rails-profiler 0.30.11 → 0.30.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7bb3bed351c863507d670d29552cb6751bb023300728a48e9baf9c718a53659
-  data.tar.gz: 8af241a6ca0278f3ada6a4d0d88599e93b952f67057ba6b826ea36935976ba67
+  metadata.gz: fc826508539b9892ab3317d52a95d77cdb162b4439a4086ae3c538239edb7eaa
+  data.tar.gz: 05c364a0cfeca030f37e635b35b150819f81f266de13137f98d33b9a9be29a53
 SHA512:
-  metadata.gz: 04d1ce9d5e1c0a2527ddb60280aa82e89e04ccc32a202a4f79e09b4a5fa87319b8f6d6c95a93f212a61cb4bc7213b92d15bb914567669a2f079eec502c075822
-  data.tar.gz: 91db3673cbcd3debdcf9fc1e02690601c4a70aaf10f4a17a070eed4b7f9359ae6261b5a9256ab43b9a13108aec0fa61677dddc9b735f72bf8103261f7e8b24f5
+  metadata.gz: b0439a929e4b29fb9cc74ea0806135bfe10fb619bac6664c375aac1ae2b969f5adcd51a1f2d04322878c952d79430e6dec6350f4bda37665df26fe459b63ac0f
+  data.tar.gz: cedc00eb32c405fa556be7723fe2adde3ae7704c57e2053d6fcf8828c933deecb1b300833f7975fdd3239679c25512435c8ccf107e7d84925400f00ea661aa02

data/CHANGELOG.md

@@ -19,6 +19,39 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.12] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Toolbar:** The toolbar endpoint (`/_profiler/api/toolbar/:token`) now answers `403` when the
+  profiler is disabled, like the rest of the API. It used to keep serving any profile left in
+  storage, request headers and environment included, after `enabled = false`. The toolbar is only
+  injected while the profiler is enabled, so it is not affected.
+- **Profile page:** The profile embedded as JSON in the profile page is now escaped explicitly
+  (`<`, `>`, `&`, U+2028 and U+2029), whatever the application sets for
+  `ActiveSupport.escape_html_entities_in_json`. An application that turned that setting off let a
+  captured value (a parameter, a header, a body) close the `<script>` element and run JavaScript
+  in the application's origin. The token and the CSP nonce written into the application's pages
+  by the toolbar injector are escaped too.
+- **Dashboard:** Captured bodies offered for download are no longer typed with their captured
+  content type: opened in a tab, a `text/html` or `image/svg+xml` body ran its scripts in the
+  application's origin. Previews keep their type for raster images and PDF only. Email previews
+  are rendered in a fully sandboxed iframe, with an opaque origin. The unused SQL highlighter,
+  which wrote captured SQL into the page as HTML, is removed.
+- **Access control:** A disabled profiler now answers its API requests with a JSON error, like
+  any other refusal of the API, instead of plain text.
+- **Toolbar:** The toolbar is now injected before the `</body>` that closes the page, looked for
+  outside comments, tags (attributes read as the browser reads them, quoted values included) and
+  the elements whose content is not markup (`<script>`, `<style>`, `<textarea>`, `<title>`,
+  `<xmp>`, `<iframe>`, `<noembed>`, `<noframes>`, `<noscript>`), instead of the first `</body>`
+  found. A `</body>` inside a script string of the page used to receive it, and the toolbar's own
+  `</script>` then turned the rest of that string into live markup. A page whose only `</body>`
+  sits in one of those, that leaves a comment, a tag, a quoted value or one of those elements
+  open, or that holds a `<plaintext>`, a double-escaped script or a CDATA section with a `>`
+  before its end, gets no toolbar.
+
 ## [0.30.11] - 2026-10-04
 
