rails-profiler 0.30.10 → 0.30.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d1f1618012f3a987e45ec2f18c565acc7cda82685806ca78801e6fb892012b3
-  data.tar.gz: 0f8e433032ac46e974c6a4162afa9c44610f5fd424afdcaf7f12a601f983cfab
+  metadata.gz: e7bb3bed351c863507d670d29552cb6751bb023300728a48e9baf9c718a53659
+  data.tar.gz: 8af241a6ca0278f3ada6a4d0d88599e93b952f67057ba6b826ea36935976ba67
 SHA512:
-  metadata.gz: 30be96f28f9d20d285b9105725cb0704ed97af7ea8e34d425f7bf3fb8b4ef2f739cded05ab68b1c2931a8424058c18245e72eddb797bbee15c8d2fc1754175e7
-  data.tar.gz: 70021a953b7a36fdff2287d9e46242761e02ea114aa6ad16344860e04cb1973d6a87095d120216b4c60b48e9187130ca7a8461b0627c35a90f683931f3ac632c
+  metadata.gz: 04d1ce9d5e1c0a2527ddb60280aa82e89e04ccc32a202a4f79e09b4a5fa87319b8f6d6c95a93f212a61cb4bc7213b92d15bb914567669a2f079eec502c075822
+  data.tar.gz: 91db3673cbcd3debdcf9fc1e02690601c4a70aaf10f4a17a070eed4b7f9359ae6261b5a9256ab43b9a13108aec0fa61677dddc9b735f72bf8103261f7e8b24f5

data/CHANGELOG.md

@@ -19,6 +19,78 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.11] - 2026-10-04
+
+<!-- stamped -->
+
+### Fixed
+
+- **Cluster:** A profile page served by the master now finds profiles held by a slave even before
+  the slave proxy has been used once.
+
+### Security
+
+- **MCP:** The HTTP transport at `/_profiler/mcp` is routed only when `mcp_enabled` is true and
+  `mcp_transport` is `:http`; it answers `404` otherwise. It used to be routed in every application,
+  whatever these options said, and to answer anyone: after the MCP handshake, any client could list
+  the tools and call those that write `ENV`, clear profiles or run the test suite. The stdio
+  transport (`rake profiler:mcp`) is unchanged.
+- **MCP:** When it is routed, each request to `/_profiler/mcp` passes the profiler's own checks
+  before the MCP server sees it, and gets a `403` otherwise: the profiler must be enabled, the
+  request must pass `authorization_mode`, and a `POST` must carry `Content-Type: application/json`
+  with no foreign `Origin`, so that a page on another site cannot call the tools from your browser.
+- **Cluster:** The cluster endpoints (`register`, `heartbeat`, `slaves` and the slave proxy) are
+  routed only on a node with the new `cluster_master = true`; they answer `404` otherwise. Every
+  application used to accept slave registrations.
+- **Cluster:** The master and its slaves authenticate each other with the new shared
+  `cluster_secret`, sent in an `X-Profiler-Cluster-Secret` header and compared in constant time:
+  `register` and `heartbeat` refuse a missing or wrong secret, and everything while no secret is
+  configured. On a slave, the master's proxied calls are let in by the secret, so a master on
+  another machine no longer needs the slave to admit its address.
+- **Cluster:** The master registers, and sends requests to, only the slave URLs allowed by the new
+  `cluster_allowed_slave_urls` (scheme, host and port, compared after normalization, and a path
+  prefix); the default refuses all. HTTPS is required, except for loopback addresses, for slave URLs
+  and for `master_url` (new `cluster_allow_insecure_http` to lift it), and the master no longer
+  returns the body of a redirect. Anyone who could register used to make the master fetch any host
+  and port it could reach and read the answer (server-side request forgery).
+- **Cluster:** A path, profile token or MCP argument sent to a slave can no longer leave the slave's
+  `/_profiler/api/`: `?`, `#` and `%` are encoded into the path segment, and a `.`, `..` or `/`
+  segment is refused before any request, on the slave proxy, the profile pages and the MCP tools.
+  An encoded `..` or `?` used to reach other paths of the slave.
+- **Cluster:** A `cluster_secret` shorter than 32 characters, or blank, is ignored as if none were
+  configured, with a warning at boot and an explicit error on registration. The master stores slave
+  URLs in their normalized form.
+- **Cluster:** The `cluster_secret` is masked by value in everything a profile captures (params,
+  bodies, headers in and out, URLs, `ENV`, SQL binds, job and mailer arguments, and the free text of
+  every collector: log lines, exception messages, dumps, SQL text, console expressions), and in the
+  output of the test runner, whatever name it travels under and even with `redact_sensitive_data`
+  off, on top of the masking by name.
+- **Cluster:** The `cluster_secret` is masked before text is shortened (flame graph names, I18n
+  values, console expressions and results, mail bodies and assigns, job arguments), so no prefix of
+  it is left, and the output of the test runner is masked across the pieces it is read in, so the
+  secret no longer comes back whole once they are joined. Only a secret the cluster accepts (32
+  characters or more) is masked by value.
+- **Cluster:** The output of the test runner holds back an end that could start the secret until
+  the process has finished printing, a killed run included, and holds back nothing else, so
+  progress output is shown as it comes. Binary bodies stored in base64, incoming, response and
+  outbound, are masked on their raw bytes before they are encoded.
+- **Upgrading:** Nothing to do if you use neither the MCP HTTP endpoint nor the cluster. Otherwise,
+  in `config/initializers/profiler.rb`:
+  - MCP over HTTP: set `config.mcp_enabled = true` and `config.mcp_transport = :http`. An
+    installation that used `/_profiler/mcp` while `mcp_transport` stayed at its default, `:stdio`,
+    must now set `:http`. The checks have no MCP-specific switch: `config.authorization_mode =
+    :allow_all` lets anybody who can reach the application call every tool, and
+    `config.api_forgery_protection = false` lets any website you visit make your browser call them.
+  - Cluster master: set `config.cluster_master = true`, `config.cluster_secret` (at least 32
+    characters, the same value on every node, from the environment) and
+    `config.cluster_allowed_slave_urls`. Slaves: set the same `config.cluster_secret`, and use HTTPS
+    URLs unless master and slave share the machine.
+  - To go back to the previous behavior: `config.cluster_require_secret = false` (with no
+    `cluster_secret`) accepts registrations from any client `authorization_mode` lets in, as in
+    0.30.6; `config.cluster_allowed_slave_urls = :any` accepts any slave URL, which reopens the
+    server-side request forgery; `config.cluster_allow_insecure_http = true` sends the secret and the
+    profiles in clear to remote hosts.
+
 ## [0.30.10] - 2026-10-04
 
