rails-profiler 0.30.10 → 0.30.12

data/lib/profiler/cluster/security.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "uri"
+require "active_support/security_utils"
+
+module Profiler
+  module Cluster
+    # The rules a master and its slaves apply to each other: the shared secret they exchange,
+    # and the URLs a master agrees to send requests to.
+    module Security
+      SECRET_HEADER = "X-Profiler-Cluster-Secret"
+      SECRET_ENV_KEY = "HTTP_X_PROFILER_CLUSTER_SECRET"
+      # A shorter secret, or a blank one, is treated as if none were configured.
+      MIN_SECRET_LENGTH = 32
+      API_PREFIX = "/_profiler/api/"
+
+      class << self
+        # Whether a secret has to be presented. False only with cluster_require_secret = false
+        # and no cluster_secret, the behaviour of 0.30.6.
+        def secret_required?
+          config = Profiler.configuration
+          config.cluster_require_secret || configured_secret?
+        end
+
+        def configured_secret?
+          secret_problem.nil?
+        end
+
+        # Why the configured secret cannot be used, or nil when it can.
+        def secret_problem
+          secret = Profiler.configuration.cluster_secret.to_s
+          return "No config.cluster_secret is configured" if secret.strip.empty?
+          return nil if secret.strip.length >= MIN_SECRET_LENGTH
+
+          "config.cluster_secret is shorter than #{MIN_SECRET_LENGTH} characters, so it is ignored " \
+            "as if none were configured"
+        end
+
+        # Logged once at boot on a cluster node whose secret cannot be used, since every cluster
+        # request is then refused.
+        def warn_about_configuration(logger)
+          config = Profiler.configuration
+          return unless config.cluster_master? || config.slave?
+          return unless (problem = secret_problem) && secret_required?
+
+          logger.warn("[Profiler Cluster] #{problem}: registrations, heartbeats and proxied requests " \
+                      "are refused. Generate one with `ruby -rsecurerandom -e 'puts SecureRandom.hex(32)'` " \
+                      "and give the same value to every node.")
+        end
+
+        # Constant-time comparison of the secret a request carries with the configured one.
+        # Always false when no usable secret is configured.
+        def valid_secret?(presented)
+          return false unless configured_secret?
+
+          expected = Profiler.configuration.cluster_secret.to_s
+          return false if presented.to_s.empty?
+
+          ActiveSupport::SecurityUtils.secure_compare(presented.to_s, expected)
+        end
+
+        def request_secret_valid?(request)
+          valid_secret?(request.get_header(SECRET_ENV_KEY))
+        end
+
+        # The headers to send with a request to another node of the cluster.
+        def outgoing_headers
+          configured_secret? ? { SECRET_HEADER => Profiler.configuration.cluster_secret.to_s } : {}
+        end
+
+        # Returns nil when the master may send requests to this slave URL, otherwise the reason.
+        def slave_url_denial(url)
+          config = Profiler.configuration
+          target = normalize(url)
+          return "#{url.inspect} is not a valid http(s) URL" unless target
+
+          if target[:scheme] == "http" && !loopback_host?(target[:host]) && !config.cluster_allow_insecure_http
+            return "#{url} uses plain HTTP to a host that is not a loopback address: HTTPS is required " \
+                   "(or set config.cluster_allow_insecure_http = true)"
+          end
+
+          allowed = config.cluster_allowed_slave_urls
+          return nil if allowed == :any
+          return nil if Array(allowed).any? { |entry| covers?(normalize(entry), target) }
+
+          "#{url} is not allowed by config.cluster_allowed_slave_urls"
+        end
+
+        # Same transport rule for the master URL a slave sends its secret to.
+        def master_url_denial(url)
+          target = normalize(url)
+          return "master_url #{url.inspect} is not a valid http(s) URL" unless target
