rails-ai-context 5.36.6 → 5.36.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 767bea69448c4f36b6cd9158d4cdb7c5a9ea975e50b534c36bd0a191e2f78284
-  data.tar.gz: 0d2e08650d551de767a8079e9b301445b24199dbe9d7d4bcecc6d24edf17f582
+  metadata.gz: 8498e25402e035ed53ab2c0dff9dff31da4c849e616632069891de80f38ff7f4
+  data.tar.gz: 92dac2339bbe11cc0486ad449f8b84fd5fe840d15c31e56414b53b9b0d7e9fbc
 SHA512:
-  metadata.gz: 81f02598eafb2253634bc51b7d050276944f829ccde5e6d2464b3a845648c1778ce9a642ed6c7a513061f5471fee883671aa0dc6b8039e00b67dafac3c978a1a
-  data.tar.gz: ee8235d4b5cb68ac2e553ba4417a4fe67e55de9422cb553b4827f57ad58d1c74fd4d6e2a83058440ba149c646992f90d594965d092c435970db66f1984e8017c
+  metadata.gz: d06dccf666aa9a2ca94e8a42f5191a9d7cf98f2a8f9799f6ab0afa941c6d4e397ecefe5aa71979bb91d6f667151345b161795bd81058a4e4810d5f29828e64eb
+  data.tar.gz: 324d72633467fc133a608d848fa3dce1f3f21cc600ab0a9d637288a5ba05f1f69c356aaf3a2871a5217a5c4498787a279695554d8c08ff80af303ba1a8857984

data/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [5.36.7] - 2026-10-22
+
+### Security
+
+- **`rails_query` reads a dollar-quote tag the way PostgreSQL does, and runs
+  one statement at the wire.** The gate read a `$tag$` that followed a
+  non-ASCII byte, or whose tag held one, as a string boundary where the server
+  read it as part of a name, so text the gate believed was one quoted value was
+  several statements to the server, and a crafted statement could run a write.
+  The tag grammar now matches the server's: a non-ASCII byte counts as a letter
+  in a tag and before one. On top of that, the statement and its plan now run
+  over the extended protocol (one statement per message), so even a text that
+  slipped past the gate cannot carry a second statement to the server. A generic
+  plan's unbound parameter, which only that protocol refuses, falls back to a
+  plan that runs nothing.
+- **`rails_query` reads `--` on MySQL the way the server does.** MySQL starts a
+  `--` comment before any control character, not whitespace alone; the gate
+  accepted whitespace only, so a `--` before a control byte hid code from the
+  checks that the server still ran, and a secret column could leave under a
+  harmless name. The comment rule now ends at a control byte too.
+- **`rails_read_logs` filters a secret column's logged bind values.** Active
+  Record filters a bind only when `config.filter_parameters` names it, which
+  older apps often leave at `[:password]`, so a token or reset key logged in
+  full. A `["name", "value"]` bind pair whose name is a secret now has its
+  value filtered, alongside the existing name-and-value rules.
+- **The standalone HTTP server refuses a non-loopback Host of its own.** It
+  binds a loopback address and hands the SDK no allowed hosts, so only a
+  loopback Host is its own. mcp 1.x refuses the rest itself; the gemspec floor
+  is 0.13, and 0.13 to 0.22 check nothing, so a web page the developer opened
+  could reach the endpoint by DNS rebinding. The server now makes that check
+  across every supported SDK, as `docs/SECURITY.md` says it does.
+
 ## [5.36.6] - 2026-10-22
 
