rails-profiler 0.30.10 → 0.30.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9d1f1618012f3a987e45ec2f18c565acc7cda82685806ca78801e6fb892012b3
-  data.tar.gz: 0f8e433032ac46e974c6a4162afa9c44610f5fd424afdcaf7f12a601f983cfab
+  metadata.gz: fc826508539b9892ab3317d52a95d77cdb162b4439a4086ae3c538239edb7eaa
+  data.tar.gz: 05c364a0cfeca030f37e635b35b150819f81f266de13137f98d33b9a9be29a53
 SHA512:
-  metadata.gz: 30be96f28f9d20d285b9105725cb0704ed97af7ea8e34d425f7bf3fb8b4ef2f739cded05ab68b1c2931a8424058c18245e72eddb797bbee15c8d2fc1754175e7
-  data.tar.gz: 70021a953b7a36fdff2287d9e46242761e02ea114aa6ad16344860e04cb1973d6a87095d120216b4c60b48e9187130ca7a8461b0627c35a90f683931f3ac632c
+  metadata.gz: b0439a929e4b29fb9cc74ea0806135bfe10fb619bac6664c375aac1ae2b969f5adcd51a1f2d04322878c952d79430e6dec6350f4bda37665df26fe459b63ac0f
+  data.tar.gz: cedc00eb32c405fa556be7723fe2adde3ae7704c57e2053d6fcf8828c933deecb1b300833f7975fdd3239679c25512435c8ccf107e7d84925400f00ea661aa02