+          return nil if target[:scheme] == "https" || loopback_host?(target[:host])
+          return nil if Profiler.configuration.cluster_allow_insecure_http
+
+          "master_url #{url} uses plain HTTP to a host that is not a loopback address: HTTPS is required " \
+            "(or set config.cluster_allow_insecure_http = true)"
+        end
+
+        # The URL as the registry keeps it: lower-case scheme and host, no default port, IPv6
+        # between brackets, path segments re-encoded, no trailing slash. Nil when not acceptable.
+        def normalized_url(url)
+          parts = normalize(url)
+          return nil unless parts
+
+          host = parts[:host].include?(":") ? "[#{parts[:host]}]" : parts[:host]
+          default_port = parts[:scheme] == "https" ? 443 : 80
+          port = parts[:port] == default_port ? "" : ":#{parts[:port]}"
+          path = parts[:segments].map { |segment| escape_segment(segment) }.join("/")
+          "#{parts[:scheme]}://#{host}#{port}#{path.empty? ? "" : "/#{path}"}"
+        end
+
+        # One path segment of a request to a slave, from a value that may come from a client (a
+        # proxied path, a profile token). "?", "#" and "%" are encoded, so they stay in the
+        # segment; ".", ".." and anything holding a "/" are refused, so the request cannot leave
+        # the slave's API.
+        def escape_segment(value)
+          segment = value.to_s
+          if segment.empty? || segment == "." || segment == ".." || segment.match?(%r{[/\\]})
+            raise Profiler::Error, "Refusing to send #{segment.inspect} as a path segment to a slave profiler"
+          end
+
+          URI.encode_www_form_component(segment).gsub("+", "%20")
+        end
+
+        # The final check on a path sent to a slave: under /_profiler/api/, with no dot or empty
+        # segment once decoded.
+        def api_path_denial(path)
+          raw = path.to_s.split("?", 2).first
+          return "#{path.inspect} is not under #{API_PREFIX}" unless raw.start_with?(API_PREFIX)
+
+          segments = raw.delete_prefix("/").split("/", -1)
+          decoded = segments.map { |segment| URI.decode_www_form_component(segment) }
+          return nil if decoded.none? { |segment| segment.empty? || segment == "." || segment == ".." || segment.include?("/") }
+
+          "#{path.inspect} holds an empty, \".\", \"..\" or encoded \"/\" path segment"
+        rescue ArgumentError
+          "#{path.inspect} is not a valid path"
+        end
+
+        # Scheme, host and port compared after normalization (case, default port, IPv6 brackets),
+        # and a path prefix compared segment by segment.
+        def covers?(entry, target)
+          return false unless entry
+
+          entry[:scheme] == target[:scheme] && entry[:host] == target[:host] && entry[:port] == target[:port] &&
+            (entry[:segments].empty? || target[:segments].first(entry[:segments].size) == entry[:segments])
+        end
+
+        # Returns { scheme:, host:, port:, segments: }, or nil for anything that is not a plain
+        # http(s) URL: user info, a query, a fragment, or a "." or ".." path segment are refused
+        # rather than interpreted.
+        def normalize(url)
+          uri = URI.parse(url.to_s.strip)
+          return nil unless uri.is_a?(URI::HTTP) && uri.host && !uri.host.empty?
+          return nil if uri.userinfo || uri.query || uri.fragment
+
+          segments = uri.path.to_s.split("/").reject(&:empty?)
+          decoded = segments.map { |segment| URI.decode_www_form_component(segment) }
+          return nil if decoded.any? { |segment| segment == "." || segment == ".." || segment.include?("/") }
+
+          { scheme: uri.scheme.downcase, host: uri.hostname.downcase, port: uri.port, segments: decoded }
+        rescue URI::Error, ArgumentError
+          nil
+        end
+
+        def loopback_host?(host)
+          host = host.to_s.downcase
+          return true if host == "localhost"
+
+          IPAddr.new(host).loopback?
+        rescue IPAddr::Error
+          false
+        end
+      end
+    end
+  end
+end