 ### Removed

data/docs/COMPATIBILITY.md

@@ -359,6 +359,13 @@ Proof sources:
    them on Mongoid, in the static tier, compared with v5.36.5 and every
    changed answer checked against the app's source; and the unit suite and
    the E2E harness on Linux, macOS and Windows.
+   In the v5.36.7 release QA: each fix's example failing on the code before
+   it; the `rails_query` gate and its reads run against live PostgreSQL 17,
+   MySQL 9.6 and MariaDB 13 for the dollar-quote and `--` comment readings,
+   with each server confirmed to read the text the way the gate does; the
+   security, gate, redaction and database specs on Rails 7.0 (Ruby 3.1), 7.1,
+   7.2 and 8.1 against live PostgreSQL; and the unit suite and the E2E harness
+   on Linux, macOS and Windows.
 2. Non-crash coverage for every built-in tool including `get_view` in
    `spec/e2e/in_gemfile_install_spec.rb`'s full-tool sweep; output correctness
    (ivar cross-check, render-form detection, partial interfaces) verified

data/lib/rails_ai_context/database_family/postgresql_runtime.rb

@@ -9,14 +9,50 @@ module RailsAiContext
       module_function
 
       def read_only(conn, sql, timeout)
-        # An EXPLAIN answers text, and one of a generic plan holds $1, which Rails 7.0's select_all sends as an empty bind.
-        if sql.match?(/\A\s*EXPLAIN\b/i)
-          result = bounded(conn, timeout) { conn.execute(sql) }
-          return Rows.new(result.fields, result.values, false)
+        result = bounded(conn, timeout) { exec_single(conn, sql) }
+        Rows.new(result.fields, result.values, false)
+      end
+
+      # One statement over the extended protocol (exec_params with no binds). The simple
+      # protocol conn.execute and select_all use runs every statement in its text, so a text
+      # the gate passed in error would run a second one; the extended protocol refuses that at
+      # the wire ("cannot insert multiple commands"), whatever the gate saw. The adapter set the
+      # raw connection's result type map, so values cast as select_all's do. The bounded block's
+      # SET statements have materialized the transaction, so this runs inside it, under its
+      # read-only mode and statement_timeout. A driver error is raised as the ActiveRecord class
+      # the callers expect, so a timeout still reads as TimedOut.
+      #
+      # A single statement that leaves a $n unbound can only be an EXPLAIN (GENERIC_PLAN), which
+      # the extended protocol will not run but the simple one plans without a value; it runs
+      # nothing (no ANALYZE). The extended attempt aborts the transaction, so a savepoint lets
+      # the simple protocol plan it after. A text with a second statement fails with "cannot
+      # insert multiple commands" before the bind, never the unbound-parameter error, so the
+      # simple-protocol fallback can never run one. Only a $ can be an unbound parameter, so a
+      # statement without one takes the extended protocol with no savepoint round-trips.
+      def exec_single(conn, sql)
+        raw = conn.raw_connection
+        return raw.exec_params(sql, []) unless sql.include?("$")
+
+        raw.exec("SAVEPOINT rac_exec_single")
+        begin
+          result = raw.exec_params(sql, [])
+          raw.exec("RELEASE SAVEPOINT rac_exec_single")
+          result
+        rescue StandardError => e
+          raw.exec("ROLLBACK TO SAVEPOINT rac_exec_single")
+          raise e unless unbound_parameters?(e)
+
+          conn.execute(sql)
         end
+      rescue ActiveRecord::ActiveRecordError
+        raise
+      rescue StandardError => e
+        raise conn.send(:translate_exception_class, e, sql, [])
+      end
 
-        result = bounded(conn, timeout) { conn.select_all(sql) }
-        Rows.new(result.columns, result.rows, false)
+      # The driver's "bind message supplies 0 parameters, but ... requires N" for a lone $n.
+      def unbound_parameters?(error)
+        (defined?(PG::ProtocolViolation) && error.is_a?(PG::ProtocolViolation)) || error.message.include?("bind message supplies")
       end
 