 <!-- stamped -->

data/app/assets/builds/profiler.js

@@ -4054,7 +4054,7 @@
   function DownloadTextButton({ text, mime }) {
     const [url, setUrl] = d2(null);
     y2(() => {
-      const objectUrl = URL.createObjectURL(new Blob([text], { type: mime }));
+      const objectUrl = URL.createObjectURL(new Blob([text], { type: "application/octet-stream" }));
       setUrl(objectUrl);
       return () => URL.revokeObjectURL(objectUrl);
     }, [text, mime]);
@@ -4142,11 +4142,17 @@
     };
     return map[category] || "text/plain";
   }
+  var INERT_PREVIEW_TYPES = ["image/png", "image/jpeg", "image/gif", "image/webp", "image/avif", "application/pdf"];
+  function inertPreviewType(mime) {
+    const m3 = mime.toLowerCase();
+    return INERT_PREVIEW_TYPES.includes(m3) ? m3 : "application/octet-stream";
+  }
   var PREVIEW_LIMIT = 500;
   var CSV_ROW_LIMIT = 10;
   function SmartBodyPreview({ body, encoding, headers }) {
     const [expanded, setExpanded] = d2(false);
     const [objectUrl, setObjectUrl] = d2(null);
+    const [downloadUrl, setDownloadUrl] = d2(null);
     const category = detectContentType(headers);
     y2(() => {
       if (encoding !== "base64" || !body) return;
@@ -4154,19 +4160,27 @@
       const raw = atob(body);
       const bytes = new Uint8Array(raw.length);
       for (let i3 = 0; i3 < raw.length; i3++) bytes[i3] = raw.charCodeAt(i3);
-      const url = URL.createObjectURL(new Blob([bytes], { type: mime }));
+      const url = URL.createObjectURL(new Blob([bytes], { type: inertPreviewType(mime) }));
+      const download = URL.createObjectURL(new Blob([bytes], { type: "application/octet-stream" }));
       setObjectUrl(url);
-      return () => URL.revokeObjectURL(url);
+      setDownloadUrl(download);
+      return () => {
+        URL.revokeObjectURL(url);
+        URL.revokeObjectURL(download);
+      };
     }, [body, encoding, headers]);
     if (!body) return /* @__PURE__ */ u3("span", { class: "profiler-text--muted profiler-text--xs", children: "empty" });
     if (encoding === "base64") {
       const mime = Object.entries(headers).find(([k3]) => k3.toLowerCase() === "content-type")?.[1]?.split(";")[0].trim() || "application/octet-stream";
       const filename = `body${mimeToExt(mime)}`;
       return /* @__PURE__ */ u3("div", { class: "profiler-body-binary", children: [
-        objectUrl && (category === "image" || category === "svg") && /* @__PURE__ */ u3("img", { src: objectUrl, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
+        objectUrl && category === "image" && /* @__PURE__ */ u3("img", { src: objectUrl, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
+        category === "svg" && // A data: URL rather than a blob: one: an <img> runs no script, and browsers refuse
+        // to open a data: URL in a tab of its own.
+        /* @__PURE__ */ u3("img", { src: `data:image/svg+xml;base64,${body}`, alt: "response preview", style: "max-width:100%;max-height:300px;display:block;margin-bottom:8px;border-radius:4px;border:1px solid var(--profiler-border)" }),
         objectUrl && category === "pdf" && /* @__PURE__ */ u3("iframe", { src: objectUrl, class: "profiler-body-preview-frame", title: "PDF preview" }),
         /* @__PURE__ */ u3("div", { style: "display:flex;gap:8px;margin-top:4px", children: [
-          objectUrl && /* @__PURE__ */ u3("a", { href: objectUrl, download: filename, class: "profiler-body-download-btn profiler-text--xs", children: [
+          downloadUrl && /* @__PURE__ */ u3("a", { href: downloadUrl, download: filename, class: "profiler-body-download-btn profiler-text--xs", children: [
             "Download ",
             mime
           ] }),
@@ -8615,7 +8629,7 @@
         "iframe",
         {
           srcdoc: email.body_html ?? void 0,
-          sandbox: "allow-same-origin",
+          sandbox: "",
           style: { width: "100%", height: "300px", border: "1px solid var(--profiler-border)", borderRadius: "var(--profiler-radius-md)", background: "#fff", display: "block" }
         }
       ),
@@ -9421,62 +9435,6 @@ Duration: ${event.duration.toFixed(2)}ms`;
     return "#dcdcaa";
   }
 
-  // app/assets/typescript/profiler/sql-formatter.ts
-  var SQL_KEYWORDS = [
-    "SELECT",
-    "FROM",
-    "WHERE",
-    "INSERT",
-    "UPDATE",
-    "DELETE",
-    "JOIN",
-    "LEFT",
-    "RIGHT",
-    "INNER",
-    "OUTER",
-    "ON",
-    "AS",
-    "AND",
-    "OR",
-    "NOT",
-    "IN",
-    "EXISTS",
-    "LIKE",
-    "ORDER",
-    "BY",
-    "GROUP",
-    "HAVING",
-    "LIMIT",
-    "OFFSET",
-    "DISTINCT",
-    "COUNT",
-    "SUM",
-    "AVG",
-    "MAX",
-    "MIN",
-    "CASE",
-    "WHEN",
-    "THEN",
-    "ELSE",
-    "END"
-  ];
-  function formatSQL(element) {
-    const sql = element.textContent || "";
-    const formatted = highlightSQL(sql);
-    element.innerHTML = formatted;
-  }
-  function highlightSQL(sql) {
-    let highlighted = sql;
-    SQL_KEYWORDS.forEach((keyword) => {
-      const regex = new RegExp(`\\b${keyword}\\b`, "gi");
-      highlighted = highlighted.replace(regex, `<span class="sql-keyword">${keyword}</span>`);
-    });
-    highlighted = highlighted.replace(/'([^']*)'/g, `<span class="sql-string">'$1'</span>`);
-    highlighted = highlighted.replace(/\b(\d+)\b/g, '<span class="sql-number">$1</span>');
-    highlighted = highlighted.replace(/--([^\n]*)/g, '<span class="sql-comment">--$1</span>');
-    return highlighted;
-  }
-
   // app/assets/typescript/profiler/theme.ts
   var STORAGE_KEY2 = "profiler-theme";
   var THEME_ATTRIBUTE = "data-theme";
@@ -9663,8 +9621,5 @@ Duration: ${event.duration.toFixed(2)}ms`;
     if (timeline) {
       initTimeline(timeline);
     }
-    document.querySelectorAll('pre[data-language="sql"]').forEach((block) => {
-      formatSQL(block);
-    });
   });
 })();