data/lib/profiler/cluster/slave_proxy.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "json"
 require "uri"
+require_relative "security"
 
 module Profiler
   module Cluster
@@ -15,6 +16,15 @@ module Profiler
         entry = Profiler.slave_registry.find!(slave_name)
         raise Profiler::Error, "Slave profiler '#{slave_name}' is offline" if entry.status == "offline"
 
+        # Checked again on every use: the URL was registered earlier, under a configuration that
+        # may have changed since.
+        if (reason = Security.slave_url_denial(entry.url))
+          raise Profiler::Error, "Slave profiler '#{slave_name}' refused: #{reason}"
+        end
+        if Security.secret_required? && (problem = Security.secret_problem)
+          raise Profiler::Error, "#{problem}: requests to slave profilers are refused"
+        end
+
         @base_url = entry.url.to_s.chomp("/")
         @open_timeout = open_timeout || OPEN_TIMEOUT
         @read_timeout = read_timeout || READ_TIMEOUT
@@ -30,7 +40,7 @@ module Profiler
       end
 
       def load(token)
-        data = get_json("/_profiler/api/profiles/#{token}")
+        data = get_json("/_profiler/api/profiles/#{Security.escape_segment(token)}")
         return nil unless data["token"] || data["profile"]
 
         raw = data["profile"] || data
@@ -69,7 +79,14 @@ module Profiler
 
       private
 
+      # Every request carries the secret, so its path must stay under the slave's API: values
+      # from clients are escaped by Security.escape_segment where they are interpolated, and
+      # this refuses whatever still reaches here with a dot segment.
       def build_uri(path, params = {})
+        if (reason = Security.api_path_denial(path))
+          raise Profiler::Error, "Refusing to send a request to a slave profiler: #{reason}"
+        end
+
         uri = URI("#{@base_url}#{path}")
         unless params.empty?
           uri.query = URI.encode_www_form(params.compact.transform_values(&:to_s))
@@ -87,12 +104,18 @@ module Profiler
 
       def request(uri, req)
         req[Profiler::FORGERY_PROTECTION_HEADER] = "1"
+        Security.outgoing_headers.each { |name, value| req[name] = value }
+        # Net::HTTP never follows a redirect; a 3xx is reported, without its body, rather than
+        # handed back as if the slave had answered.
         resp = Net::HTTP.start(uri.hostname, uri.port,
                                open_timeout: @open_timeout, read_timeout: @read_timeout,
                                use_ssl: uri.scheme == "https") do |http|
           http.request(req)
         end
         return {} if resp.code == "204"
+        if resp.code.to_s.start_with?("3")
+          raise Profiler::Error, "Slave profiler answered #{resp.code} (redirect not followed)"
+        end
 
         parse_response(resp)
       end

data/lib/profiler/collectors/base_collector.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../redaction"
+
 module Profiler
   module Collectors
     class BaseCollector

data/lib/profiler/collectors/console_collector.rb

@@ -13,7 +13,7 @@ module Profiler
       end
 
       def set_return_value(value)
-        @return_value = value.inspect.slice(0, 10_000)
+        @return_value = Profiler::Redaction.truncate(value.inspect, 10_000, "")
         @return_value_captured = true
       rescue
         @return_value = "(uninspectable)"
@@ -50,7 +50,7 @@ module Profiler
       end
 
       def toolbar_summary
-        { text: @expression.to_s[0, 30], color: "blue" }
+        { text: Profiler::Redaction.truncate(@expression, 30, ""), color: "blue" }
       end
     end
   end

data/lib/profiler/collectors/flamegraph_collector.rb

@@ -86,7 +86,7 @@ module Profiler
 
           sql = payload[:sql].to_s
           add_event Models::TimelineEvent.new(
-            name: sql.length > 80 ? "#{sql[0, 80]}..." : sql,
+            name: Profiler::Redaction.truncate(sql, 80),
             started_at: started,
             finished_at: finished,
             category: "sql",
@@ -100,7 +100,7 @@ module Profiler
             op = name.split(".").first.sub("cache_", "")
             key = payload[:key].to_s
             add_event Models::TimelineEvent.new(
-              name: "cache_#{op}: #{key.length > 60 ? "#{key[0, 60]}..." : key}",
+              name: "cache_#{op}: #{Profiler::Redaction.truncate(key, 60)}",
               started_at: started,
               finished_at: finished,
               category: "cache",