 <!-- stamped -->

data/app/controllers/profiler/api/cluster_controller.rb

@@ -1,8 +1,12 @@
 # frozen_string_literal: true
 
+require_relative "../../../../lib/profiler/cluster/security"
+
 module Profiler
   module Api
     class ClusterController < Profiler::ApplicationController
+      SLAVE_ACTIONS = %w[register heartbeat].freeze
+
       def register
         name = params[:name].to_s
         url  = params[:url].to_s
@@ -11,7 +15,11 @@ module Profiler
           return render json: { error: "name and url are required" }, status: :unprocessable_entity
         end
 
-        Profiler.slave_registry.register(name: name, url: url)
+        if (reason = Cluster::Security.slave_url_denial(url))
+          return render json: { error: reason }, status: :unprocessable_entity
+        end
+
+        Profiler.slave_registry.register(name: name, url: Cluster::Security.normalized_url(url))
         render json: { ok: true, name: name }
       end
 
@@ -28,6 +36,34 @@ module Profiler
       def slaves
         render json: { slaves: Profiler.slave_registry.all }
       end
+
+      private
+
+      # A slave is a server, often on another host, not a browser: it proves itself with the
+      # shared secret instead of the access guard and the forgery header. Without
+      # cluster_require_secret, and with no secret configured, the guard of the other
+      # endpoints applies, as in 0.30.6.
+      def authorize_request
+        return super unless secret_authenticated_action?
+        return if Cluster::Security.request_secret_valid?(request)
+
+        if (problem = Cluster::Security.secret_problem)
+          deny("#{problem} on this master: cluster requests are refused")
+        else
+          deny("Missing or invalid #{Cluster::Security::SECRET_HEADER} header")
+        end
+      end
+
+      # The secret is a custom header, which a cross-site page cannot send without a preflight.
+      def verified_request?
+        return Cluster::Security.request_secret_valid?(request) if secret_authenticated_action?
+
+        super
+      end
+
+      def secret_authenticated_action?
+        SLAVE_ACTIONS.include?(action_name) && Cluster::Security.secret_required?
+      end
     end
   end
 end

data/app/controllers/profiler/api/slave_proxy_controller.rb

@@ -7,8 +7,10 @@ module Profiler
     class SlaveProxyController < Profiler::ApplicationController
       def forward
         proxy = Cluster::SlaveProxy.new(params[:slave_name])
-        sub_path = params[:path].to_s
-        full_path = "/_profiler/api/#{sub_path}"
+        # Each segment is escaped: a decoded "?" or "#" stays in its segment, and a dot segment
+        # is refused, so the request stays under the slave's API.
+        segments = params[:path].to_s.split("/", -1).map { |segment| Cluster::Security.escape_segment(segment) }
+        full_path = "/_profiler/api/#{segments.join("/")}"
 
         result = case request.method
                  when "GET"

data/app/controllers/profiler/application_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../../lib/profiler/cluster/security"
+
 module Profiler
   class ApplicationController < ActionController::Base
     layout "profiler/application"
@@ -18,6 +20,8 @@ module Profiler
     end
 
     def authorize_request
+      # Checked first, so that :allow_local does not log a refusal for the master's calls.
+      return if cluster_master_request?
       return if Profiler.configuration.authorized?(request)
 
       deny("Not authorized to access the profiler")
@@ -32,7 +36,14 @@ module Profiler
     # Rails' token, or the header every profiler client sends. A third-party page cannot add a
     # custom header without a CORS preflight, which is refused unless an origin was allowed.
     def verified_request?
-      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present?
+      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present? || cluster_master_request?
+    end
+
+    # On a slave, the master's proxied calls carry the shared secret, which stands for both the
+    # access guard and the forgery header. Never true on a node without master_url, or without
+    # a configured secret.
+    def cluster_master_request?
+      Profiler.configuration.slave? && Cluster::Security.request_secret_valid?(request)
     end
 
     def handle_unverified_request

data/app/controllers/profiler/profiles_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../../lib/profiler/cluster/slave_proxy"
+
 module Profiler
   class ProfilesController < ApplicationController
     def index

data/config/routes.rb

@@ -3,7 +3,12 @@
 require "profiler/mcp/server"
 
 Profiler::Engine.routes.draw do
-  mount Profiler::MCP::Server.rack_app, at: "mcp"
+  # Read on each request rather than when the routes are drawn: the application's initializer
+  # may set these options after the engine routes are loaded. A route that does not match
+  # answers 404, as if it were not there.
+  constraints(->(_request) { Profiler.configuration.mcp_http_enabled? }) do
+    mount Profiler::MCP::Server.rack_app, at: "mcp"
+  end
 
   root to: "profiles#index"
 
@@ -52,14 +57,16 @@ Profiler::Engine.routes.draw do
     delete "test_runner/runs/:id",        to: "test_runner#destroy"
     get    "events/:token",               to: "events#subscribe",  as: :profile_events
 
