-toggle-shortcut="{toggleShortcut}" data-start-hidden="{startHidden}" data-collapse-results="{collapseResults}" data-html-container="{htmlContainer}" data-hidden-custom-fields="{hiddenCustomFields}"></script>
+<script async nonce="{cspNonce}" type="text/javascript" id="mini-profiler" src="{url}" data-css-url="{cssUrl}" data-version="{version}" data-path="{path}" data-current-id="{currentId}" data-ids="{ids}" data-horizontal-position="{horizontalPosition}" data-vertical-position="{verticalPosition}" data-trivial="{showTrivial}" data-children="{showChildren}" data-max-traces="{maxTracesToShow}" data-controls="{showControls}" data-total-sql-count="{showTotalSqlCount}" data-authorized="{authorized}" data-toggle-shortcut="{toggleShortcut}" data-start-hidden="{startHidden}" data-collapse-results="{collapseResults}" data-html-container="{htmlContainer}" data-hidden-custom-fields="{hiddenCustomFields}" data-turbo-permanent="{hotwireTurboDriveSupport}"></script>

data/lib/html/vendor.js

@@ -7,11 +7,11 @@
 MiniProfiler.templates = {};
 MiniProfiler.templates["profilerTemplate"] = function anonymous(it
 ) {
-var out=' <div class="profiler-result"> <div class="profiler-button ';if(it.has_duplicate_sql_timings){out+='profiler-warning';}out+='"> ';if(it.has_duplicate_sql_timings){out+='<span class="profiler-nuclear">!</span>';}out+=' <span class="profiler-number"> '+( MiniProfiler.formatDuration(it.duration_milliseconds))+' <span class="profiler-unit">ms</span> </span> ';if(MiniProfiler.showTotalSqlCount()){out+=' <span class="profiler-number"> '+( it.sql_count)+' <span class="profiler-unit">sql</span> </span> ';}out+=' </div> <div class="profiler-popup"> <div class="profiler-info"> <span class="profiler-name"> '+( it.name)+' <span class="profiler-overall-duration">('+( MiniProfiler.formatDuration(it.duration_milliseconds))+' ms)</span> </span> <span class="profiler-server-time">'+( it.machine_name)+' on '+( MiniProfiler.renderDate(it.started_formatted))+'</span> </div> <div class="profiler-output"> <table class="profiler-timings"> <thead> <tr> <th>event</th> <th>duration (ms)</th> <th class="profiler-duration-with-children">with children (ms)</th> <th class="time-from-start">from start (ms)</th> ';if(it.has_sql_timings){out+=' <th colspan="2">query time (ms)</th> ';}out+=' ';var arr1=it.custom_timing_names;if(arr1){var value,i1=-1,l1=arr1.length-1;while(i1<l1){value=arr1[i1+=1];out+=' <th colspan="2">'+( value.toLowerCase() )+' (ms)</th> ';} } out+=' </tr> </thead> <tbody> '+( MiniProfiler.templates.timingTemplate({timing: it.root, page: it}) )+' </tbody> <tfoot> <tr> <td colspan="3"> ';if(!it.client_timings){out+=' '+( MiniProfiler.templates.linksTemplate({timing: it.root, page: it}) )+' ';}out+=' <a class="profiler-toggle-duration-with-children" title="toggles column with aggregate child durations">show time with children</a> <a class="profiler-snapshots-page-link" title="Go to snapshots page" href="'+( MiniProfiler.options.path )+'snapshots">snapshots</a> </td> ';if(it.has_sql_timings){out+=' <td colspan="2" class="profiler-number profiler-percent-in-sql" title="'+( MiniProfiler.getSqlTimingsCount(it.root) )+' queries spent '+( MiniProfiler.formatDuration(it.duration_milliseconds_in_sql) )+' ms of total request time"> '+( MiniProfiler.formatDuration(it.duration_milliseconds_in_sql / it.duration_milliseconds * 100) )+' <span class="profiler-unit">% in sql</span> </td> ';}out+=' ';var arr2=it.custom_timing_names;if(arr2){var value,i2=-1,l2=arr2.length-1;while(i2<l2){value=arr2[i2+=1];out+=' <td colspan="2" class="profiler-number profiler-percentage-in-sql" title="'+( it.custom_timing_stats[value].count )+' '+( value.toLowerCase() )+' invocations spent '+( MiniProfiler.formatDuration(it.custom_timing_stats[value].duration) )+' ms of total request time"> '+( MiniProfiler.formatDuration(it.custom_timing_stats[value].duration / it.duration_milliseconds * 100) )+' <span class="profiler-unit">% in '+( value.toLowerCase() )+'</span> </td> ';} } out+=' </tr> </tfoot> </table> ';if(it.client_timings){out+=' <table class="profiler-timings profiler-client-timings"> <thead> <tr> <th>client event</th> <th>duration (ms)</th> <th>from start (ms)</th> </tr> </thead> <tbody> ';var arr3=MiniProfiler.getClientTimings(it.client_timings);if(arr3){var