data/lib/profiler/collectors/i18n_collector.rb

@@ -93,7 +93,7 @@ module Profiler
       private
 
       def truncate(str, max = 100)
-        str.length > max ? "#{str[0, max]}…" : str
+        Profiler::Redaction.truncate(str, max, "…")
       end
     end
   end

data/lib/profiler/collectors/mailer_collector.rb

@@ -224,12 +224,12 @@ module Profiler
         if mail.multipart?
           html_part = mail.parts.find { |p| p.content_type.to_s.start_with?("text/html") }
           text_part = mail.parts.find { |p| p.content_type.to_s.start_with?("text/plain") }
-          html = html_part&.body&.decoded&.then { |b| b[0, MAX_BODY_SIZE] }
-          text = text_part&.body&.decoded&.then { |b| b[0, MAX_BODY_SIZE] }
+          html = html_part&.body&.decoded&.then { |b| Profiler::Redaction.truncate(b, MAX_BODY_SIZE, "") }
+          text = text_part&.body&.decoded&.then { |b| Profiler::Redaction.truncate(b, MAX_BODY_SIZE, "") }
         elsif mail.content_type.to_s.start_with?("text/html")
-          html = mail.body.decoded[0, MAX_BODY_SIZE]
+          html = Profiler::Redaction.truncate(mail.body.decoded, MAX_BODY_SIZE, "")
         else
-          text = mail.body.decoded[0, MAX_BODY_SIZE]
+          text = Profiler::Redaction.truncate(mail.body.decoded, MAX_BODY_SIZE, "")
         end
         [html.nil? || html.empty? ? nil : html, text.nil? || text.empty? ? nil : text]
       rescue StandardError
@@ -240,7 +240,7 @@ module Profiler
         return "nil" if value.nil?
 
         inspected = value.inspect
-        inspected.length > 300 ? "#{inspected[0, 300]}…" : inspected
+        Profiler::Redaction.truncate(inspected, 300, "…")
       rescue StandardError
         value.to_s
       end

data/lib/profiler/configuration.rb

@@ -41,7 +41,9 @@ module Profiler
                   :compress_bodies, :compress_body_threshold,
                   :redact_sensitive_data, :filter_parameters, :env_allowlist,
                   :name, :master_url, :self_url,
-                  :cluster_heartbeat_interval, :cluster_offline_threshold
+                  :cluster_heartbeat_interval, :cluster_offline_threshold,
+                  :cluster_master, :cluster_secret, :cluster_require_secret,
+                  :cluster_allowed_slave_urls, :cluster_allow_insecure_http
 
     attr_writer :tmp_path
 
@@ -98,6 +100,12 @@ module Profiler
       @self_url = nil
       @cluster_heartbeat_interval = 15
       @cluster_offline_threshold = 60
+      # Cluster security: see Profiler::Cluster::Security and the Cluster section of the README.
+      @cluster_master = false
+      @cluster_secret = nil
+      @cluster_require_secret = true
+      @cluster_allowed_slave_urls = []
+      @cluster_allow_insecure_http = false
     end
 
     def tmp_path
@@ -112,6 +120,18 @@ module Profiler
       !slave?
     end
 
+    # Whether this node serves the master-side cluster routes (register, heartbeat, slaves and
+    # the slave proxy). Read on each request by the route constraints.
+    def cluster_master?
+      cluster_master ? true : false
+    end
+
+    # Whether /_profiler/mcp is routed. The stdio transport (rake profiler:mcp) does not depend
+    # on it.
+    def mcp_http_enabled?
+      mcp_enabled && mcp_transport.to_s == "http" ? true : false
+    end
+
     def resolved_name
       @name || (defined?(Rails) ? Rails.application.class.module_parent_name.underscore : "profiler")
     end