-    # Cluster endpoints (master-side)
-    post "cluster/register",  to: "cluster#register"
-    post "cluster/heartbeat", to: "cluster#heartbeat"
-    get  "cluster/slaves",    to: "cluster#slaves"
+    # Cluster endpoints (master-side), routed only on a node with cluster_master set
+    constraints(->(_request) { Profiler.configuration.cluster_master? }) do
+      post "cluster/register",  to: "cluster#register"
+      post "cluster/heartbeat", to: "cluster#heartbeat"
+      get  "cluster/slaves",    to: "cluster#slaves"
 
-    # Slave proxy — must be last to avoid shadowing other api routes
-    scope "/slaves/:slave_name" do
-      match "*path", to: "slave_proxy#forward", via: :all
+      # Slave proxy: must be last to avoid shadowing other api routes
+      scope "/slaves/:slave_name" do
+        match "*path", to: "slave_proxy#forward", via: :all
+      end
     end
   end
 end

data/lib/profiler/cluster/master_client.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "json"
 require "uri"
+require_relative "security"
 
 module Profiler
   module Cluster
@@ -22,10 +23,9 @@ module Profiler
 
       def register!
         config = Profiler.configuration
-        uri = URI("#{config.master_url}/_profiler/api/cluster/register")
+        uri = master_uri("register")
         body = { name: config.resolved_name, url: config.self_url }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
-                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
+        resp = Net::HTTP.post(uri, body, request_headers)
         unless resp.code.to_i.between?(200, 299)
           raise "Master returned #{resp.code}: #{resp.body.to_s.slice(0, 200)}"
         end
@@ -35,13 +35,31 @@ module Profiler
 
       def heartbeat!
         config = Profiler.configuration
-        uri = URI("#{config.master_url}/_profiler/api/cluster/heartbeat")
+        uri = master_uri("heartbeat")
         body = { name: config.resolved_name }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
-                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
+        resp = Net::HTTP.post(uri, body, request_headers)
         raise "Heartbeat rejected #{resp.code}" unless resp.code.to_i.between?(200, 299)
       end
 
+      # Refused before any request when the secret would cross the network in clear, or when
+      # there is no secret for the master to accept.
+      def master_uri(action)
+        config = Profiler.configuration
+        if (reason = Security.master_url_denial(config.master_url))
+          raise reason
+        end
+        if Security.secret_required? && (problem = Security.secret_problem)
+          raise "#{problem}: the master refuses registration without a secret"
+        end
+
+        URI("#{config.master_url}/_profiler/api/cluster/#{action}")
+      end
+
+      def request_headers
+        { "Content-Type" => "application/json", Profiler::FORGERY_PROTECTION_HEADER => "1" }
+          .merge(Security.outgoing_headers)
+      end
+
       def start_heartbeat_thread
         Thread.new do
           interval = Profiler.configuration.cluster_heartbeat_interval