value,i3=-1,l3=arr3.length-1;while(i3<l3){value=arr3[i3+=1];out+=' <tr class="';if(value.isTrivial){out+='profiler-trivial';}out+='"> <td class="profiler-label">'+( value.name )+'</td> <td class="profiler-duration"> ';if(value.duration >= 0){out+=' <span class="profiler-unit"></span>'+( MiniProfiler.formatDuration(value.duration) )+' ';}out+=' </td> <td class="profiler-duration time-from-start"> <span class="profiler-unit">+</span>'+( MiniProfiler.formatDuration(value.start) )+' </td> </tr> ';} } out+=' </tbody> <tfoot> <td colspan="3"> '+( MiniProfiler.templates.linksTemplate({timing: it.root, page: it}) )+' </td> </tfoot> </table> ';}out+=' ';if(it.custom_fields && Object.keys(it.custom_fields).length > 0){out+=' <p class="custom-fields-title">Snapshot custom fields</p> <table class="profiler-timings"> <tbody> ';var arr4=Object.keys(it.custom_fields);if(arr4){var key,i4=-1,l4=arr4.length-1;while(i4<l4){key=arr4[i4+=1];out+=' <tr> <td class="profiler-label">'+( key )+'</td> <td class="profiler-label">'+( it.custom_fields[key] )+'</td> </tr> ';} } out+=' </tbody> </table> ';}out+=' </div> </div> ';if(it.has_sql_timings){out+=' <div class="profiler-queries"> <table> <thead> <tr> <th style="text-align:right">step<br />time from start<br />query type<br />duration</th> <th style="text-align:left">call stack<br />query</th> </tr> </thead> <tbody> ';var arr5=MiniProfiler.getSqlTimings(it.root);if(arr5){var value,index=-1,l5=arr5.length-1;while(index<l5){value=arr5[index+=1];out+=' '+( MiniProfiler.templates.sqlGapTemplate({g: value.prevGap}) )+' '+( MiniProfiler.templates.sqlTimingTemplate({i: index, s: value}) )+' ';if(value.nextGap){out+=' '+( MiniProfiler.templates.sqlGapTemplate({g: value.nextGap}) )+' ';}out+=' ';} } out+=' </tbody> </table> <p class="profiler-trivial-gap-container"> <a class="profiler-toggle-trivial-gaps">show trivial gaps</a> </p> </div> ';}out+=' </div>';return out;
+var out=' <div class="profiler-result"> <div class="profiler-button ';if(it.has_duplicate_sql_timings){out+='profiler-warning';}out+='"> ';if(it.has_duplicate_sql_timings){out+='<span class="profiler-nuclear">!</span>';}out+=' <span class="profiler-number"> '+( MiniProfiler.formatDuration(it.duration_milliseconds))+' <span class="profiler-unit">ms</span> </span> ';if(MiniProfiler.showTotalSqlCount()){out+=' <span class="profiler-number"> '+( it.sql_count)+' <span class="profiler-unit">sql</span> </span> ';}out+=' </div> <div class="profiler-popup"> <div class="profiler-info"> <span class="profiler-name"> '+( it.name)+' <span class="profiler-overall-duration">('+( MiniProfiler.formatDuration(it.duration_milliseconds))+' ms)</span> </span> <span class="profiler-server-time">'+( it.machine_name)+' on '+( MiniProfiler.renderDate(it.started_formatted))+'</span> </div> <div class="profiler-output"> <table class="profiler-timings"> <thead> <tr> <th>event</th> <th>duration (ms)</th> <th class="profiler-duration-with-children">with children (ms)</th> <th class="time-from-start">from start (ms)</th> ';if(it.has_sql_timings){out+=' <th colspan="2">query time (ms)</th> ';}out+=' ';var arr1=it.custom_timing_names;if(arr1){var value,i1=-1,l1=arr1.length-1;while(i1<l1){value=arr1[i1+=1];out+=' <th colspan="2">'+( value.toLowerCase() )+' (ms)</th> ';} } out+=' </tr> </thead> <tbody> '+( MiniProfiler.templates.timingTemplate({timing: it.root, page: it}) )+' </tbody> <tfoot> <tr> <td colspan="3"> ';if(!it.client_timings){out+=' '+( MiniProfiler.templates.linksTemplate({timing: it.root, page: it}) )+' ';}out+=' <a class="profiler-toggle-duration-with-children" title="toggles column with aggregate child durations">show time with children</a> <a class="profiler-snapshots-page-link" title="Go to snapshots page" href="'+( MiniProfiler.options.path )+'snapshots">snapshots</a> </td> ';if(it.has_sql_timings){out+=' <td colspan="2" class="profiler-number profiler-percent-in-sql" title="'+( MiniProfiler.getSqlTimingsCount(it.root) )+' queries spent '+( MiniProfiler.formatDuration(it.duration_milliseconds_in_sql) )+' ms of total request time"> '+( MiniProfiler.formatDuration(it.duration_milliseconds_in_sql / it.duration_milliseconds * 100) )+' <span class="profiler-unit">% in sql</span> </td> ';}out+=' ';var arr2=it.custom_timing_names;if(arr2){var