data/lib/profiler/console_profiler.rb

@@ -39,7 +39,7 @@ module Profiler
       profile = Models::Profile.new
       profile.profile_type = "console"
       profile.gem_version = Profiler::VERSION
-      profile.path = @expression.length > 200 ? "#{@expression[0, 200]}..." : @expression
+      profile.path = Redaction.truncate(@expression, 200)
       profile.method = "CONSOLE"
 
       console_collector = Collectors::ConsoleCollector.new(profile, expression: @expression)

data/lib/profiler/instrumentation/net_http_instrumentation.rb

@@ -150,7 +150,8 @@ module Profiler
         mime = content_type.split(";").first.to_s.strip
 
         if mime.match?(BINARY_CONTENT_TYPES)
-          { body: Base64.strict_encode64(body.b), encoding: "base64" }
+          # Masked on the raw bytes, before the encoding hides them from any later search.
+          { body: Base64.strict_encode64(Redaction.hide_credentials(body.b)), encoding: "base64" }
         else
           text = Redaction.filter_body(body, content_type)
                           .encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")

data/lib/profiler/job_profiler.rb

@@ -118,11 +118,11 @@ module Profiler
 
       Redaction.filter_value(args).map do |arg|
         case arg
-        when String then arg.length > 200 ? "#{arg[0, 200]}..." : arg
+        when String then Redaction.truncate(arg, 200)
         when Numeric, TrueClass, FalseClass, NilClass then arg
         else
           inspected = arg.inspect
-          inspected.length > 200 ? "#{inspected[0, 200]}..." : inspected
+          Redaction.truncate(inspected, 200)
         end
       rescue
         arg.to_s

data/lib/profiler/mcp/http_guard.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module Profiler
+  module MCP
+    # Checks a request to the MCP HTTP transport before the MCP server sees it, with the same
+    # rules as the profiler's controllers: the profiler must be enabled, the request authorized,
+    # and a POST must not be one that another site could forge from a browser.
+    #
+    # Forgery protection does not use the X-Profiler-Request header, which MCP clients do not
+    # send. A POST must carry Content-Type: application/json instead: a cross-site form or
+    # "simple" fetch can only send text/plain, form-urlencoded or multipart, and JSON needs a
+    # CORS preflight that the profiler grants to configured origins only. A browser also sends
+    # its Origin, which has to be the profiler's own or one of cors_allowed_origins. GET (the
+    # SSE stream) changes nothing, and DELETE always needs a preflight.
+    module HttpGuard
+      JSON_MEDIA_TYPE = "application/json"
+
+      class << self
+        # Returns nil when the request may proceed, otherwise a Rack response.
+        def call(env)
+          config = Profiler.configuration
+          return deny("Profiler is disabled") unless config.enabled
+
+          request = ActionDispatch::Request.new(env)
+          return deny("Not authorized to access the profiler") unless config.authorized?(request)
+          return nil unless config.api_forgery_protection
+
+          forgery_denial(request, config)
+        end
+
+        private
+
+        def forgery_denial(request, config)
+          origin = request.get_header("HTTP_ORIGIN")
+          if origin && !origin.empty? && !allowed_origin?(origin, request, config)
+            return deny("Cross-origin request refused: Origin #{origin} is not allowed")
+          end
+
+          if request.post? && media_type(request) != JSON_MEDIA_TYPE
+            return deny("A POST to the MCP endpoint needs Content-Type: #{JSON_MEDIA_TYPE}")
+          end
+
+          nil
+        end
+
+        def media_type(request)
+          request.get_header("CONTENT_TYPE").to_s.split(";").first.to_s.strip.downcase
+        end
+
+        def allowed_origin?(origin, request, config)
+          return true if Array(config.cors_allowed_origins).include?(origin)
+
+          same_origin?(origin, request.base_url)
+        end
+
+        def same_origin?(origin, base_url)
+          a = URI.parse(origin)
+          b = URI.parse(base_url)
+          a.scheme.to_s.casecmp?(b.scheme.to_s) && a.host.to_s.casecmp?(b.host.to_s) && a.port == b.port
+        rescue URI::InvalidURIError
+          false
+        end
+
+        def deny(message)
+          [403, { "content-type" => "application/json" }, [{ error: message }.to_json]]
+        end
+      end
+    end
+  end
+end