data/lib/profiler/cluster/security.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "uri"
+require "active_support/security_utils"
+
+module Profiler
+  module Cluster
+    # The rules a master and its slaves apply to each other: the shared secret they exchange,
+    # and the URLs a master agrees to send requests to.
+    module Security
+      SECRET_HEADER = "X-Profiler-Cluster-Secret"
+      SECRET_ENV_KEY = "HTTP_X_PROFILER_CLUSTER_SECRET"
+      # A shorter secret, or a blank one, is treated as if none were configured.
+      MIN_SECRET_LENGTH = 32
+      API_PREFIX = "/_profiler/api/"
+
+      class << self
+        # Whether a secret has to be presented. False only with cluster_require_secret = false
+        # and no cluster_secret, the behaviour of 0.30.6.
+        def secret_required?
+          config = Profiler.configuration
+          config.cluster_require_secret || configured_secret?
+        end
+
+        def configured_secret?
+          secret_problem.nil?
+        end
+
+        # Why the configured secret cannot be used, or nil when it can.
+        def secret_problem
+          secret = Profiler.configuration.cluster_secret.to_s
+          return "No config.cluster_secret is configured" if secret.strip.empty?
+          return nil if secret.strip.length >= MIN_SECRET_LENGTH
+
+          "config.cluster_secret is shorter than #{MIN_SECRET_LENGTH} characters, so it is ignored " \
+            "as if none were configured"
+        end
+
+        # Logged once at boot on a cluster node whose secret cannot be used, since every cluster
+        # request is then refused.
+        def warn_about_configuration(logger)
+          config = Profiler.configuration
+          return unless config.cluster_master? || config.slave?
+          return unless (problem = secret_problem) && secret_required?
+
+          logger.warn("[Profiler Cluster] #{problem}: registrations, heartbeats and proxied requests " \
+                      "are refused. Generate one with `ruby -rsecurerandom -e 'puts SecureRandom.hex(32)'` " \
+                      "and give the same value to every node.")
+        end
+
+        # Constant-time comparison of the secret a request carries with the configured one.
+        # Always false when no usable secret is configured.
+        def valid_secret?(presented)
+          return false unless configured_secret?
+
+          expected = Profiler.configuration.cluster_secret.to_s
+          return false if presented.to_s.empty?
+
+          ActiveSupport::SecurityUtils.secure_compare(presented.to_s, expected)
+        end
+
+        def request_secret_valid?(request)
+          valid_secret?(request.get_header(SECRET_ENV_KEY))
+        end
+
+        # The headers to send with a request to another node of the cluster.
+        def outgoing_headers
+          configured_secret? ? { SECRET_HEADER => Profiler.configuration.cluster_secret.to_s } : {}
+        end
+
+        # Returns nil when the master may send requests to this slave URL, otherwise the reason.
+        def slave_url_denial(url)
+          config = Profiler.configuration
+          target = normalize(url)
+          return "#{url.inspect} is not a valid http(s) URL" unless target
+
+          if target[:scheme] == "http" && !loopback_host?(target[:host]) && !config.cluster_allow_insecure_http
+            return "#{url} uses plain HTTP to a host that is not a loopback address: HTTPS is required " \
+                   "(or set config.cluster_allow_insecure_http = true)"
+          end
+
+          allowed = config.cluster_allowed_slave_urls
+          return nil if allowed == :any
+          return nil if Array(allowed).any? { |entry| covers?(normalize(entry), target) }
+
+          "#{url} is not allowed by config.cluster_allowed_slave_urls"
+        end
+
+        # Same transport rule for the master URL a slave sends its secret to.
+        def master_url_denial(url)
+          target = normalize(url)
+          return "master_url #{url.inspect} is not a valid http(s) URL" unless target
+          return nil if target[:scheme] == "https" || loopback_host?(target[:host])
+          return nil if Profiler.configuration.cluster_allow_insecure_http
+
+          "master_url #{url} uses plain HTTP to a host that is not a loopback address: HTTPS is required " \
+            "(or set config.cluster_allow_insecure_http = true)"
+        end
+
+        # The URL as the registry keeps it: lower-case scheme and host, no default port, IPv6
+        # between brackets, path segments re-encoded, no trailing slash. Nil when not acceptable.
+        def normalized_url(url)
+          parts = normalize(url)
+          return nil unless parts
+
+          host = parts[:host].include?(":") ? "[#{parts[:host]}]" : parts[:host]
+          default_port = parts[:scheme] == "https" ? 443 : 80
+          port = parts[:port] == default_port ? "" : ":#{parts[:port]}"
+          path = parts[:segments].map { |segment| escape_segment(segment) }.join("/")
+          "#{parts[:scheme]}://#{host}#{port}#{path.empty? ? "" : "/#{path}"}"
+        end
+
+        # One path segment of a request to a slave, from a value that may come from a client (a
+        # proxied path, a profile token). "?", "#" and "%" are encoded, so they stay in the
+        # segment; ".", ".." and anything holding a "/" are refused, so the request cannot leave
+        # the slave's API.
+        def escape_segment(value)
+          segment = value.to_s
+          if segment.empty? || segment == "." || segment == ".." || segment.match?(%r{[/\\]})
+            raise Profiler::Error, "Refusing to send #{segment.inspect} as a path segment to a slave profiler"
+          end
+
+          URI.encode_www_form_component(segment).gsub("+", "%20")
+        end
+
+        # The final check on a path sent to a slave: under /_profiler/api/, with no dot or empty
+        # segment once decoded.
+        def api_path_denial(path)
+          raw = path.to_s.split("?", 2).first
+          return "#{path.inspect} is not under #{API_PREFIX}" unless raw.start_with?(API_PREFIX)
+
+          segments = raw.delete_prefix("/").split("/", -1)
+          decoded = segments.map { |segment| URI.decode_www_form_component(segment) }
+          return nil if decoded.none? { |segment| segment.empty? || segment == "." || segment == ".." || segment.include?("/") }
+
+          "#{path.inspect} holds an empty, \".\", \"..\" or encoded \"/\" path segment"
+        rescue ArgumentError
+          "#{path.inspect} is not a valid path"
+        end
+
+        # Scheme, host and port compared after normalization (case, default port, IPv6 brackets),
+        # and a path prefix compared segment by segment.
+        def covers?(entry, target)
+          return false unless entry
+
+          entry[:scheme] == target[:scheme] && entry[:host] == target[:host] && entry[:port] == target[:port] &&
+            (entry[:segments].empty? || target[:segments].first(entry[:segments].size) == entry[:segments])
+        end
+
+        # Returns { scheme:, host:, port:, segments: }, or nil for anything that is not a plain
+        # http(s) URL: user info, a query, a fragment, or a "." or ".." path segment are refused
+        # rather than interpreted.
+        def normalize(url)
+          uri = URI.parse(url.to_s.strip)
+          return nil unless uri.is_a?(URI::HTTP) && uri.host && !uri.host.empty?
+          return nil if uri.userinfo || uri.query || uri.fragment
+
+          segments = uri.path.to_s.split("/").reject(&:empty?)
+          decoded = segments.map { |segment| URI.decode_www_form_component(segment) }
+          return nil if decoded.any? { |segment| segment == "." || segment == ".." || segment.include?("/") }
+
+          { scheme: uri.scheme.downcase, host: uri.hostname.downcase, port: uri.port, segments: decoded }
+        rescue URI::Error, ArgumentError
+          nil
+        end
+
+        def loopback_host?(host)
+          host = host.to_s.downcase
+          return true if host == "localhost"
+
+          IPAddr.new(host).loopback?
+        rescue IPAddr::Error
+          false
+        end
+      end
+    end
+  end
+end

data/lib/profiler/cluster/slave_proxy.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "json"
 require "uri"
+require_relative "security"
 
 module Profiler
   module Cluster
@@ -15,6 +16,15 @@ module Profiler
         entry = Profiler.slave_registry.find!(slave_name)
         raise Profiler::Error, "Slave profiler '#{slave_name}' is offline" if entry.status == "offline"
 
+        # Checked again on every use: the URL was registered earlier, under a configuration that
+        # may have changed since.
+        if (reason = Security.slave_url_denial(entry.url))
+          raise Profiler::Error, "Slave profiler '#{slave_name}' refused: #{reason}"
+        end
+        if Security.secret_required? && (problem = Security.secret_problem)
+          raise Profiler::Error, "#{problem}: requests to slave profilers are refused"
+        end
+
         @base_url = entry.url.to_s.chomp("/")
         @open_timeout = open_timeout || OPEN_TIMEOUT
         @read_timeout = read_timeout || READ_TIMEOUT
@@ -30,7 +40,7 @@ module Profiler
       end
 
       def load(token)
-        data = get_json("/_profiler/api/profiles/#{token}")
+        data = get_json("/_profiler/api/profiles/#{Security.escape_segment(token)}")
         return nil unless data["token"] || data["profile"]
 