value,i2=-1,l2=arr2.length-1;while(i2<l2){value=arr2[i2+=1];out+=' <td colspan="2" class="profiler-number profiler-percentage-in-sql" title="'+( it.custom_timing_stats[value].count )+' '+( value.toLowerCase() )+' invocations spent '+( MiniProfiler.formatDuration(it.custom_timing_stats[value].duration) )+' ms of total request time"> '+( MiniProfiler.formatDuration(it.custom_timing_stats[value].duration / it.duration_milliseconds * 100) )+' <span class="profiler-unit">% in '+( value.toLowerCase() )+'</span> </td> ';} } out+=' </tr> </tfoot> </table> ';if(it.client_timings){out+=' <table class="profiler-timings profiler-client-timings"> <thead> <tr> <th>client event</th> <th>duration (ms)</th> <th>from start (ms)</th> </tr> </thead> <tbody> ';var arr3=MiniProfiler.getClientTimings(it.client_timings);if(arr3){var value,i3=-1,l3=arr3.length-1;while(i3<l3){value=arr3[i3+=1];out+=' <tr class="';if(value.isTrivial){out+='profiler-trivial';}out+='"> <td class="profiler-label">'+( value.name )+'</td> <td class="profiler-duration"> ';if(value.duration >= 0){out+=' <span class="profiler-unit"></span>'+( MiniProfiler.formatDuration(value.duration) )+' ';}out+=' </td> <td class="profiler-duration time-from-start"> <span class="profiler-unit">+</span>'+( MiniProfiler.formatDuration(value.start) )+' </td> </tr> ';} } out+=' </tbody> <tfoot> <td colspan="3"> '+( MiniProfiler.templates.linksTemplate({timing: it.root, page: it}) )+' </td> </tfoot> </table> ';}out+=' ';if(it.custom_fields && Object.keys(it.custom_fields).length > 0){out+=' <p class="custom-fields-title">Snapshot custom fields</p> <table class="profiler-timings"> <tbody> ';var arr4=Object.keys(it.custom_fields);if(arr4){var key,i4=-1,l4=arr4.length-1;while(i4<l4){key=arr4[i4+=1];out+=' <tr> <td class="profiler-label">'+( key )+'</td> <td class="profiler-label">'+( it.custom_fields[key] )+'</td> </tr> ';} } out+=' </tbody> </table> ';}out+=' </div> </div> ';if(it.has_sql_timings){out+=' <div class="profiler-queries"> <table> <thead> <tr> <th class="ta-right">step<br />time from start<br />query type<br />duration</th> <th class="ta-left">call stack<br />query</th> </tr> </thead> <tbody> ';var arr5=MiniProfiler.getSqlTimings(it.root);if(arr5){var value,index=-1,l5=arr5.length-1;while(index<l5){value=arr5[index+=1];out+=' '+( MiniProfiler.templates.sqlGapTemplate({g: value.prevGap}) )+' '+( MiniProfiler.templates.sqlTimingTemplate({i: index, s: value}) )+' ';if(value.nextGap){out+=' '+( MiniProfiler.templates.sqlGapTemplate({g: value.nextGap}) )+' ';}out+=' ';} } out+=' </tbody> </table> <p class="profiler-trivial-gap-container"> <a class="profiler-toggle-trivial-gaps">show trivial gaps</a> </p> </div> ';}out+=' </div>';return out;
 }
 MiniProfiler.templates["linksTemplate"] = function anonymous(it
 ) {
-var out=' <a href="'+( MiniProfiler.shareUrl(it.page.id) )+'" class="profiler-share-profiler-results" target="_blank">share</a> <a href="'+( MiniProfiler.moreUrl(it.timing.name) )+'" class="profiler-more-actions">more</a> ';if(it.custom_link){out+=' <a href="'+( it.custom_link )+'" class="profiler-custom-link" target="_blank">'+( it.custom_link_name )+'</a> ';}out+=' ';if(it.page.has_trivial_timings){out+=' <a class="profiler-toggle-trivial" data-show-on-load="'+( it.page.has_all_trivial_timings )+'" title="toggles any rows with &lt; '+( it.page.trivial_duration_threshold_milliseconds )+' ms"> show trivial </a> ';}return out;
+var out=' <a href="'+( MiniProfiler.shareUrl(it.page.id) )+'" class="profiler-share-profiler-results" target="_blank">share</a> <a href="'+( MiniProfiler.moreUrl(it.timing.name) )+'" class="profiler-more-actions">more</a> ';if(it.page.has_flamegraph){out+=' <a href="'+( MiniProfiler.flamegraphUrl(it.page.id) )+'" class="profiler-show-flamegraph" target="_blank">flamegraph</a> ';}out+=' ';if(it.custom_link){out+=' <a href="'+( it.custom_link )+'" class="profiler-custom-link" target="_blank">'+( it.custom_link_name )+'</a> ';}out+=' ';if(it.page.has_trivial_timings){out+=' <a class="profiler-toggle-trivial" data-show-on-load="'+( it.page.has_all_trivial_timings )+'" title="toggles any rows with &lt; '+( it.page.trivial_duration_threshold_milliseconds )+' ms"> show trivial </a> ';}return out;
 }
 MiniProfiler.templates["timingTemplate"] = function anonymous(it
 ) {