data/app/controllers/profiler/api/toolbar_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ToolbarController < Profiler::ApplicationController
-      skip_before_action :check_authorization
-
       def show
         profile = Profiler.storage.load(params[:token])
 

data/app/controllers/profiler/application_controller.rb

@@ -14,9 +14,7 @@ module Profiler
     private
 
     def check_authorization
-      unless Profiler.configuration.enabled
-        render plain: "Profiler is disabled", status: :forbidden
-      end
+      deny("Profiler is disabled") unless Profiler.configuration.enabled
     end
 
     def authorize_request

data/app/views/profiler/profiles/show.html.erb

@@ -1,4 +1,6 @@
 <div id="profiler-show" data-embedded="<%= @embedded %>"></div>
+<%# json_escape turns <, >, & and U+2028/U+2029 into \u escapes, so that no captured value can
+    close the element, whatever the application sets for escape_html_entities_in_json. %>
 <script type="application/json" id="profiler-show-data">
-  <%= @profile_data.to_json.html_safe %>
+  <%= raw json_escape(@profile_data.to_json) %>
 </script>

data/lib/profiler/middleware/toolbar_injector.rb

@@ -1,9 +1,31 @@
 # frozen_string_literal: true
 
+require "json"
+require "strscan"
+require "active_support/core_ext/string/output_safety"
+
 module Profiler
   module Middleware
     class ToolbarInjector
-      CLOSING_BODY_TAG = "</body>"
+      # The only characters HTML counts as white space between attributes (\s also takes \v).
+      WS = "[\\t\\n\\f\\r ]"
+      # Elements whose content the browser does not parse as markup: a </body> inside one of
+      # them is text, not the end of the page. Each maps to the end tag that closes it.
+      RAW_TEXT_ELEMENTS = %w[script style textarea title xmp iframe noembed noframes noscript]
+                          .to_h { |name| [name, %r{</#{name}(?=#{WS}|[/>])}i] }.freeze
+      # Never closed: whatever follows it is text.
+      PLAINTEXT = "plaintext"
+      # An attribute as the HTML tokenizer reads it: the name may start with = (or a quote),
+      # and a value only follows a name, after =. A quoted value may hold a > or a </body>.
+      ATTRIBUTE = %r{
+        [^\t\n\f\r\ />][^\t\n\f\r\ />=]*+
+        (?:#{WS}*+(?:=#{WS}*+(?:"[^"]*+"|'[^']*+'|[^\t\n\f\r\ >"'][^\t\n\f\r\ >]*+|(?=>))|(?!=)))
+      }x
+      # The rest of a tag, up to its >. A quoted value that is never closed fails the match,
+      # as does a tag without its >. Possessive, so that a failure costs no backtracking.
+      TAG_REST = %r{(?:#{WS}++|/|#{ATTRIBUTE})*+>}
+      # A whole start or end tag, read after its <: the slash and the name are captured.
+      TAG = %r{(/)?([a-z][^\t\n\f\r\ />]*+)#{TAG_REST}}i
 
       def initialize(body, token, nonce = nil)
         @body = body
@@ -13,9 +35,12 @@ module Profiler
 
       def inject
         content = extract_content(@body)
-        return @body unless content.include?(CLOSING_BODY_TAG)
+        # Bytes, so that a page that is not valid UTF-8 can still be scanned.
+        bytes = content.b
+        position = closing_body_position(bytes)
+        return @body unless position
 
-        injected_content = content.sub(CLOSING_BODY_TAG, toolbar_html + CLOSING_BODY_TAG)
+        injected_content = bytes.insert(position, toolbar_html.b).force_encoding(content.encoding)
 