         raw = data["profile"] || data
@@ -69,7 +79,14 @@ module Profiler
 
       private
 
+      # Every request carries the secret, so its path must stay under the slave's API: values
+      # from clients are escaped by Security.escape_segment where they are interpolated, and
+      # this refuses whatever still reaches here with a dot segment.
       def build_uri(path, params = {})
+        if (reason = Security.api_path_denial(path))
+          raise Profiler::Error, "Refusing to send a request to a slave profiler: #{reason}"
+        end
+
         uri = URI("#{@base_url}#{path}")
         unless params.empty?
           uri.query = URI.encode_www_form(params.compact.transform_values(&:to_s))
@@ -87,12 +104,18 @@ module Profiler
 
       def request(uri, req)
         req[Profiler::FORGERY_PROTECTION_HEADER] = "1"
+        Security.outgoing_headers.each { |name, value| req[name] = value }
+        # Net::HTTP never follows a redirect; a 3xx is reported, without its body, rather than
+        # handed back as if the slave had answered.
         resp = Net::HTTP.start(uri.hostname, uri.port,
                                open_timeout: @open_timeout, read_timeout: @read_timeout,
                                use_ssl: uri.scheme == "https") do |http|
           http.request(req)
         end
         return {} if resp.code == "204"
+        if resp.code.to_s.start_with?("3")
+          raise Profiler::Error, "Slave profiler answered #{resp.code} (redirect not followed)"
+        end
 
         parse_response(resp)
       end

data/lib/profiler/collectors/base_collector.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../redaction"
+
 module Profiler
   module Collectors
     class BaseCollector

data/lib/profiler/collectors/console_collector.rb

@@ -13,7 +13,7 @@ module Profiler
       end
 
       def set_return_value(value)
-        @return_value = value.inspect.slice(0, 10_000)
+        @return_value = Profiler::Redaction.truncate(value.inspect, 10_000, "")
         @return_value_captured = true
       rescue
         @return_value = "(uninspectable)"
@@ -50,7 +50,7 @@ module Profiler
       end
 
       def toolbar_summary
-        { text: @expression.to_s[0, 30], color: "blue" }
+        { text: Profiler::Redaction.truncate(@expression, 30, ""), color: "blue" }
       end
     end
   end

data/lib/profiler/collectors/flamegraph_collector.rb

@@ -86,7 +86,7 @@ module Profiler
 
           sql = payload[:sql].to_s
           add_event Models::TimelineEvent.new(
-            name: sql.length > 80 ? "#{sql[0, 80]}..." : sql,
+            name: Profiler::Redaction.truncate(sql, 80),
             started_at: started,
             finished_at: finished,
             category: "sql",
@@ -100,7 +100,7 @@ module Profiler
             op = name.split(".").first.sub("cache_", "")
             key = payload[:key].to_s
             add_event Models::TimelineEvent.new(
-              name: "cache_#{op}: #{key.length > 60 ? "#{key[0, 60]}..." : key}",
+              name: "cache_#{op}: #{Profiler::Redaction.truncate(key, 60)}",
               started_at: started,
               finished_at: finished,
               category: "cache",

data/lib/profiler/collectors/i18n_collector.rb

@@ -93,7 +93,7 @@ module Profiler
       private
 
       def truncate(str, max = 100)
-        str.length > max ? "#{str[0, max]}…" : str
+        Profiler::Redaction.truncate(str, max, "…")
       end
     end
   end

data/lib/profiler/collectors/mailer_collector.rb

@@ -224,12 +224,12 @@ module Profiler
         if mail.multipart?
           html_part = mail.parts.find { |p| p.content_type.to_s.start_with?("text/html") }
           text_part = mail.parts.find { |p| p.content_type.to_s.start_with?("text/plain") }
-          html = html_part&.body&.decoded&.then { |b| b[0, MAX_BODY_SIZE] }
-          text = text_part&.body&.decoded&.then { |b| b[0, MAX_BODY_SIZE] }
+          html = html_part&.body&.decoded&.then { |b| Profiler::Redaction.truncate(b, MAX_BODY_SIZE, "") }
+          text = text_part&.body&.decoded&.then { |b| Profiler::Redaction.truncate(b, MAX_BODY_SIZE, "") }
         elsif mail.content_type.to_s.start_with?("text/html")
-          html = mail.body.decoded[0, MAX_BODY_SIZE]
+          html = Profiler::Redaction.truncate(mail.body.decoded, MAX_BODY_SIZE, "")
         else
-          text = mail.body.decoded[0, MAX_BODY_SIZE]
+          text = Profiler::Redaction.truncate(mail.body.decoded, MAX_BODY_SIZE, "")
         end
         [html.nil? || html.empty? ? nil : html, text.nil? || text.empty? ? nil : text]
       rescue StandardError
@@ -240,7 +240,7 @@ module Profiler
         return "nil" if value.nil?
 
         inspected = value.inspect
-        inspected.length > 300 ? "#{inspected[0, 300]}…" : inspected
+        Profiler::Redaction.truncate(inspected, 300, "…")
       rescue StandardError
         value.to_s
       end

data/lib/profiler/configuration.rb

@@ -41,7 +41,9 @@ module Profiler
                   :compress_bodies, :compress_body_threshold,
                   :redact_sensitive_data, :filter_parameters, :env_allowlist,
                   :name, :master_url, :self_url,
-                  :cluster_heartbeat_interval, :cluster_offline_threshold
+                  :cluster_heartbeat_interval, :cluster_offline_threshold,
+                  :cluster_master, :cluster_secret, :cluster_require_secret,
+                  :cluster_allowed_slave_urls, :cluster_allow_insecure_http
 
     attr_writer :tmp_path
 
@@ -98,6 +100,12 @@ module Profiler
       @self_url = nil
       @cluster_heartbeat_interval = 15
       @cluster_offline_threshold = 60
+      # Cluster security: see Profiler::Cluster::Security and the Cluster section of the README.
+      @cluster_master = false
+      @cluster_secret = nil
+      @cluster_require_secret = true
+      @cluster_allowed_slave_urls = []
+      @cluster_allow_insecure_http = false
     end
 