data/lib/mini_profiler/asset_version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Rack
   class MiniProfiler
-    ASSET_VERSION = '644e88e41aaa4b3ea7e36f7c445b7bfd'
+    ASSET_VERSION = '35a79b300ab5afa978cb59af0b05e059'
   end
 end

data/lib/mini_profiler/client_settings.rb

@@ -42,7 +42,7 @@ module Rack
       def handle_cookie(result)
         status, headers, _body = result
 
-        if (MiniProfiler.config.authorization_mode == :whitelist && !MiniProfiler.request_authorized?)
+        if (MiniProfiler.config.authorization_mode == :allow_authorized && !MiniProfiler.request_authorized?)
           # this is non-obvious, don't kill the profiling cookie on errors or short requests
           # this ensures that stuff that never reaches the rails stack does not kill profiling
           if status.to_i >= 200 && status.to_i < 300 && ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - @start) > 0.1)
@@ -59,7 +59,7 @@ module Rack
 
         tokens_changed = false
 
-        if MiniProfiler.request_authorized? && MiniProfiler.config.authorization_mode == :whitelist
+        if MiniProfiler.request_authorized? && MiniProfiler.config.authorization_mode == :allow_authorized
           @allowed_tokens ||= @store.allowed_tokens
           tokens_changed = !@orig_auth_tokens || ((@allowed_tokens - @orig_auth_tokens).length > 0)
         end
@@ -74,7 +74,7 @@ module Rack
           settings["bt"] = @backtrace_level     if @backtrace_level
           settings["a"] = @allowed_tokens.join("|") if @allowed_tokens && MiniProfiler.request_authorized?
           settings_string = settings.map { |k, v| "#{k}=#{v}" }.join(",")
-          cookie = { value: settings_string, path: '/', httponly: true }
+          cookie = { value: settings_string, path: MiniProfiler.config.cookie_path, httponly: true }
           cookie[:secure] = true if @request.ssl?
           cookie[:same_site] = 'Lax'
           Rack::Utils.set_cookie_header!(headers, COOKIE_NAME, cookie)
@@ -83,14 +83,14 @@ module Rack
 
       def discard_cookie!(headers)
         if @cookie
-          Rack::Utils.delete_cookie_header!(headers, COOKIE_NAME, path: '/')
+          Rack::Utils.delete_cookie_header!(headers, COOKIE_NAME, path: MiniProfiler.config.cookie_path)
         end
       end
 
       def has_valid_cookie?
         valid_cookie = !@cookie.nil?
 
-        if (MiniProfiler.config.authorization_mode == :whitelist) && valid_cookie
+        if (MiniProfiler.config.authorization_mode == :allow_authorized) && valid_cookie
           begin
             @allowed_tokens ||= @store.allowed_tokens
           rescue => e

data/lib/mini_profiler/config.rb

@@ -17,6 +17,7 @@ module Rack
         new.instance_eval {
           @auto_inject      = true # automatically inject on every html page
           @base_url_path    = "/mini-profiler-resources/".dup
+          @cookie_path      = "/".dup
           @disable_caching  = true
           # called prior to rack chain, to ensure we are allowed to profile
           @pre_authorize_cb = lambda { |env| true }
@@ -28,6 +29,7 @@ module Rack
           @authorization_mode     = :allow_all
           @backtrace_threshold_ms = 0
           @flamegraph_sample_rate = 0.5
+          @flamegraph_mode = :wall
           @storage_failure = Proc.new do |exception|
             if @logger
               @logger.warn("MiniProfiler storage failure: #{exception.message}")
@@ -57,6 +59,7 @@ module Rack
           @snapshots_transport_auth_key = nil
           @snapshots_redact_sql_queries = true
           @snapshots_transport_gzip_requests = false
+          @enable_hotwire_turbo_drive_support = false
 
           self
         }
@@ -64,11 +67,13 @@ module Rack
 
       attr_accessor :authorization_mode, :auto_inject, :backtrace_ignores,
         :backtrace_includes, :backtrace_remove, :backtrace_threshold_ms,
-        :base_url_path, :disable_caching, :enabled,
+        :base_url_path, :cookie_path, :disable_caching, :enabled,
         :flamegraph_sample_rate, :logger, :pre_authorize_cb, :skip_paths,
         :skip_schema_queries, :storage, :storage_failure, :storage_instance,
         :storage_options, :user_provider, :enable_advanced_debugging_tools,
-        :skip_sql_param_names, :suppress_encoding, :max_sql_param_length
+        :skip_sql_param_names, :suppress_encoding, :max_sql_param_length,
+        :content_security_policy_nonce, :enable_hotwire_turbo_drive_support,
+        :flamegraph_mode
 