data/lib/profiler/mcp/server.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "mcp"
+require_relative "http_guard"
 
 module Profiler
   module MCP
@@ -12,7 +13,9 @@ module Profiler
 
         def rack_app
           # Memoized at class level — survives route reloads in development
-          @rack_app ||= ->(env) { instance.http_transport.handle_request(Rack::Request.new(env)) }
+          @rack_app ||= lambda do |env|
+            HttpGuard.call(env) || instance.http_transport.handle_request(Rack::Request.new(env))
+          end
         end
       end
 

data/lib/profiler/middleware/toolbar_injector.rb

@@ -1,9 +1,31 @@
 # frozen_string_literal: true
 
+require "json"
+require "strscan"
+require "active_support/core_ext/string/output_safety"
+
 module Profiler
   module Middleware
     class ToolbarInjector
-      CLOSING_BODY_TAG = "</body>"
+      # The only characters HTML counts as white space between attributes (\s also takes \v).
+      WS = "[\\t\\n\\f\\r ]"
+      # Elements whose content the browser does not parse as markup: a </body> inside one of
+      # them is text, not the end of the page. Each maps to the end tag that closes it.
+      RAW_TEXT_ELEMENTS = %w[script style textarea title xmp iframe noembed noframes noscript]
+                          .to_h { |name| [name, %r{</#{name}(?=#{WS}|[/>])}i] }.freeze
+      # Never closed: whatever follows it is text.
+      PLAINTEXT = "plaintext"
+      # An attribute as the HTML tokenizer reads it: the name may start with = (or a quote),
+      # and a value only follows a name, after =. A quoted value may hold a > or a </body>.
+      ATTRIBUTE = %r{
+        [^\t\n\f\r\ />][^\t\n\f\r\ />=]*+
+        (?:#{WS}*+(?:=#{WS}*+(?:"[^"]*+"|'[^']*+'|[^\t\n\f\r\ >"'][^\t\n\f\r\ >]*+|(?=>))|(?!=)))
+      }x
+      # The rest of a tag, up to its >. A quoted value that is never closed fails the match,
+      # as does a tag without its >. Possessive, so that a failure costs no backtracking.
+      TAG_REST = %r{(?:#{WS}++|/|#{ATTRIBUTE})*+>}
+      # A whole start or end tag, read after its <: the slash and the name are captured.
+      TAG = %r{(/)?([a-z][^\t\n\f\r\ />]*+)#{TAG_REST}}i
 
       def initialize(body, token, nonce = nil)
         @body = body
@@ -13,9 +35,12 @@ module Profiler
 
       def inject
         content = extract_content(@body)
-        return @body unless content.include?(CLOSING_BODY_TAG)
+        # Bytes, so that a page that is not valid UTF-8 can still be scanned.
+        bytes = content.b
+        position = closing_body_position(bytes)
+        return @body unless position
 
-        injected_content = content.sub(CLOSING_BODY_TAG, toolbar_html + CLOSING_BODY_TAG)
+        injected_content = bytes.insert(position, toolbar_html.b).force_encoding(content.encoding)
 
