rack-mini-profiler 1.1.3 → 1.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5d7135086b980cb3201aab37e65fa4b1d9d192498c94976b724480d0487a2694
-  data.tar.gz: deb8ce345b8e7c8096297c7a3199ce218a72e7b06b47bd3708620fba6d5492a9
+  metadata.gz: 23beddd8a924076759b5f25229f0e9a2c91dee5b916f2e4712381c247ad4922d
+  data.tar.gz: af7fc0fbe8008e5159e86b4cdf4fb19d694e15ea125eae2c776b0815df3dca0f
 SHA512:
-  metadata.gz: d389a986e89d4019afdab48aa1680d94a7bb3250886131e1887598d82a21a74583c192df2de377ed130b28052904f3938f1904e384607878d399ec8483476323
-  data.tar.gz: 662f669f1a7861bd55728b281d78270808bcc8d06fddc7bc795b24a58304b677e709e2bf48aa1e4624a58698b6bb873dae3675877a10c461c563a9c525f59a3c
+  metadata.gz: bc6a2e360c45f76f9a66f12e649932ced7a2fdad4e6102eb551df688065970ef47d6b3a4871fa3f642c6b86884b236b547c98fc14de5ba93ee44c4fdbf4a6f90
+  data.tar.gz: f6d0ea244eac7b8a40adb7556a7185a245d378402248bd9317be18a616ed2d4c4ba4203401600bb9416f38f875762d688a1191a52a17c643793d4a5a4607f6b5

data/CHANGELOG.md

@@ -1,20 +1,24 @@
 # CHANGELOG
 
-## 1.1.3 2019-28-10
+## 1.1.4 - 2019-12-12
+
+- [SECURITY] carefully crafted SQL could cause an XSS on sites that do not use CSPs
+
+## 1.1.3 - 2019-10-28
 
 - [FEATURE] precompile all templates to avoid need for unsafe-eval
 
-## 1.1.2 2019-24-10
+## 1.1.2 - 2019-10-24
 
 - [FIX] JS payload was not working on IE11 and leading to errors
 - [FIX] Remove global singleton_class which was injected
 - [FIX] Regressions post removal of jQuery
 
-## 1.1.1 2019-22-10
+## 1.1.1 - 2019-10-22
 
 - [FIX] correct JavaScript fetch support header iteration (Jorge Manrubia)
 
-## 1.1.0 2019-10-01
+## 1.1.0 - 2019-10-01
 
 - [FEATURE] remove jQuery dependency, switch template library to dot.js
 - [FEATURE] disable all sensitive debugging methods by default (env, memory profiling) can be enabled with enable_advanced_debugging_tools.
@@ -22,11 +26,11 @@
 - [FEATURE] `/rack-mini-profiler/requests` can be used to monitor all requests for apps that do not have a UI (like API apps)
 - [SECURITY] XSS injection in `?pp=help` via rogue uri
 
-## 1.0.2 2019-02-05
+## 1.0.2 - 2019-02-05
 
 - [FIX] correct script injection to work with Rails 6 and above
 
-## 1.0.1 2018-12-10
+## 1.0.1 - 2018-12-10
 
 - [FIX] add support for exec_params instrumentation in PG, this method as of PG 1.1.0 no longer
  routes calls to exec / async_exec
@@ -36,7 +40,7 @@
 - [FIX] getEntriesByName is missing in iOS, workaround
 - [FEATURE] drop support for Ruby 2.2.0 we require 2.3.0 and up (EOL Ruby no longer supported)
 
-## 1.0.0 2017-03-29
+## 1.0.0 - 2018-03-29
 
 - [BREAKING CHANGE] Ruby version 2.2.0 or later is required
 - [FEATURE] use new web performance API to avoid warning @MikeRogers0
@@ -44,16 +48,16 @@
 - [FIX] correct jQuery 3.0 deprecations @TiSer
 - [FIX] JS in IFRAME @naiyt
 