       # ui accessors
       attr_accessor :collapse_results, :max_traces_to_show, :position,
@@ -86,6 +91,22 @@ module Rack
 
       attr_reader :assets_url
 
+      # redefined - since the accessor defines it first
+      undef :authorization_mode=
+      def authorization_mode=(mode)
+        if mode == :whitelist
+          warn "[DEPRECATION] `:whitelist` authorization mode is deprecated. Please use `:allow_authorized` instead."
+
+          mode = :allow_authorized
+        end
+
+        warn <<~DEP unless mode == :allow_authorized || mode == :allow_all
+          [DEPRECATION] unknown authorization mode #{mode}. Expected `:allow_all` or `:allow_authorized`.
+        DEP
+
+        @authorization_mode = mode
+      end
+
       def assets_url=(lmbda)
         if defined?(Rack::MiniProfilerRails)
           Rack::MiniProfilerRails.create_engine

data/lib/mini_profiler/profiler.rb

@@ -182,6 +182,7 @@ module Rack
 
       return serve_results(env) if file_name.eql?('results')
       return handle_snapshots_request(env) if file_name.eql?('snapshots')
+      return serve_flamegraph(env) if file_name.eql?('flamegraph')
 
       resources_env = env.dup
       resources_env['PATH_INFO'] = file_name
@@ -213,7 +214,7 @@ module Rack
     def call(env)
       start = Process.clock_gettime(Process::CLOCK_MONOTONIC)
       client_settings = ClientSettings.new(env, @storage, start)
-      MiniProfiler.deauthorize_request if @config.authorization_mode == :whitelist
+      MiniProfiler.deauthorize_request if @config.authorization_mode == :allow_authorized
 
       status = headers = body = nil
       query_string = env['QUERY_STRING']
@@ -239,7 +240,7 @@ module Rack
       skip_it = (@config.pre_authorize_cb && !@config.pre_authorize_cb.call(env))
 
       if skip_it || (
-        @config.authorization_mode == :whitelist &&
+        @config.authorization_mode == :allow_authorized &&
         !client_settings.has_valid_cookie?
       )
         if take_snapshot?(path)
@@ -281,6 +282,15 @@ module Rack
       # profile memory
       if query_string =~ /pp=profile-memory/
         return tool_disabled_message(client_settings) if !advanced_debugging_enabled?
+
+        unless defined?(MemoryProfiler) && MemoryProfiler.respond_to?(:report)
+          message = "Please install the memory_profiler gem and require it: add gem 'memory_profiler' to your Gemfile"
+          _, _, body = @app.call(env)
+          body.close if body.respond_to? :close
+
+          return client_settings.handle_cookie(text_result(message))
+        end
+
         query_params = Rack::Utils.parse_nested_query(query_string)
         options = {
           ignore_files: query_params['memory_profiler_ignore_files'],
@@ -336,11 +346,12 @@ module Rack
         # Prevent response body from being compressed
         env['HTTP_ACCEPT_ENCODING'] = 'identity' if config.suppress_encoding
 
-        if query_string =~ /pp=flamegraph/
+        if query_string =~ /pp=(async-)?flamegraph/ || env['HTTP_REFERER'] =~ /pp=async-flamegraph/
           unless defined?(StackProf) && StackProf.respond_to?(:run)
-
-            flamegraph = "Please install the stackprof gem and require it: add gem 'stackprof' to your Gemfile"
-            status, headers, body = @app.call(env)
+            headers = { 'Content-Type' => 'text/html' }
+            message = "Please install the stackprof gem and require it: add gem 'stackprof' to your Gemfile"
+            body.close if body.respond_to? :close
+            return client_settings.handle_cookie([500, headers, message])
           else
             # do not sully our profile with mini profiler timings
             current.measure = false
@@ -351,8 +362,17 @@ module Rack
             else
               sample_rate = config.flamegraph_sample_rate
             end
+
+            mode_match_data = query_string.match(/flamegraph_mode=([a-zA-Z]+)/)
+
+            if mode_match_data && [:cpu, :wall, :object, :custom].include?(mode_match_data[1].to_sym)
+              mode = mode_match_data[1].to_sym
+            else
+              mode = config.flamegraph_mode
+            end
+
             flamegraph = StackProf.run(
-              mode: :wall,
+              mode: mode,
               raw: true,
               aggregate: false,
               interval: (sample_rate * 1000).to_i
@@ -379,7 +399,7 @@ module Rack
 
       skip_it = current.discard
 
-      if (config.authorization_mode == :whitelist && !MiniProfiler.request_authorized?)
+      if (config.authorization_mode == :allow_authorized && !MiniProfiler.request_authorized?)
         skip_it = true
       end
 
@@ -420,9 +440,12 @@ module Rack
       page_struct[:user] = user(env)
       page_struct[:root].record_time((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start) * 1000)
 
-      if flamegraph
+      if flamegraph && query_string =~ /pp=flamegraph/
         body.close if body.respond_to? :close
         return client_settings.handle_cookie(self.flamegraph(flamegraph, path))
+      elsif flamegraph # async-flamegraph
+        page_struct[:has_flamegraph] = true
+        page_struct[:flamegraph] = flamegraph
       end
 
       begin
@@ -616,7 +639,7 @@ module Rack
     end
 
     def text_result(body)
-      headers = { 'Content-Type' => 'text/plain' }
+      headers = { 'Content-Type' => 'text/plain; charset=utf-8' }
       [200, headers, [body]]
     end
 