data/CHANGELOG.md

@@ -19,6 +19,111 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.12] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Toolbar:** The toolbar endpoint (`/_profiler/api/toolbar/:token`) now answers `403` when the
+  profiler is disabled, like the rest of the API. It used to keep serving any profile left in
+  storage, request headers and environment included, after `enabled = false`. The toolbar is only
+  injected while the profiler is enabled, so it is not affected.
+- **Profile page:** The profile embedded as JSON in the profile page is now escaped explicitly
+  (`<`, `>`, `&`, U+2028 and U+2029), whatever the application sets for
+  `ActiveSupport.escape_html_entities_in_json`. An application that turned that setting off let a
+  captured value (a parameter, a header, a body) close the `<script>` element and run JavaScript
+  in the application's origin. The token and the CSP nonce written into the application's pages
+  by the toolbar injector are escaped too.
+- **Dashboard:** Captured bodies offered for download are no longer typed with their captured
+  content type: opened in a tab, a `text/html` or `image/svg+xml` body ran its scripts in the
+  application's origin. Previews keep their type for raster images and PDF only. Email previews
+  are rendered in a fully sandboxed iframe, with an opaque origin. The unused SQL highlighter,
+  which wrote captured SQL into the page as HTML, is removed.
+- **Access control:** A disabled profiler now answers its API requests with a JSON error, like
+  any other refusal of the API, instead of plain text.
+- **Toolbar:** The toolbar is now injected before the `</body>` that closes the page, looked for
+  outside comments, tags (attributes read as the browser reads them, quoted values included) and
+  the elements whose content is not markup (`<script>`, `<style>`, `<textarea>`, `<title>`,
+  `<xmp>`, `<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`), instead of the first `</body>`
+  found. A `</body>` inside a script string of the page used to receive it, and the toolbar's own
+  `</script>` then turned the rest of that string into live markup. A page whose only `</body>`
+  sits in one of those, that leaves a comment, a tag, a quoted value or one of those elements
+  open, or that holds a `<plaintext>`, a double-escaped script or a CDATA section with a `>`
+  before its end, gets no toolbar.
+
+## [0.30.11] - 2026-10-04
+
+<!-- stamped -->
+
+### Fixed
+
+- **Cluster:** A profile page served by the master now finds profiles held by a slave even before
+  the slave proxy has been used once.
+
+### Security
+
+- **MCP:** The HTTP transport at `/_profiler/mcp` is routed only when `mcp_enabled` is true and
+  `mcp_transport` is `:http`; it answers `404` otherwise. It used to be routed in every application,
+  whatever these options said, and to answer anyone: after the MCP handshake, any client could list
+  the tools and call those that write `ENV`, clear profiles or run the test suite. The stdio
+  transport (`rake profiler:mcp`) is unchanged.
+- **MCP:** When it is routed, each request to `/_profiler/mcp` passes the profiler's own checks
+  before the MCP server sees it, and gets a `403` otherwise: the profiler must be enabled, the
+  request must pass `authorization_mode`, and a `POST` must carry `Content-Type: application/json`
+  with no foreign `Origin`, so that a page on another site cannot call the tools from your browser.
+- **Cluster:** The cluster endpoints (`register`, `heartbeat`, `slaves` and the slave proxy) are
+  routed only on a node with the new `cluster_master = true`; they answer `404` otherwise. Every
+  application used to accept slave registrations.
+- **Cluster:** The master and its slaves authenticate each other with the new shared
+  `cluster_secret`, sent in an `X-Profiler-Cluster-Secret` header and compared in constant time:
+  `register` and `heartbeat` refuse a missing or wrong secret, and everything while no secret is
+  configured. On a slave, the master's proxied calls are let in by the secret, so a master on
+  another machine no longer needs the slave to admit its address.
+- **Cluster:** The master registers, and sends requests to, only the slave URLs allowed by the new
+  `cluster_allowed_slave_urls` (scheme, host and port, compared after normalization, and a path
+  prefix); the default refuses all. HTTPS is required, except for loopback addresses, for slave URLs
+  and for `master_url` (new `cluster_allow_insecure_http` to lift it), and the master no longer
+  returns the body of a redirect. Anyone who could register used to make the master fetch any host
+  and port it could reach and read the answer (server-side request forgery).
+- **Cluster:** A path, profile token or MCP argument sent to a slave can no longer leave the slave's
+  `/_profiler/api/`: `?`, `#` and `%` are encoded into the path segment, and a `.`, `..` or `/`
+  segment is refused before any request, on the slave proxy, the profile pages and the MCP tools.
+  An encoded `..` or `?` used to reach other paths of the slave.
+- **Cluster:** A `cluster_secret` shorter than 32 characters, or blank, is ignored as if none were
+  configured, with a warning at boot and an explicit error on registration. The master stores slave
+  URLs in their normalized form.
+- **Cluster:** The `cluster_secret` is masked by value in everything a profile captures (params,
+  bodies, headers in and out, URLs, `ENV`, SQL binds, job and mailer arguments, and the free text of
+  every collector: log lines, exception messages, dumps, SQL text, console expressions), and in the
+  output of the test runner, whatever name it travels under and even with `redact_sensitive_data`
+  off, on top of the masking by name.
+- **Cluster:** The `cluster_secret` is masked before text is shortened (flame graph names, I18n
+  values, console expressions and results, mail bodies and assigns, job arguments), so no prefix of
+  it is left, and the output of the test runner is masked across the pieces it is read in, so the
+  secret no longer comes back whole once they are joined. Only a secret the cluster accepts (32
+  characters or more) is masked by value.
+- **Cluster:** The output of the test runner holds back an end that could start the secret until
+  the process has finished printing, a killed run included, and holds back nothing else, so
+  progress output is shown as it comes. Binary bodies stored in base64, incoming, response and
+  outbound, are masked on their raw bytes before they are encoded.
+- **Upgrading:** Nothing to do if you use neither the MCP HTTP endpoint nor the cluster. Otherwise,
+  in `config/initializers/profiler.rb`:
+  - MCP over HTTP: set `config.mcp_enabled = true` and `config.mcp_transport = :http`. An
+    installation that used `/_profiler/mcp` while `mcp_transport` stayed at its default, `:stdio`,
+    must now set `:http`. The checks have no MCP-specific switch: `config.authorization_mode =
+    :allow_all` lets anybody who can reach the application call every tool, and
+    `config.api_forgery_protection = false` lets any website you visit make your browser call them.
+  - Cluster master: set `config.cluster_master = true`, `config.cluster_secret` (at least 32
+    characters, the same value on every node, from the environment) and
+    `config.cluster_allowed_slave_urls`. Slaves: set the same `config.cluster_secret`, and use HTTPS
+    URLs unless master and slave share the machine.
+  - To go back to the previous behavior: `config.cluster_require_secret = false` (with no
+    `cluster_secret`) accepts registrations from any client `authorization_mode` lets in, as in
+    0.30.6; `config.cluster_allowed_slave_urls = :any` accepts any slave URL, which reopens the
+    server-side request forgery; `config.cluster_allow_insecure_http = true` sends the secret and the
+    profiles in clear to remote hosts.
+
 ## [0.30.10] - 2026-10-04
 