     def tmp_path
@@ -112,6 +120,18 @@ module Profiler
       !slave?
     end
 
+    # Whether this node serves the master-side cluster routes (register, heartbeat, slaves and
+    # the slave proxy). Read on each request by the route constraints.
+    def cluster_master?
+      cluster_master ? true : false
+    end
+
+    # Whether /_profiler/mcp is routed. The stdio transport (rake profiler:mcp) does not depend
+    # on it.
+    def mcp_http_enabled?
+      mcp_enabled && mcp_transport.to_s == "http" ? true : false
+    end
+
     def resolved_name
       @name || (defined?(Rails) ? Rails.application.class.module_parent_name.underscore : "profiler")
     end

data/lib/profiler/console_profiler.rb

@@ -39,7 +39,7 @@ module Profiler
       profile = Models::Profile.new
       profile.profile_type = "console"
       profile.gem_version = Profiler::VERSION
-      profile.path = @expression.length > 200 ? "#{@expression[0, 200]}..." : @expression
+      profile.path = Redaction.truncate(@expression, 200)
       profile.method = "CONSOLE"
 
       console_collector = Collectors::ConsoleCollector.new(profile, expression: @expression)

data/lib/profiler/instrumentation/net_http_instrumentation.rb

@@ -150,7 +150,8 @@ module Profiler
         mime = content_type.split(";").first.to_s.strip
 
         if mime.match?(BINARY_CONTENT_TYPES)
-          { body: Base64.strict_encode64(body.b), encoding: "base64" }
+          # Masked on the raw bytes, before the encoding hides them from any later search.
+          { body: Base64.strict_encode64(Redaction.hide_credentials(body.b)), encoding: "base64" }
         else
           text = Redaction.filter_body(body, content_type)
                           .encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")

data/lib/profiler/job_profiler.rb

@@ -118,11 +118,11 @@ module Profiler
 
       Redaction.filter_value(args).map do |arg|
         case arg
-        when String then arg.length > 200 ? "#{arg[0, 200]}..." : arg
+        when String then Redaction.truncate(arg, 200)
         when Numeric, TrueClass, FalseClass, NilClass then arg
         else
           inspected = arg.inspect
-          inspected.length > 200 ? "#{inspected[0, 200]}..." : inspected
+          Redaction.truncate(inspected, 200)
         end
       rescue
         arg.to_s

data/lib/profiler/mcp/http_guard.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module Profiler
+  module MCP
+    # Checks a request to the MCP HTTP transport before the MCP server sees it, with the same
+    # rules as the profiler's controllers: the profiler must be enabled, the request authorized,
+    # and a POST must not be one that another site could forge from a browser.
+    #
+    # Forgery protection does not use the X-Profiler-Request header, which MCP clients do not
+    # send. A POST must carry Content-Type: application/json instead: a cross-site form or
+    # "simple" fetch can only send text/plain, form-urlencoded or multipart, and JSON needs a
+    # CORS preflight that the profiler grants to configured origins only. A browser also sends
+    # its Origin, which has to be the profiler's own or one of cors_allowed_origins. GET (the
+    # SSE stream) changes nothing, and DELETE always needs a preflight.
+    module HttpGuard
+      JSON_MEDIA_TYPE = "application/json"
+
+      class << self
+        # Returns nil when the request may proceed, otherwise a Rack response.
+        def call(env)
+          config = Profiler.configuration
+          return deny("Profiler is disabled") unless config.enabled
+
+          request = ActionDispatch::Request.new(env)
+          return deny("Not authorized to access the profiler") unless config.authorized?(request)
+          return nil unless config.api_forgery_protection
+
+          forgery_denial(request, config)
+        end
+
+        private
+
+        def forgery_denial(request, config)
+          origin = request.get_header("HTTP_ORIGIN")
+          if origin && !origin.empty? && !allowed_origin?(origin, request, config)
+            return deny("Cross-origin request refused: Origin #{origin} is not allowed")
+          end
+
+          if request.post? && media_type(request) != JSON_MEDIA_TYPE
+            return deny("A POST to the MCP endpoint needs Content-Type: #{JSON_MEDIA_TYPE}")
+          end
+
+          nil
+        end
+
+        def media_type(request)
+          request.get_header("CONTENT_TYPE").to_s.split(";").first.to_s.strip.downcase
+        end
+
+        def allowed_origin?(origin, request, config)
+          return true if Array(config.cors_allowed_origins).include?(origin)
+
+          same_origin?(origin, request.base_url)
+        end
+
+        def same_origin?(origin, base_url)
+          a = URI.parse(origin)
+          b = URI.parse(base_url)
+          a.scheme.to_s.casecmp?(b.scheme.to_s) && a.host.to_s.casecmp?(b.host.to_s) && a.port == b.port
+        rescue URI::InvalidURIError
+          false
+        end
+
+        def deny(message)
+          [403, { "content-type" => "application/json" }, [{ error: message }.to_json]]
+        end
+      end
+    end
+  end
+end

data/lib/profiler/mcp/server.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "mcp"
+require_relative "http_guard"
 
 module Profiler
   module MCP
@@ -12,7 +13,9 @@ module Profiler
 
         def rack_app
           # Memoized at class level — survives route reloads in development
-          @rack_app ||= ->(env) { instance.http_transport.handle_request(Rack::Request.new(env)) }
+          @rack_app ||= lambda do |env|
+            HttpGuard.call(env) || instance.http_transport.handle_request(Rack::Request.new(env))
+          end
         end
       end
 

data/lib/profiler/models/profile.rb

@@ -9,7 +9,8 @@ require_relative "../redaction"
 module Profiler
   module Models
     class Profile
-      attr_accessor :token, :path, :method, :status, :duration, :memory,
+      attr_reader :path
+      attr_accessor :token, :method, :status, :duration, :memory,
                     :started_at, :finished_at, :params, :headers,
                     :response_headers, :collectors_data, :collectors_metadata,
                     :parent_token, :is_ajax, :profile_type,
@@ -50,8 +51,15 @@ module Profiler
         @response_headers = Redaction.filter_headers(response_headers)
       end
 