@@ -629,7 +652,7 @@ module Rack
       headers = { 'Content-Type' => 'text/html' }
       body = "<html><body>
 <pre style='line-height: 30px; font-size: 16px;'>
-Append the following to your query string:
+This is the help menu of the <a href='#{Rack::MiniProfiler::SOURCE_CODE_URI}'>rack-mini-profiler</a> gem, append the following to your query string for more options:
 
   #{make_link "help", env} : display this screen
   #{make_link "env", env} : display the rack environment
@@ -639,13 +662,15 @@ Append the following to your query string:
   #{make_link "full-backtrace", env} #{"(*) " if client_settings.backtrace_full?}: enable full backtraces for SQL executed (use pp=normal-backtrace to disable)
   #{make_link "disable", env} : disable profiling for this session
   #{make_link "enable", env} : enable profiling for this session (if previously disabled)
-  #{make_link "profile-gc", env} : perform gc profiling on this request, analyzes ObjectSpace generated by request (ruby 1.9.3 only)
+  #{make_link "profile-gc", env} : perform gc profiling on this request, analyzes ObjectSpace generated by request
   #{make_link "profile-memory", env} : requires the memory_profiler gem, new location based report
-  #{make_link "flamegraph", env} : requires Ruby 2.2, a graph representing sampled activity (requires the stackprof gem).
+  #{make_link "flamegraph", env} : a graph representing sampled activity (requires the stackprof gem).
+  #{make_link "async-flamegraph", env} : store flamegraph data for this page and all its AJAX requests. Flamegraph links will be available in the mini-profiler UI (requires the stackprof gem).
   #{make_link "flamegraph&flamegraph_sample_rate=1", env}: creates a flamegraph with the specified sample rate (in ms). Overrides value set in config
-  #{make_link "flamegraph_embed", env} : requires Ruby 2.2, a graph representing sampled activity (requires the stackprof gem), embedded resources for use on an intranet.
-  #{make_link "trace-exceptions", env} : requires Ruby 2.0, will return all the spots where your application raises exceptions
-  #{make_link "analyze-memory", env} : requires Ruby 2.0, will perform basic memory analysis of heap
+  #{make_link "flamegraph&flamegraph_mode=cpu", env}: creates a flamegraph with the specified mode (one of cpu, wall, object, or custom). Overrides value set in config
+  #{make_link "flamegraph_embed", env} : a graph representing sampled activity (requires the stackprof gem), embedded resources for use on an intranet.
+  #{make_link "trace-exceptions", env} : will return all the spots where your application raises exceptions
+  #{make_link "analyze-memory", env} : will perform basic memory analysis of heap
 </pre>
 </body>
 </html>
@@ -656,35 +681,31 @@ Append the following to your query string:
 
     def flamegraph(graph, path)
       headers = { 'Content-Type' => 'text/html' }
-      if Hash === graph
-        html = <<~HTML
-          <!DOCTYPE html>
-          <html>
-            <head>
-              <style>
-                body { margin: 0; height: 100vh; }
-                #speedscope-iframe { width: 100%; height: 100%; border: none; }
-              </style>
-            </head>
-            <body>
-              <script type="text/javascript">
-                var graph = #{JSON.generate(graph)};
-                var json = JSON.stringify(graph);
-                var blob = new Blob([json], { type: 'text/plain' });
-                var objUrl = encodeURIComponent(URL.createObjectURL(blob));
-                var iframe = document.createElement('IFRAME');
-                iframe.setAttribute('id', 'speedscope-iframe');
-                document.body.appendChild(iframe);
-                var iframeUrl = '#{@config.base_url_path}speedscope/index.html#profileURL=' + objUrl + '&title=' + 'Flamegraph for #{CGI.escape(path)}';
-                iframe.setAttribute('src', iframeUrl);
-              </script>
-            </body>
-          </html>
-        HTML
-        [200, headers, [html]]
-      else
-        [200, headers, [graph]]
-      end
+      html = <<~HTML
+        <!DOCTYPE html>
+        <html>
+          <head>
+            <style>
+              body { margin: 0; height: 100vh; }
+              #speedscope-iframe { width: 100%; height: 100%; border: none; }
+            </style>
+          </head>
+          <body>
+            <script type="text/javascript">
+              var graph = #{JSON.generate(graph)};
+              var json = JSON.stringify(graph);
+              var blob = new Blob([json], { type: 'text/plain' });
+              var objUrl = encodeURIComponent(URL.createObjectURL(blob));
+              var iframe = document.createElement('IFRAME');
+              iframe.setAttribute('id', 'speedscope-iframe');
+              document.body.appendChild(iframe);
+              var iframeUrl = '#{@config.base_url_path}speedscope/index.html#profileURL=' + objUrl + '&title=' + 'Flamegraph for #{CGI.escape(path)}';
+              iframe.setAttribute('src', iframeUrl);
+            </script>
+          </body>
+        </html>
+      HTML
+      [200, headers, [html]]
     end
 
     def ids(env)
@@ -717,6 +738,10 @@ Append the following to your query string:
       url = "#{path}includes.js?v=#{version}" if !url
       css_url = "#{path}includes.css?v=#{version}" if !css_url
 