 <!-- stamped -->

data/app/assets/builds/profiler.js

@@ -4054,7 +4054,7 @@
   function DownloadTextButton({ text, mime }) {
     const [url, setUrl] = d2(null);
     y2(() => {
-      const objectUrl = URL.createObjectURL(new Blob([text], { type: mime }));
+      const objectUrl = URL.createObjectURL(new Blob([text], { type: "application/octet-stream" }));
       setUrl(objectUrl);
       return () => URL.revokeObjectURL(objectUrl);
     }, [text, mime]);
@@ -4142,11 +4142,17 @@
     };
     return map[category] || "text/plain";
   }
+  var INERT_PREVIEW_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp", "image/avif", "application/pdf"];
+  function inertPreviewType(mime) {
+    const m3 = mime.toLowerCase();
+    return INERT_PREVIEW_TYPES.includes(m3) ? m3 : "application/octet-stream";
+  }
   var PREVIEW_LIMIT = 500;
   var CSV_ROW_LIMIT = 10;
   function SmartBodyPreview({ body, encoding, headers }) {
     const [expanded, setExpanded] = d2(false);
     const [objectUrl, setObjectUrl] = d2(null);
+    const [downloadUrl, setDownloadUrl] = d2(null);
     const category = detectContentType(headers);
     y2(() => {
       if (encoding !== "base64" || !body) return;
@@ -4154,19 +4160,27 @@
       const raw = atob(body);
       const bytes = new Uint8Array(raw.length);
       for (let i3 = 0; i3 < raw.length; i3++) bytes[i3] = raw.charCodeAt(i3);
-      const url = URL.createObjectURL(new Blob([bytes], { type: mime }));
+      const url = URL.createObjectURL(new Blob([bytes], { type: inertPreviewType(mime) }));
+      const download = URL.createObjectURL(new Blob([bytes], { type: "application/octet-stream" }));
       setObjectUrl(url);
-      return () => URL.revokeObjectURL(url);
+      setDownloadUrl(download);
+      return () => {
+        URL.revokeObjectURL(url);
+        URL.revokeObjectURL(download);
+      };
     }, [body, encoding, headers]);
     if (!body) return /* @__PURE__ */ u3("span", { class: "profiler-text--muted profiler-text--xs", children: "empty" });
     if (encoding === "base64") {
       const mime = Object.entries(headers).find(([k3]) => k3.toLowerCase() === "content-type")?.[1]?.split(";")[0].trim() || "application/octet-stream";
       const filename = `body${mimeToExt(mime)}`;
       return /* @__PURE__ */ u3("div", { class: "profiler-body-binary", children: [
-        objectUrl && (category === "image" || category === "svg") && /* @__PURE__ */ u3("img", { src: objectUrl, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
+        objectUrl && category === "image" && /* @__PURE__ */ u3("img", { src: objectUrl, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
+        category === "svg" && // A data: URL rather than a blob: one: an <img> runs no script, and browsers refuse
+        // to open a data: URL in a tab of its own.
+        /* @__PURE__ */ u3("img", { src: `data:image/svg+xml;base64,${body}`, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
         objectUrl && category === "pdf" && /* @__PURE__ */ u3("iframe", { src: objectUrl, class: "profiler-body-preview-frame", title: "PDF preview" }),
         /* @__PURE__ */ u3("div", { style: "display:flex;gap:8px;margin-top:4px", children: [
-          objectUrl && /* @__PURE__ */ u3("a", { href: objectUrl, download: filename, class: "profiler-body-download-btn profiler-text--xs", children: [
+          downloadUrl && /* @__PURE__ */ u3("a", { href: downloadUrl, download: filename, class: "profiler-body-download-btn profiler-text--xs", children: [
             "Download ",
             mime
           ] }),
@@ -8615,7 +8629,7 @@
         "iframe",
         {
           srcdoc: email.body_html ?? void 0,
-          sandbox: "allow-same-origin",
+          sandbox: "",
           style: { width: "100%", height: "300px", border: "1px solid var(--profiler-border)", borderRadius: "var(--profiler-radius-md)", background: "#fff", display: "block" }
         }
       ),
@@ -9421,62 +9435,6 @@ Duration: ${event.duration.toFixed(2)}ms`;
     return "#dcdcaa";
   }
 