-## 0.10.8 2017-12-01
+## 0.10.8 - 2017-12-01
 
 - [FEATURE] Add `# frozen_string_literal: true` to all `lib/**/*.rb` files
 
-## 0.10.7 2017-11-24
+## 0.10.7 - 2017-11-24
 
 - [FEATURE] Replace Time.now with Process.clock_gettime(Process::CLOCK_MONOTONIC)
 - [FIX] Error with webrick and empty cache control
 
-## 0.10.6 2017-10-30
+## 0.10.6 - 2017-10-30
 
 - [FEATURE] Support for vertical positions (top/bottom)
 - [FEATURE] Suppress profiler results in print media @Mike Dillon
@@ -61,11 +65,11 @@
 - [FEATURE] install generator @yhirano
 - [FEATURE] store initial cache control headers in X-MiniProfiler-Original-Cache-Control @mrasu
 
-## 0.10.5 2017-05-22
+## 0.10.5 - 2017-05-22
 
 - [FIX] revert PG bind sniffing until it is properly tested
 
-## 0.10.4 2017-05-17
+## 0.10.4 - 2017-05-17
 
 - [FEATURE] log binds for pg @neznauy
 - [FIX] use async exec pg monkey patch instead of exec
@@ -74,25 +78,25 @@
 - [FIX] ensure redis get_unviewed_ids returns only ids that exist
 - [FIX] correctly respect SCRIPT in env if it is sniffed by middleware
 
-## 0.10.2 2017-02-08
+## 0.10.2 - 2017-02-08
 
 - [FIX] improve turbolinks support
 - [FEATURE] make location of mini_profiler injection customizable
 
-## 0.10.1 2016-05-18
+## 0.10.1 - 2016-05-18
 
 - [FEATURE] push forward the security checks so no work is ever done if a valid production
     cookie is not available (@sam)
 
-## 0.9.9.2 2016-03-06
+## 0.9.9.2 - 2016-03-06
 
 - [FEATURE] on pageTransition collapse previously expanded timings
 
-## 0.9.9.1 2016-03-06
+## 0.9.9.1 - 2016-03-06
 
 - [FEATURE] expost MiniProfiler.pageTransition() for use by SPA web apps (@sam)
 
-## 0.9.9 2016-03-06
+## 0.9.9 - 2016-03-06
 
 - [FIX] removes alias_method_chain in favor of alias_method until Ruby 1.9.3 (@ayfredlund)
 - [FIX] Dont block mongo when already patched for another db (@rrooding @kbrock)
@@ -148,7 +152,7 @@
 - [FIXED] Possible XSS (admin only)
 - [FIXED] Corrected Sql patching to avoid setting instance vars on nil which is frozen (thanks Andy, huoxito)
 
-## 0.9.0.pre - 2013-12-12 (Sam Saffron)
+## 0.9.0.pre - 2013-12-05 (Sam Saffron)
 - Bumped up version to reflect the stability of the project
 - [IMPROVED] Reports for pp=profile-gc
 - [IMPROVED] pp=flamegraph&flamegraph_sample_rate=1 , allow you to specify sampling rates
@@ -158,7 +162,7 @@
   config.assets.prefix path since developers can rename the path to serve Asset Pipeline
   files from
 
-## 2013-09-03
+## 0.1.31 - 2013-09-03
 - [IMPROVED] Flamegraph now has much increased fidelity
 - [REMOVED] Ripped out flamegraph so it can be isolated into a gem
 - [REMOVED] Ripped out pp=sample it just was never really used
@@ -214,13 +218,13 @@
 - [ADDED] New MemchacedStore
 - [ADDED] Rails 4 support
 
-## 2012-09-12 (Sam Saffron)
+## 0.1.20 - 2012-09-12 (Sam Saffron)
 - [ADDED] pp=profile-gc: allows you to profile the GC in Ruby 1.9.3
 