+      content_security_policy_nonce = @config.content_security_policy_nonce ||
+                                      env["action_dispatch.content_security_policy_nonce"] ||
+                                      env["secure_headers_content_security_policy_nonce"]
+
       settings = {
        path: path,
        url: url,
@@ -734,7 +759,9 @@ Append the following to your query string:
        startHidden: @config.start_hidden,
        collapseResults: @config.collapse_results,
        htmlContainer: @config.html_container,
-       hiddenCustomFields: @config.snapshot_hidden_custom_fields.join(',')
+       hiddenCustomFields: @config.snapshot_hidden_custom_fields.join(','),
+       cspNonce: content_security_policy_nonce,
+       hotwireTurboDriveSupport: @config.enable_hotwire_turbo_drive_support,
       }
 
       if current && current.page_struct
@@ -746,7 +773,7 @@ Append the following to your query string:
       end
 
       # TODO : cache this snippet
-      script = IO.read(::File.expand_path('../html/profile_handler.js', ::File.dirname(__FILE__)))
+      script = ::File.read(::File.expand_path('../html/profile_handler.js', ::File.dirname(__FILE__)))
       # replace the variables
       settings.each do |k, v|
         regex = Regexp.new("\\{#{k.to_s}\\}")
@@ -815,6 +842,24 @@ Append the following to your query string:
       response.finish
     end
 
+    def serve_flamegraph(env)
+      request     = Rack::Request.new(env)
+      id          = request.params['id']
+      page_struct = @storage.load(id)
+
+      if !page_struct
+        id        = ERB::Util.html_escape(id)
+        user_info = ERB::Util.html_escape(user(env))
+        return [404, {}, ["Request not found: #{id} - user #{user_info}"]]
+      end
+
+      if !page_struct[:flamegraph]
+        return [404, {}, ["No flamegraph available for #{ERB::Util.html_escape(id)}"]]
+      end
+
+      self.flamegraph(page_struct[:flamegraph], page_struct[:request_path])
+    end
+
     def rails_route_from_path(path, method)
       if defined?(Rails) && defined?(ActionController::RoutingError)
         hash = Rails.application.routes.recognize_path(path, method: method)

data/lib/mini_profiler/storage/abstract_store.rb

@@ -36,7 +36,7 @@ module Rack
         ""
       end
 
-      # a list of tokens that are permitted to access profiler in whitelist mode
+      # a list of tokens that are permitted to access profiler in explicit mode
       def allowed_tokens
         raise NotImplementedError.new("allowed_tokens is not implemented")
       end

data/lib/mini_profiler/storage/file_store.rb

@@ -17,7 +17,9 @@ module Rack
         def [](key)
           begin
             data = ::File.open(path(key), "rb") { |f| f.read }
+            # rubocop:disable Security/MarshalLoad
             Marshal.load data
+            # rubocop:enable Security/MarshalLoad
           rescue
             nil
           end

data/lib/mini_profiler/storage/memcache_store.rb

@@ -24,7 +24,9 @@ module Rack
 
       def load(id)
         raw = @client.get("#{@prefix}#{id}")
-        Marshal::load(raw) if raw
+        # rubocop:disable Security/MarshalLoad
+        Marshal.load(raw) if raw
+        # rubocop:enable Security/MarshalLoad
       end
 
       def set_unviewed(user, id)
@@ -65,14 +67,16 @@ module Rack
         key1, key2, cycle_at = nil
 
         if token_info
-          key1, key2, cycle_at = Marshal::load(token_info)
+          # rubocop:disable Security/MarshalLoad
+          key1, key2, cycle_at = Marshal.load(token_info)
+          # rubocop:enable Security/MarshalLoad
 
-           key1 = nil unless key1 && key1.length == 32
-           key2 = nil unless key2 && key2.length == 32
+          key1 = nil unless key1 && key1.length == 32
+          key2 = nil unless key2 && key2.length == 32
 
-           if key1 && cycle_at && (cycle_at > Process.clock_gettime(Process::CLOCK_MONOTONIC))
-             return [key1, key2].compact
-           end
+          if key1 && cycle_at && (cycle_at > Process.clock_gettime(Process::CLOCK_MONOTONIC))
+            return [key1, key2].compact
+          end
         end
 