+      # Every collector stores its data here: logs, exception messages, dumps and SQL text are free
+      # text with no name to filter on, so the profiler's own credentials are masked by value.
       def add_collector_data(name, data)
-        @collectors_data[name.to_s] = data
+        @collectors_data[name.to_s] = Redaction.hide_credentials(data)
+      end
+
+      # The path is free text for a console profile: the expression typed.
+      def path=(value)
+        @path = Redaction.hide_credentials(value)
       end
 
       def collector_data(name)
@@ -160,7 +168,9 @@ module Profiler
         return { body: nil, encoding: "text" } if raw.nil? || raw.empty?
 
         if binary_content_type?(content_type)
-          { body: Base64.strict_encode64(raw.b), encoding: "base64" }
+          # Masked on the raw bytes, before the encoding hides them from any later search. A
+          # compressed format (zip, png, gzip...) does not hold the secret as it is.
+          { body: Base64.strict_encode64(Redaction.hide_credentials(raw.b)), encoding: "base64" }
         else
           text = Redaction.filter_body(raw, content_type).encode("UTF-8", invalid: :replace, undef: :replace)
           if compress_body?(text)
@@ -195,7 +205,7 @@ module Profiler
       def sanitize_params(params)
         return {} unless params
 
-        return params.to_h.except(*LEGACY_FILTERED_PARAMS) unless Redaction.enabled?
+        return Redaction.hide_credentials(params.to_h.except(*LEGACY_FILTERED_PARAMS)) unless Redaction.enabled?
 
         Redaction.filter_hash(params.to_h)
       end

data/lib/profiler/railtie.rb

@@ -92,7 +92,11 @@ module Profiler
       # Check slave? inside on_load — the app's own initializers (config/initializers/profiler.rb)
       # set master_url AFTER railtie initializers run, so the check must happen after_initialize.
       ActiveSupport.on_load(:after_initialize) do
-        next unless Profiler.configuration.enabled && Profiler.configuration.slave?
+        next unless Profiler.configuration.enabled
+
+        require_relative "cluster/security"
+        Profiler::Cluster::Security.warn_about_configuration(Rails.logger)
+        next unless Profiler.configuration.slave?
 
         require_relative "cluster/master_client"
         Profiler::Cluster::MasterClient.new.start

data/lib/profiler/redaction.rb

@@ -4,6 +4,7 @@ require "json"
 require "set"
 require "rack/utils"
 require "active_support/parameter_filter"
+require_relative "cluster/security"
 
 module Profiler
   # The single filter applied to everything the profiler captures: request
@@ -44,6 +45,18 @@ module Profiler
     # fail on the same key inside the text.
     CONTEXT_SENSITIVE_REGEXP = /\\[AzZbBG]|[\^$]|\(\?<?[=!]/
 
+    # The profiler's own credentials are masked wherever they appear, by value,
+    # whatever name they travel under, and even with redact_sensitive_data
+    # off: the cluster secret opens every slave from the network, and a
+    # profile can be read on any node. Wraps every public filter, so that each
+    # capture point gets it.
+    module CredentialMasking
+      %i[filter_hash filter_value filter_named filter_headers filter_body filter_query filter_url
+         env_snapshot env_value env_overrides].each do |name|
+        define_method(name) { |*args| hide_credentials(super(*args)) }
+      end
+    end
+
     # Bound on the memo of names already tested against the filter.
     KEY_CACHE_LIMIT = 10_000
 
@@ -52,6 +65,41 @@ module Profiler
     PROBE = "x"
 
     class << self
+      prepend CredentialMasking
+
+      # Masks every occurrence of the profiler's own credentials in a value:
+      # a string equal to one becomes MASK, a string holding one has it
+      # replaced, hashes and arrays are walked. Only what changes is copied:
+      # a value holding no credential is returned as it is.
+      def hide_credentials(value)
+        credentials = credential_values
+        credentials.empty? ? value : hide_in(value, credentials)
+      rescue StandardError => e
+        report(e, "masking a profiler credential")
+        MASK
+      end
+
+      # Text cut to +max+ characters, with +ellipsis+ when cut, once the
+      # credentials are masked: cutting first would leave a prefix of one, or
+      # all of it once the pieces are put back together. Every capture point
+      # that shortens text goes through here.
+      def truncate(text, max, ellipsis = "...")
+        text = hide_credentials(text.to_s)
+        text.length > max ? "#{text[0, max]}#{ellipsis}" : text
+      end
+
+      # How many trailing bytes of +text+, a stream read in pieces, could be
+      # the start of a credential and have to wait for the next piece: the
+      # longest end of the text that is also the beginning of a credential,
+      # 0 when there is none, so that other output is shown as it comes.
+      def held_back_bytes(text)
+        bytes = text.to_s.b
+        credential_values.map do |credential|
+          start = credential.b
+          [start.bytesize - 1, bytes.bytesize].min.downto(1).find { |k| bytes.end_with?(start.byteslice(0, k)) } || 0
+        end.max || 0
+      end
+
       def enabled?
         Profiler.configuration.redact_sensitive_data != false
       end
@@ -231,6 +279,56 @@ module Profiler
 