 ## 0.1.19 - 2012-09-10 (Sam Saffron)
 - [FIXED] Compatibility issue with Ruby 1.8.7
 
-## 0.1.17 - 2012-09-09 (Sam Saffron)
+## 0.1.17 - 2012-09-07 (Sam Saffron)
 - [FIXED] pp=sample was bust unless stacktrace was installed
 
 ## 0.1.16 - 2012-09-05 (Sam Saffron)
@@ -244,10 +248,10 @@
 ## 0.1.12.pre - 2012-08-20 (Sam Saffron)
 - [IMPROVED] Cap X-MiniProfiler-Ids at 10, otherwise the header can get killed
 
-## 2012-08-10 (Sam Saffron)
+## 0.1.11.pre - 2012-08-10 (Sam Saffron)
 - [ADDED] Basic prepared statement profiling for Postgres
 
-## 2012-08-07 (Sam Saffron)
+## 0.1.10 - 2012-08-07 (Sam Saffron)
 - [ADDED] Option to disable profiler for the current session (pp=disable / pp=enable)
 - [ADDED] yajl compatability contributed by Sven Riedel
 
@@ -261,7 +265,7 @@
 - [ADDED] First Paint time for Google Chrome
 - [FIXED] Ensure non Rails installs have mini profiler
 
-## 2012-07-12 (Sam Saffron)
+## 0.1.6 - 2012-07-12 (Sam Saffron)
 - [ADDED] Native PG and MySql2 interceptors, this gives way more accurate times
 - [ADDED] some more client probing built in to rails
 - [IMPROVED] Refactored context so its a proper class and not a hash
@@ -275,7 +279,7 @@
   production
 - [IMPROVED] Cleaned up railties, got rid of the post authorize callback
 
-## 2012-06-28 (Sam Saffron)
+## 0.1.1 - 2012-06-28 (Sam Saffron)
 - [ADDED] Started change log
 - [ADDED] added MemcacheStore
 - [IMPROVED] Corrected profiler so it properly captures POST requests (was supressing non 200s)

data/README.md

@@ -19,7 +19,7 @@ Middleware that displays speed badge for every html page. Designed to work both
 
 ## rack-mini-profiler needs your help
 
-We have decided to restructure our repository so there is a central UI repo and the various language implementation have their own.
+We have decided to restructure our repository so there is a central UI repo and the various language implementations have their own.
 
 **WE NEED HELP.**
 
@@ -53,7 +53,7 @@ All you have to do is to include the Gem and you're good to go in development. S
 
 #### Rails and manual initialization
 
-In case you need to make sure rack_mini_profiler initialized is after all other gems, or you want to execute some code before rack_mini_profiler required:
+In case you need to make sure rack_mini_profiler is initialized after all other gems, or you want to execute some code before rack_mini_profiler required:
 
 ```ruby
 gem 'rack-mini-profiler', require: false
@@ -227,8 +227,7 @@ Rack::MiniProfiler.config.storage = Rack::MiniProfiler::MemoryStore
 
 # set RedisStore
 if Rails.env.production?
-  uri = URI.parse(ENV["REDIS_SERVER_URL"])
-  Rack::MiniProfiler.config.storage_options = { :host => uri.host, :port => uri.port, :password => uri.password }
+  Rack::MiniProfiler.config.storage_options = { url: ENV["REDIS_SERVER_URL"] }
   Rack::MiniProfiler.config.storage = Rack::MiniProfiler::RedisStore
 end
 ```

data/lib/html/includes.js

@@ -172,7 +172,7 @@ var MiniProfiler = (function() {
               var json = JSON.parse(request.responseText);
               fetchedIds.push(id);
 