         timeout = Rack::MiniProfiler::AbstractStore::MAX_TOKEN_AGE

data/lib/mini_profiler/storage/redis_store.rb

@@ -25,7 +25,9 @@ module Rack
         key = prefixed_id(id)
         raw = redis.get key
         begin
-          Marshal::load(raw) if raw
+          # rubocop:disable Security/MarshalLoad
+          Marshal.load(raw) if raw
+          # rubocop:enable Security/MarshalLoad
         rescue
           # bad format, junk old data
           redis.del key
@@ -177,7 +179,9 @@ unviewed_ids: #{get_unviewed_ids(user)}
           batch = redis.mapped_hmget(hash_key, *ids).to_a
           batch.map! do |id, bytes|
             begin
+              # rubocop:disable Security/MarshalLoad
               Marshal.load(bytes)
+              # rubocop:enable Security/MarshalLoad
             rescue
               corrupt_snapshots << id
               nil
@@ -189,9 +193,9 @@ unviewed_ids: #{get_unviewed_ids(user)}
           iteration += 1
         end
         if corrupt_snapshots.size > 0
-          redis.pipelined do
-            redis.zrem(zset_key, corrupt_snapshots)
-            redis.hdel(hash_key, corrupt_snapshots)
+          redis.pipelined do |pipeline|
+            pipeline.zrem(zset_key, corrupt_snapshots)
+            pipeline.hdel(hash_key, corrupt_snapshots)
           end
         end
       end
@@ -200,11 +204,13 @@ unviewed_ids: #{get_unviewed_ids(user)}
         hash_key = snapshot_hash_key()
         bytes = redis.hget(hash_key, id)
         begin
+          # rubocop:disable Security/MarshalLoad
           Marshal.load(bytes)
+          # rubocop:enable Security/MarshalLoad
         rescue
-          redis.pipelined do
-            redis.zrem(snapshot_zset_key(), id)
-            redis.hdel(hash_key, id)
+          redis.pipelined do |pipeline|
+            pipeline.zrem(snapshot_zset_key(), id)
+            pipeline.hdel(hash_key, id)
           end
           nil
         end
@@ -253,11 +259,11 @@ unviewed_ids: #{get_unviewed_ids(user)}
 
       # only used in tests
       def wipe_snapshots_data
-        redis.pipelined do
-          redis.del(snapshot_counter_key())
-          redis.del(snapshot_zset_key())
-          redis.del(snapshot_hash_key())
-        end
+        redis.del(
+          snapshot_counter_key(),
+          snapshot_zset_key(),
+          snapshot_hash_key(),
+        )
       end
     end
   end

data/lib/mini_profiler/timer_struct/page.rb

@@ -87,7 +87,9 @@ module Rack
             executed_non_queries: 0,
             custom_timing_names: [],
             custom_timing_stats: {},
-            custom_fields: {}
+            custom_fields: {},
+            has_flamegraph: false,
+            flamegraph: nil
           )
           self[:request_method] = env['REQUEST_METHOD']
           self[:request_path] = env['PATH_INFO']
@@ -111,12 +113,16 @@ module Rack
           @attributes[:root]
         end
 
+        def attributes_to_serialize
+          @attributes.keys - [:flamegraph]
+        end
+
         def to_json(*a)
-          ::JSON.generate(@attributes.merge(self.extra_json))
+          ::JSON.generate(@attributes.slice(*attributes_to_serialize).merge(extra_json))
         end
 
         def as_json(options = nil)
-          super(options).merge!(extra_json)
+          super(options).slice(*attributes_to_serialize.map(&:to_s)).merge!(extra_json)
         end
 
         def extra_json

data/lib/mini_profiler/version.rb

@@ -2,6 +2,7 @@
 
 module Rack
   class MiniProfiler
-    VERSION = '2.3.1'
+    VERSION = '2.3.4'
+    SOURCE_CODE_URI = 'https://github.com/MiniProfiler/rack-mini-profiler'
   end
 end

data/lib/mini_profiler_rails/railtie.rb

@@ -35,7 +35,7 @@ module Rack::MiniProfilerRails
     end
 
     unless Rails.env.development? || Rails.env.test?
-      c.authorization_mode = :whitelist
+      c.authorization_mode = :allow_authorized
     end
 
     if Rails.logger

data/lib/patches/db/riak.rb

@@ -2,7 +2,7 @@
 
 # riak-client 2.2.2 patches
 class Riak::Multiget
-  class <<self
+  class << self
     alias_method :get_all_without_profiling, :get_all
     def get_all(client, fetch_list)
       return get_all_without_profiling(client, fetch_list) unless SqlPatches.should_measure?

data/rack-mini-profiler.gemspec

@@ -24,7 +24,7 @@ Gem::Specification.new do |s|
   s.required_ruby_version = '>= 2.4.0'
 
   s.metadata = {
-    'source_code_uri' => 'https://github.com/MiniProfiler/rack-mini-profiler',
+    'source_code_uri' => Rack::MiniProfiler::SOURCE_CODE_URI,
     'changelog_uri' => 'https://github.com/MiniProfiler/rack-mini-profiler/blob/master/CHANGELOG.md'
   }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-mini-profiler
 version: !ruby/object:Gem::Version
-  version: 2.3.1
+  version: 2.3.4
 platform: ruby
 authors:
 - Sam Saffron
@@ -10,7 +10,7 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-01-28 00:00:00.000000000 Z
+date: 2022-02-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack
@@ -354,7 +354,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.2
+rubygems_version: 3.1.6
 signing_key:
 specification_version: 4
 summary: Profiles loading speed for rack applications.