         # Return as array for Rack compatibility
         [injected_content]
@@ -23,12 +48,70 @@ module Profiler
 
       private
 
+      # Byte offset of the </body> that closes the page: the last one outside comments, tags
+      # (an attribute value) and raw-text elements, where a page can carry the string
+      # "</body>" (a script building markup, a cached fragment in a final comment). nil when
+      # there is none, or when the page leaves a comment, a tag, a quoted value or a raw-text
+      # element open, or holds a <plaintext> or a double-escaped script: no toolbar rather than
+      # a toolbar in the wrong place.
+      def closing_body_position(bytes)
+        scanner = StringScanner.new(bytes)
+        position = nil
+
+        while scanner.skip_until(/</)
+          start = scanner.pos - 1
+
+          if scanner.skip(TAG)
+            name = scanner[2]
+            name = name.downcase if name.match?(/[A-Z]/)
+
+            if scanner[1]
+              position = start if name == "body"
+              next
+            end
+            return nil if name == PLAINTEXT
+            next unless (end_tag = RAW_TEXT_ELEMENTS[name])
+
+            text_start = scanner.pos
+            return nil unless scanner.skip_until(end_tag)
+            return nil if name == "script" && double_escaped?(bytes, text_start, scanner.pos - scanner.matched_size)
+            return nil unless scanner.skip(TAG_REST)
+          elsif scanner.match?(%r{/?[a-z]}i)
+            # A tag, or a quoted value in it, that is never closed.
+            return nil
+          elsif scanner.skip(/!--/)
+            # <!--> and <!---> are complete comments.
+            next if scanner.skip(/-?>/) || scanner.skip_until(/-->/)
+
+            return nil
+          elsif scanner.skip(/!\[CDATA\[/)
+            # A bogus comment up to the first > in HTML, a CDATA section up to ]]> in <svg> or
+            # <math>: go on only when both end at the same place.
+            return nil unless scanner.skip_until(/>/) && bytes.byteslice(scanner.pos - 3, 3) == "]]>"
+          elsif scanner.skip(%r{[!?/]})
+            # <!DOCTYPE>, <?xml ?>, </ not followed by a letter: a bogus comment, up to its >.
+            return nil unless scanner.skip_until(/>/)
+          end
+        end
+
+        position
+      end
+
+      # In a script, <!-- followed by <script enters a state where </script> does not close it.
+      # Only the script itself is searched, so that a page of many scripts is read in linear
+      # time.
+      def double_escaped?(bytes, from, to)
+        text = bytes.byteslice(from, to - from)
+        comment = text.index("<!--")
+        comment ? text.match?(%r{<script(?:#{WS}|[/>])}i, comment) : false
+      end
+
       def ajax_interceptor_script
         return "" unless Profiler.configuration.track_ajax
 
         <<~HTML
           <script#{nonce_attr}>
-            window.__PROFILER_PARENT_TOKEN__ = '#{@token}';
+            window.__PROFILER_PARENT_TOKEN__ = #{js_token};
           </script>
           <script#{nonce_attr}>
             #{ajax_interceptor_code}
@@ -63,15 +146,20 @@ module Profiler
         <<~HTML
           #{ajax_interceptor_script}
           <style>#{toolbar_styles}</style>
-          <div id="profiler-toolbar" class="profiler-root" data-token="#{@token}"></div>
+          <div id="profiler-toolbar" class="profiler-root" data-token="#{ERB::Util.html_escape(@token)}"></div>
           <button id="profiler-toolbar-toggle" class="profiler-root" title="Toggle profiler (Alt+P)"><span class="profiler-toggle-icon">&#9654;</span></button>
           <script#{nonce_attr}>(function(){var c=localStorage.getItem('profiler-toolbar-collapsed')==='true',t=localStorage.getItem('profiler-theme'),theme=t==='light'?'light':t==='dark'?'dark':(window.matchMedia('(prefers-color-scheme:light)').matches?'light':'dark'),el=document.getElementById('profiler-toolbar'),tog=document.getElementById('profiler-toolbar-toggle');if(c){el.style.cssText='animation:none!important;transform:translateX(calc(100% + 44px))';tog.dataset.collapsed='true';}el.setAttribute('data-theme',theme);tog.setAttribute('data-theme',theme);})();</script>
           <script src="/_profiler/assets/profiler-toolbar.js" defer#{nonce_attr}></script>
         HTML
       end
 
+      # The token as a JavaScript string literal that cannot close the <script> element.
+      def js_token
+        ERB::Util.json_escape(@token.to_s.to_json)
+      end
+
       def nonce_attr
-        @nonce ? " nonce=\"#{@nonce}\"" : ""
+        @nonce ? " nonce=\"#{ERB::Util.html_escape(@nonce)}\"" : ""
       end
 
       # Thermal design system — self-contained CSS for the injected toolbar.