       private
 
+      # Only a secret the cluster would use (Cluster::Security.secret_problem
+      # nil: 32 characters or more): a shorter one is ignored by the cluster,
+      # and masking "true" or "/" everywhere would hide the very data profiled.
+      def credential_values
+        return [] unless Cluster::Security.configured_secret?
+
+        [Profiler.configuration.cluster_secret.to_s.strip]
+      end
+
+      def hide_in(value, credentials)
+        case value
+        when String then hide_in_string(value, credentials)
+        when Hash
+          changes = nil
+          value.each do |key, v|
+            masked = hide_in(v, credentials)
+            (changes ||= {})[key] = masked unless masked.equal?(v)
+          end
+          changes ? value.merge(changes) : value
+        when Array
+          copy = nil
+          value.each_with_index do |v, i|
+            masked = hide_in(v, credentials)
+            next if masked.equal?(v)
+
+            (copy ||= value.dup)[i] = masked
+          end
+          copy || value
+        else value
+        end
+      end
+
+      # The string itself when it holds no credential, which is the common
+      # case and costs one search; otherwise a copy, compared as bytes so that
+      # a binary body never meets an incompatible encoding.
+      def hide_in_string(string, credentials)
+        credentials.reduce(string) do |text, credential|
+          next text unless contains?(text, credential)
+          next MASK if text.b.strip == credential.b
+
+          text.b.gsub(credential.b, MASK).force_encoding(text.encoding)
+        end
+      end
+
+      def contains?(text, credential)
+        text.include?(credential)
+      rescue Encoding::CompatibilityError, ArgumentError
+        text.b.include?(credential.b)
+      end
+
       def compiled
         filters = current_filters
         state = @compiled

data/lib/profiler/test_runner/run_store.rb

@@ -2,6 +2,7 @@
 
 require "concurrent"
 require "securerandom"
+require_relative "../redaction"
 
 module Profiler
   module TestRunner
@@ -24,6 +25,9 @@ module Profiler
       def initialize
         @runs  = Concurrent::Hash.new
         @locks = Concurrent::Hash.new
+        @held  = Concurrent::Hash.new
+        @output_finished = Concurrent::Hash.new
+        @held_lock = Mutex.new
       end
 
       def create(files:, framework:)
@@ -58,11 +62,38 @@ module Profiler
         run
       end
 
+      # Output is free text read back by the API, the SSE stream and run_tests, in the pieces it
+      # arrives in: the profiler's own credentials are masked by value, as in a profile. They
+      # are masked on the text joined with what was held back from the previous piece, and the
+      # last bytes that could start a credential wait for the next piece, so that none is ever
+      # shown cut in two. What is held back is released by finish_output, once the process has
+      # nothing more to print: a killed run still prints its summary after its status changed.
       def append_output(id, chunk)
         run = @runs[id]
         return unless run
 
-        run.output_lines.push(chunk)
+        @held_lock.synchronize do
+          text = Profiler::Redaction.hide_credentials(@held.fetch(id, "".b) + chunk.to_s.b)
+          holdback = @output_finished[id] ? 0 : Profiler::Redaction.held_back_bytes(text)
+          cut = text.bytesize - holdback
+          @held[id] = text.byteslice(cut, text.bytesize - cut)
+          shown = text.byteslice(0, cut).force_encoding(chunk.to_s.encoding)
+          run.output_lines.push(shown) unless shown.empty?
+        end
+        signal(id)
+      end
+
+      # The end of the output, told by the reader of the process once it read everything: the
+      # bytes held back are shown, and anything appended later is shown as it comes.
+      def finish_output(id)
+        run = @runs[id]
+        return unless run
+
+        @held_lock.synchronize do
+          @output_finished[id] = true
+          rest = @held.delete(id)
+          run.output_lines.push(rest) if rest && !rest.empty?
+        end
         signal(id)
       end
 
@@ -97,6 +128,12 @@ module Profiler
         lock[:mutex].synchronize { lock[:cond].broadcast }
       end
 
+      def forget_output(id)
+        @held.delete(id)
+        @output_finished.delete(id)
+        true
+      end
+
       def snapshot(run, position)
         lines = run.output_lines.dup
         {
@@ -109,7 +146,7 @@ module Profiler
 
       def cleanup_old_runs
         cutoff = Time.now - TTL
-        @runs.delete_if { |id, r| r.finished_at && r.finished_at < cutoff && @locks.delete(id) }
+        @runs.delete_if { |id, r| r.finished_at && r.finished_at < cutoff && @locks.delete(id) && forget_output(id) }
       end
     end
 

data/lib/profiler/test_runner/runner.rb

@@ -124,6 +124,7 @@ module Profiler
             finished_at: Time.now
           )
           Profiler::TestRunner.run_store.append_output(run.id, "\n[Profiler] Error: #{e.message}\n")
+          Profiler::TestRunner.run_store.finish_output(run.id)
         end
       end
 
@@ -137,10 +138,15 @@ module Profiler
         IO.popen([env, *cmd, unsetenv_others: true, err: [:child, :out]], "r") do |io|
           Profiler::TestRunner.run_store.update(run.id, pid: io.pid)
 
-          while (chunk = io.read(256))
-            break if chunk.empty?
+          begin
+            while (chunk = io.read(256))
+              break if chunk.empty?
 
-            Profiler::TestRunner.run_store.append_output(run.id, chunk)
+              Profiler::TestRunner.run_store.append_output(run.id, chunk)
+            end
+          ensure
+            # The process printed everything, killed or not: what was held back can be shown.
+            Profiler::TestRunner.run_store.finish_output(run.id)
           end
         end
 

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.10"
+  VERSION = "0.30.11"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.10
+  version: 0.30.11
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -135,6 +135,7 @@ files:
 - lib/profiler.rb
 - lib/profiler/boot_env.rb
 - lib/profiler/cluster/master_client.rb
+- lib/profiler/cluster/security.rb
 - lib/profiler/cluster/slave_proxy.rb
 - lib/profiler/cluster/slave_registry.rb
 - lib/profiler/cluster/token_cache.rb
@@ -172,6 +173,7 @@ files:
 - lib/profiler/local_request.rb
 - lib/profiler/mcp/body_formatter.rb
 - lib/profiler/mcp/file_cache.rb
+- lib/profiler/mcp/http_guard.rb
 - lib/profiler/mcp/path_extractor.rb
 - lib/profiler/mcp/resources/failing_tests.rb
 - lib/profiler/mcp/resources/n1_patterns.rb