-              if (json != "hidden") {
+              if (json != "hidden" && MiniProfiler.templates) {
                 buttonShow(json);
               }
             }

data/lib/mini_profiler/asset_version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Rack
   class MiniProfiler
-    ASSET_VERSION = 'e3a360203588a280be3f711b6d85ee72'
+    ASSET_VERSION = '7e0146095db5a4bd0c9ae1b165d69e56'
   end
 end

data/lib/mini_profiler/gc_profiler.rb

@@ -151,7 +151,7 @@ String stats:
       body << "#{count} : #{string}\n"
     end
 
-    return [200, { 'Content-Type' => 'text/plain' }, body]
+    [200, { 'Content-Type' => 'text/plain' }, body]
   ensure
     prev_gc_state ? GC.disable : GC.enable
   end

data/lib/mini_profiler/storage/file_store.rb

@@ -17,9 +17,9 @@ module Rack
         def [](key)
           begin
             data = ::File.open(path(key), "rb") { |f| f.read }
-            return Marshal.load data
+            Marshal.load data
           rescue
-            return nil
+            nil
           end
         end
 

data/lib/mini_profiler/timer_struct/sql.rb

@@ -36,7 +36,7 @@ module Rack
           start_millis = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) * 1000).to_i - page[:started]) - duration_ms
           super(
             execute_type: 3, # TODO
-            formatted_command_string: query,
+            formatted_command_string: ERB::Util.html_escape(query),
             stack_trace_snippet: stack_trace,
             start_milliseconds: start_millis,
             duration_milliseconds: duration_ms,

data/lib/mini_profiler/version.rb

@@ -2,6 +2,6 @@
 
 module Rack
   class MiniProfiler
-    VERSION = '1.1.3'
+    VERSION = '1.1.4'
   end
 end

data/lib/patches/db/mongo.rb

@@ -8,7 +8,7 @@ class Mongo::Server::Connection
     result, _record = SqlPatches.record_sql(args[0][0].payload.inspect) do
       dispatch_without_timing(*args, &blk)
     end
-    return result
+    result
   end
 
   # TODO: change to Module#prepend as soon as Ruby 1.9.3 support is dropped

data/lib/patches/db/moped.rb

@@ -9,6 +9,6 @@ class Moped::Node
     result, _record = SqlPatches.record_sql(args[0].log_inspect) do
       process_without_profiling(*args, &blk)
     end
-    return result
+    result
   end
 end

data/lib/patches/db/plucky.rb

@@ -9,19 +9,19 @@ class Plucky::Query
   alias_method :remove_without_profiling, :remove
 
   def find_each(*args, &blk)
-    return profile_database_operation(__callee__, filtered_inspect(), *args, &blk)
+    profile_database_operation(__callee__, filtered_inspect(), *args, &blk)
   end
 
   def find_one(*args, &blk)
-    return profile_database_operation(__callee__, filtered_inspect(args[0]), *args, &blk)
+    profile_database_operation(__callee__, filtered_inspect(args[0]), *args, &blk)
   end
 
   def count(*args, &blk)
-    return profile_database_operation(__callee__, filtered_inspect(), *args, &blk)
+    profile_database_operation(__callee__, filtered_inspect(), *args, &blk)
   end
 
   def remove(*args, &blk)
-    return profile_database_operation(__callee__, filtered_inspect(), *args, &blk)
+    profile_database_operation(__callee__, filtered_inspect(), *args, &blk)
   end
 
   private

data/lib/patches/sql_patches.rb

@@ -11,7 +11,7 @@ class SqlPatches
     start  = Process.clock_gettime(Process::CLOCK_MONOTONIC)
     result = yield
     record = ::Rack::MiniProfiler.record_sql(statement, elapsed_time(start), parameters)
-    return result, record
+    [result, record]
   end
 
   def self.should_measure?

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rack-mini-profiler
 version: !ruby/object:Gem::Version
-  version: 1.1.3
+  version: 1.1.4
 platform: ruby
 authors:
 - Sam Saffron
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-10-28 00:00:00.000000000 Z
+date: 2019-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rack