       # statement_timeout ends each statement in the block, a wait on a lock included. Read-only, rolled back.
@@ -76,8 +112,12 @@ module RailsAiContext
       # Planning only: EXPLAIN without ANALYZE runs nothing, not even a VOLATILE function.
       # A timeout and an SQL error are raised, so the caller never runs what it could not plan.
       def plan(conn, sql, timeout, generic: false)
-        json = read_only(conn, "EXPLAIN (VERBOSE, FORMAT JSON#{", GENERIC_PLAN" if generic}) #{sql}", timeout).rows.first&.first
-        data = JSON.parse(json.to_s)
+        explain = "EXPLAIN (VERBOSE, FORMAT JSON#{", GENERIC_PLAN" if generic}) #{sql}"
+        # One statement at the wire while the gate is still checking, so a text it passed in
+        # error cannot run a write here. A generic plan's unbound $n falls back to the simple
+        # protocol inside exec_single, which plans it without running anything.
+        result = bounded(conn, timeout) { exec_single(conn, explain) }
+        data = JSON.parse(result.values.first&.first.to_s)
         data.is_a?(Array) && data.first.is_a?(Hash) ? data.first["Plan"] : nil
       rescue JSON::ParserError
         nil

data/lib/rails_ai_context/database_family.rb

@@ -71,9 +71,9 @@ module RailsAiContext
         mysql?
       end
 
-      # @return [Regexp] a comment that runs to the end of its line: `#` too, and `--` only before a space, on MySQL
+      # @return [Regexp] a comment that runs to the end of its line: `#` too, and `--` only before a space or a control character, on MySQL
       def line_comment
-        mysql? ? /--(?=\s|\z)[^\n]*|#[^\n]*/ : /--[^\n]*/
+        mysql? ? /--(?=[\s\x00-\x1f\x7f]|\z)[^\n]*|#[^\n]*/ : /--[^\n]*/
       end
 
       # @return [Rows] run in a read-only transaction, bounded by timeout seconds

data/lib/rails_ai_context/mcp_edge.rb

@@ -153,6 +153,19 @@ module RailsAiContext
         message && [ 403, { "Content-Type" => "application/json" }, [ error_frame(INVALID_REQUEST, message) ] ]
       end
 
+      # The standalone server's own Host and Origin check. It binds a loopback address and
+      # hands the SDK no allowed_hosts, so only a loopback Host is its own. mcp >= 0.23 makes
+      # the SDK refuse the rest itself; the gemspec floor is 0.13, and 0.13 to 0.22 check
+      # nothing, so a web page the developer opens could reach the endpoint by DNS rebinding.
+      # This stands in for the SDK's check across every allowed version.
+      def loopback_refusal(env)
+        host = env["HTTP_HOST"].to_s.downcase.sub(/:\d+\z/, "").delete_prefix("[").delete_suffix("]")
+        message = if !LOOPBACK_HOSTS.include?(host) then "Forbidden: Invalid Host header"
+        elsif env["HTTP_ORIGIN"] && !same_origin?(env["HTTP_ORIGIN"], env["HTTP_HOST"]) then "Forbidden: Invalid Origin header"
+        end
+        message && [ 403, { "Content-Type" => "application/json" }, [ error_frame(INVALID_REQUEST, message) ] ]
+      end
+
       private
 
       def host_allowed?(env, app)

data/lib/rails_ai_context/redaction.rb

@@ -175,6 +175,13 @@ module RailsAiContext
       (\s*(?:=>|:|=(?!>))\s*)
       (?!["']?\[FILTERED\])(?:"([^"]*)"|'([^']*)'|([^\s,;&)\]}]+))
     /xi
+    # A `["name", "value"]` pair in a query's logged binds. Active Record filters a bind only
+    # when config.filter_parameters lists its name, which pre-Rails-7 apps often leave at
+    # [:password], so a token or reset key logs in full. The name and the quoted value are
+    # captured and the value filtered when the name is a secret; a bare value (a number, nil) is
+    # left, as is the `$n` placeholder in the SQL before the binds.
+    LOG_BIND = /\[\s*"((?:[^"\\]|\\.)*)"\s*,\s*("(?:[^"\\]|\\.)*")\s*\]/
+
     # A quoted key may close an index (`ENV["API_TOKEN"] =`); the assignment may be `||=` or another op-assign.
     SECRET_KEY = /"(?<name>#{DASHED_KEY_NAME})"\]?|'(?<name>#{DASHED_KEY_NAME})'\]?|(?<![\w"'\/\\-])(?<name>#{KEY_NAME})/
     KEYED_LITERAL = /(?:#{SECRET_KEY})(?<assign>\s*(?::|=>|(?:\|\||&&|[-+*\/|&])?=(?![=~>]))\s*)(?<literal>#{STRING_LITERAL})/
@@ -370,6 +377,7 @@ module RailsAiContext
         result.gsub!(result.encoding == Encoding::UTF_8 ? EMAIL_PATTERN : ASCII_EMAIL_PATTERN, EMAIL)
 