         # Return as array for Rack compatibility
         [injected_content]
@@ -23,12 +48,70 @@ module Profiler
 
       private
 
+      # Byte offset of the </body> that closes the page: the last one outside comments, tags
+      # (an attribute value) and raw-text elements, where a page can carry the string
+      # "</body>" (a script building markup, a cached fragment in a final comment). nil when
+      # there is none, or when the page leaves a comment, a tag, a quoted value or a raw-text
+      # element open, or holds a <plaintext> or a double-escaped script: no toolbar rather than
+      # a toolbar in the wrong place.
+      def closing_body_position(bytes)
+        scanner = StringScanner.new(bytes)
+        position = nil
+
+        while scanner.skip_until(/</)
+          start = scanner.pos - 1
+
+          if scanner.skip(TAG)
+            name = scanner[2]
+            name = name.downcase if name.match?(/[A-Z]/)
+
+            if scanner[1]
+              position = start if name == "body"
+              next
+            end
+            return nil if name == PLAINTEXT
+            next unless (end_tag = RAW_TEXT_ELEMENTS[name])
+
+            text_start = scanner.pos
+            return nil unless scanner.skip_until(end_tag)
+            return nil if name == "script" && double_escaped?(bytes, text_start, scanner.pos - scanner.matched_size)
+            return nil unless scanner.skip(TAG_REST)
+          elsif scanner.match?(%r{/?[a-z]}i)
+            # A tag, or a quoted value in it, that is never closed.
+            return nil
+          elsif scanner.skip(/!--/)
+            # <!--> and <!---> are complete comments.
+            next if scanner.skip(/-?>/) || scanner.skip_until(/-->/)
+
+            return nil
+          elsif scanner.skip(/!\[CDATA\[/)
+            # A bogus comment up to the first > in HTML, a CDATA section up to ]]> in <svg> or
+            # <math>: go on only when both end at the same place.
+            return nil unless scanner.skip_until(/>/) && bytes.byteslice(scanner.pos - 3, 3) == "]]>"
+          elsif scanner.skip(%r{[!?/]})
+            # <!DOCTYPE>, <?xml ?>, </ not followed by a letter: a bogus comment, up to its >.
+            return nil unless scanner.skip_until(/>/)
+          end
+        end
+
+        position
+      end
+
+      # In a script, <!-- followed by <script enters a state where </script> does not close it.
+      # Only the script itself is searched, so that a page of many scripts is read in linear
+      # time.
+      def double_escaped?(bytes, from, to)
+        text = bytes.byteslice(from, to - from)
+        comment = text.index("<!--")
+        comment ? text.match?(%r{<script(?:#{WS}|[/>])}i, comment) : false
+      end
+
       def ajax_interceptor_script
         return "" unless Profiler.configuration.track_ajax
 
         <<~HTML
           <script#{nonce_attr}>
-            window.__PROFILER_PARENT_TOKEN__ = '#{@token}';
+            window.__PROFILER_PARENT_TOKEN__ = #{js_token};
           </script>
           <script#{nonce_attr}>
             #{ajax_interceptor_code}
@@ -63,15 +146,20 @@ module Profiler
         <<~HTML
           #{ajax_interceptor_script}
           <style>#{toolbar_styles}</style>
-          <div id="profiler-toolbar" class="profiler-root" data-token="#{@token}"></div>
+          <div id="profiler-toolbar" class="profiler-root" data-token="#{ERB::Util.html_escape(@token)}"></div>
           <button id="profiler-toolbar-toggle" class="profiler-root" title="Toggle profiler (Alt+P)"><span class="profiler-toggle-icon">&#9654;</span></button>
           <script#{nonce_attr}>(function(){var c=localStorage.getItem('profiler-toolbar-collapsed')==='true',t=localStorage.getItem('profiler-theme'),theme=t==='light'?'light':t==='dark'?'dark':(window.matchMedia('(prefers-color-scheme:light)').matches?'light':'dark'),el=document.getElementById('profiler-toolbar'),tog=document.getElementById('profiler-toolbar-toggle');if(c){el.style.cssText='animation:none!important;transform:translateX(calc(100% + 44px))';tog.dataset.collapsed='true';}el.setAttribute('data-theme',theme);tog.setAttribute('data-theme',theme);})();</script>
           <script src="/_profiler/assets/profiler-toolbar.js" defer#{nonce_attr}></script>
         HTML
       end
 
+      # The token as a JavaScript string literal that cannot close the <script> element.
+      def js_token
+        ERB::Util.json_escape(@token.to_s.to_json)
+      end
+
       def nonce_attr
-        @nonce ? " nonce=\"#{@nonce}\"" : ""
+        @nonce ? " nonce=\"#{ERB::Util.html_escape(@nonce)}\"" : ""
       end
 
       # Thermal design system — self-contained CSS for the injected toolbar.

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.11"
+  VERSION = "0.30.12"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.11
+  version: 0.30.12
 platform: ruby
 authors:
 - Sébastien Duplessy