-  // app/assets/typescript/profiler/sql-formatter.ts
-  var SQL_KEYWORDS = [
-    "SELECT",
-    "FROM",
-    "WHERE",
-    "INSERT",
-    "UPDATE",
-    "DELETE",
-    "JOIN",
-    "LEFT",
-    "RIGHT",
-    "INNER",
-    "OUTER",
-    "ON",
-    "AS",
-    "AND",
-    "OR",
-    "NOT",
-    "IN",
-    "EXISTS",
-    "LIKE",
-    "ORDER",
-    "BY",
-    "GROUP",
-    "HAVING",
-    "LIMIT",
-    "OFFSET",
-    "DISTINCT",
-    "COUNT",
-    "SUM",
-    "AVG",
-    "MAX",
-    "MIN",
-    "CASE",
-    "WHEN",
-    "THEN",
-    "ELSE",
-    "END"
-  ];
-  function formatSQL(element) {
-    const sql = element.textContent || "";
-    const formatted = highlightSQL(sql);
-    element.innerHTML = formatted;
-  }
-  function highlightSQL(sql) {
-    let highlighted = sql;
-    SQL_KEYWORDS.forEach((keyword) => {
-      const regex = new RegExp(`\\b${keyword}\\b`, "gi");
-      highlighted = highlighted.replace(regex, `<span class="sql-keyword">${keyword}</span>`);
-    });
-    highlighted = highlighted.replace(/'([^']*)'/g, `<span class="sql-string">'$1'</span>`);
-    highlighted = highlighted.replace(/\b(\d+)\b/g, '<span class="sql-number">$1</span>');
-    highlighted = highlighted.replace(/--([^\n]*)/g, '<span class="sql-comment">--$1</span>');
-    return highlighted;
-  }
-
   // app/assets/typescript/profiler/theme.ts
   var STORAGE_KEY2 = "profiler-theme";
   var THEME_ATTRIBUTE = "data-theme";
@@ -9663,8 +9621,5 @@ Duration: ${event.duration.toFixed(2)}ms`;
     if (timeline) {
       initTimeline(timeline);
     }
-    document.querySelectorAll('pre[data-language="sql"]').forEach((block) => {
-      formatSQL(block);
-    });
   });
 })();

data/app/controllers/profiler/api/cluster_controller.rb

@@ -1,8 +1,12 @@
 # frozen_string_literal: true
 
+require_relative "../../../../lib/profiler/cluster/security"
+
 module Profiler
   module Api
     class ClusterController < Profiler::ApplicationController
+      SLAVE_ACTIONS = %w[register heartbeat].freeze
+
       def register
         name = params[:name].to_s
         url  = params[:url].to_s
@@ -11,7 +15,11 @@ module Profiler
           return render json: { error: "name and url are required" }, status: :unprocessable_entity
         end
 