         result.gsub!(LOG_SECRET_ASSIGNMENT) { filter_assignment(Regexp.last_match) }
+        result.gsub!(LOG_BIND) { filter_bind(Regexp.last_match) }
 
         LOG_PATTERNS.each do |pattern, replacement|
           next result.gsub!(pattern, replacement) unless replacement == :value
@@ -740,6 +748,14 @@ module RailsAiContext
         "#{quote}#{key}#{quote}#{assign}#{value_quote}#{FILTERED}#{value_quote}"
       end
 
+      # A logged bind pair `["name", "value"]` with its value gone when the name is a secret.
+      def filter_bind(match)
+        name = key_name(match[1])
+        return match[0] unless name && log_secret?(name, match[2])
+
+        %(["#{match[1]}", "#{FILTERED}"])
+      end
+
       # The setting name at the head of a matched assignment.
       def descriptor?(match)
         match[/\A\w+/].to_s.match?(DESCRIPTOR_SUFFIX)

data/lib/rails_ai_context/server.rb

@@ -648,7 +648,7 @@ module RailsAiContext
     def build_rack_app(transport)
       lambda do |env|
         if McpEdge.mcp_request?(env)
-          McpEdge.serve(env, transport)
+          McpEdge.loopback_refusal(env) || McpEdge.serve(env, transport)
         else
           [ 404, { "Content-Type" => "application/json" }, [ '{"error":"Not found"}' ] ]
         end

data/lib/rails_ai_context/sql_gate.rb

@@ -219,8 +219,11 @@ module RailsAiContext
     E_QUOTE = /(?<=(?<![\p{Word}$]|[^\x00-\x7F])[eE])'/
     # SQLite reads [name] as an identifier.
     BRACKETED = /\[[^\]\n]*\]/
-    DOLLAR_QUOTED = /(?<![\p{Word}$])\$(\p{Word}*)\$.*?\$\1\$/m
-    DOLLAR_TAG = /(?<![\p{Word}$])\$\p{Word}*\$/
+    # PostgreSQL spells a dollar quote's tag as a name, and reads any non-ASCII character as a letter in both:
+    # a dollar after one (`→$a$`) is part of that name, and `$→$` is a tag.
+    TAG_NAME = /(?:[A-Za-z_]|[^\x00-\x7F])(?:\w|[^\x00-\x7F])*/
+    DOLLAR_QUOTED = /(?<![\w$]|[^\x00-\x7F])\$((?:#{TAG_NAME})?)\$.*?\$\1\$/m
+    DOLLAR_TAG = /(?<![\w$]|[^\x00-\x7F])\$(?:#{TAG_NAME})?\$/
     UNQUOTED = /[^'"`$\/\-#*\[]+/
 
     # A constant in a plan expression. PostgreSQL's deparser always doubles
@@ -269,7 +272,7 @@ module RailsAiContext
       def closed?(tag)
         @last ||= {}.tap do |last|
           tags = StringScanner.new(string)
-          last["$#{tags[1]}"] = tags.pos - 1 while tags.skip_until(/\$(?=(\p{Word}*\$))/)
+          last["$#{tags[1]}"] = tags.pos - 1 while tags.skip_until(/\$(?=((?:#{TAG_NAME})?\$))/o)
         end
         @last.fetch(tag, -1) >= pos + tag.bytesize
       end

data/lib/rails_ai_context/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsAiContext
-  VERSION = "5.36.6"
+  VERSION = "5.36.7"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-ai-context
 version: !ruby/object:Gem::Version
-  version: 5.36.6
+  version: 5.36.7
 platform: ruby
 authors:
 - crisnahine