-        Profiler.slave_registry.register(name: name, url: url)
+        if (reason = Cluster::Security.slave_url_denial(url))
+          return render json: { error: reason }, status: :unprocessable_entity
+        end
+
+        Profiler.slave_registry.register(name: name, url: Cluster::Security.normalized_url(url))
         render json: { ok: true, name: name }
       end
 
@@ -28,6 +36,34 @@ module Profiler
       def slaves
         render json: { slaves: Profiler.slave_registry.all }
       end
+
+      private
+
+      # A slave is a server, often on another host, not a browser: it proves itself with the
+      # shared secret instead of the access guard and the forgery header. Without
+      # cluster_require_secret, and with no secret configured, the guard of the other
+      # endpoints applies, as in 0.30.6.
+      def authorize_request
+        return super unless secret_authenticated_action?
+        return if Cluster::Security.request_secret_valid?(request)
+
+        if (problem = Cluster::Security.secret_problem)
+          deny("#{problem} on this master: cluster requests are refused")
+        else
+          deny("Missing or invalid #{Cluster::Security::SECRET_HEADER} header")
+        end
+      end
+
+      # The secret is a custom header, which a cross-site page cannot send without a preflight.
+      def verified_request?
+        return Cluster::Security.request_secret_valid?(request) if secret_authenticated_action?
+
+        super
+      end
+
+      def secret_authenticated_action?
+        SLAVE_ACTIONS.include?(action_name) && Cluster::Security.secret_required?
+      end
     end
   end
 end

data/app/controllers/profiler/api/slave_proxy_controller.rb

@@ -7,8 +7,10 @@ module Profiler
     class SlaveProxyController < Profiler::ApplicationController
       def forward
         proxy = Cluster::SlaveProxy.new(params[:slave_name])
-        sub_path = params[:path].to_s
-        full_path = "/_profiler/api/#{sub_path}"
+        # Each segment is escaped: a decoded "?" or "#" stays in its segment, and a dot segment
+        # is refused, so the request stays under the slave's API.
+        segments = params[:path].to_s.split("/", -1).map { |segment| Cluster::Security.escape_segment(segment) }
+        full_path = "/_profiler/api/#{segments.join("/")}"
 
         result = case request.method
                  when "GET"

data/app/controllers/profiler/api/toolbar_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ToolbarController < Profiler::ApplicationController
-      skip_before_action :check_authorization
-
       def show
         profile = Profiler.storage.load(params[:token])
 

data/app/controllers/profiler/application_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../../lib/profiler/cluster/security"
+
 module Profiler
   class ApplicationController < ActionController::Base
     layout "profiler/application"
@@ -12,12 +14,12 @@ module Profiler
     private
 
     def check_authorization
-      unless Profiler.configuration.enabled
-        render plain: "Profiler is disabled", status: :forbidden
-      end
+      deny("Profiler is disabled") unless Profiler.configuration.enabled
     end
 
     def authorize_request
+      # Checked first, so that :allow_local does not log a refusal for the master's calls.
+      return if cluster_master_request?
       return if Profiler.configuration.authorized?(request)
 
       deny("Not authorized to access the profiler")
@@ -32,7 +34,14 @@ module Profiler
     # Rails' token, or the header every profiler client sends. A third-party page cannot add a
     # custom header without a CORS preflight, which is refused unless an origin was allowed.
     def verified_request?
-      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present?
+      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present? || cluster_master_request?
+    end
+
+    # On a slave, the master's proxied calls carry the shared secret, which stands for both the
+    # access guard and the forgery header. Never true on a node without master_url, or without
+    # a configured secret.
+    def cluster_master_request?
+      Profiler.configuration.slave? && Cluster::Security.request_secret_valid?(request)
     end
 
     def handle_unverified_request

data/app/controllers/profiler/profiles_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../../lib/profiler/cluster/slave_proxy"
+
 module Profiler
   class ProfilesController < ApplicationController
     def index

data/app/views/profiler/profiles/show.html.erb

@@ -1,4 +1,6 @@
 <div id="profiler-show" data-embedded="<%= @embedded %>"></div>
+<%# json_escape turns <, >, & and U+2028/U+2029 into \u escapes, so that no captured value can
+    close the element, whatever the application sets for escape_html_entities_in_json. %>
 <script type="application/json" id="profiler-show-data">
-  <%= @profile_data.to_json.html_safe %>
+  <%= raw json_escape(@profile_data.to_json) %>
 </script>

data/config/routes.rb

@@ -3,7 +3,12 @@
 require "profiler/mcp/server"
 
 Profiler::Engine.routes.draw do
-  mount Profiler::MCP::Server.rack_app, at: "mcp"
+  # Read on each request rather than when the routes are drawn: the application's initializer
+  # may set these options after the engine routes are loaded. A route that does not match
+  # answers 404, as if it were not there.
+  constraints(->(_request) { Profiler.configuration.mcp_http_enabled? }) do
+    mount Profiler::MCP::Server.rack_app, at: "mcp"
+  end
 
   root to: "profiles#index"
 
@@ -52,14 +57,16 @@ Profiler::Engine.routes.draw do
     delete "test_runner/runs/:id",        to: "test_runner#destroy"
     get    "events/:token",               to: "events#subscribe",  as: :profile_events
 
-    # Cluster endpoints (master-side)
-    post "cluster/register",  to: "cluster#register"
-    post "cluster/heartbeat", to: "cluster#heartbeat"
-    get  "cluster/slaves",    to: "cluster#slaves"
+    # Cluster endpoints (master-side), routed only on a node with cluster_master set
+    constraints(->(_request) { Profiler.configuration.cluster_master? }) do
+      post "cluster/register",  to: "cluster#register"
+      post "cluster/heartbeat", to: "cluster#heartbeat"
+      get  "cluster/slaves",    to: "cluster#slaves"
 
-    # Slave proxy — must be last to avoid shadowing other api routes
-    scope "/slaves/:slave_name" do
-      match "*path", to: "slave_proxy#forward", via: :all
+      # Slave proxy: must be last to avoid shadowing other api routes
+      scope "/slaves/:slave_name" do
+        match "*path", to: "slave_proxy#forward", via: :all
+      end
     end
   end
 end

data/lib/profiler/cluster/master_client.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "json"
 require "uri"
+require_relative "security"
 
 module Profiler
   module Cluster
@@ -22,10 +23,9 @@ module Profiler
 
       def register!
         config = Profiler.configuration
-        uri = URI("#{config.master_url}/_profiler/api/cluster/register")
+        uri = master_uri("register")
         body = { name: config.resolved_name, url: config.self_url }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
-                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
+        resp = Net::HTTP.post(uri, body, request_headers)
         unless resp.code.to_i.between?(200, 299)
           raise "Master returned #{resp.code}: #{resp.body.to_s.slice(0, 200)}"
         end
@@ -35,13 +35,31 @@ module Profiler
 
       def heartbeat!
         config = Profiler.configuration
-        uri = URI("#{config.master_url}/_profiler/api/cluster/heartbeat")
+        uri = master_uri("heartbeat")
         body = { name: config.resolved_name }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
-                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
+        resp = Net::HTTP.post(uri, body, request_headers)
         raise "Heartbeat rejected #{resp.code}" unless resp.code.to_i.between?(200, 299)
       end
 
+      # Refused before any request when the secret would cross the network in clear, or when
+      # there is no secret for the master to accept.
+      def master_uri(action)
+        config = Profiler.configuration
+        if (reason = Security.master_url_denial(config.master_url))
+          raise reason
+        end
+        if Security.secret_required? && (problem = Security.secret_problem)
+          raise "#{problem}: the master refuses registration without a secret"
+        end
+
+        URI("#{config.master_url}/_profiler/api/cluster/#{action}")
+      end
+
+      def request_headers
+        { "Content-Type" => "application/json", Profiler::FORGERY_PROTECTION_HEADER => "1" }
+          .merge(Security.outgoing_headers)
+      end
+
       def start_heartbeat_thread
         Thread.new do
           interval = Profiler.configuration.cluster_heartbeat_interval