rails-profiler 0.30.15 → 0.31.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2acc29c9f259551473810464771039fd61748d4387892bb42eda70cbe78648de
-  data.tar.gz: d47575f34e2dd8ad24e6290c2633a2a5d57e6591439eb954ce3d74f60ea17749
+  metadata.gz: 1c74753b10258047c15aafb6de0c2b5900bc16f01f4b499405b5b72d0d6d3b9e
+  data.tar.gz: 55ad17c8d51cf4eb8e2ed9ec3fd7158a15e23becba666b204b11d7b7c81f0e47
 SHA512:
-  metadata.gz: 784d7a77e084ffc3ffb1c4664f3e6519323146a1a40a1cd783b2144950ede1129702b1e32e4b5583449bc8786d438fcdf2b943730aecdc2d5c95bbc4944309f2
-  data.tar.gz: 0d9d5aa7631bfc6459a5f66a7f9f181093a4365c4459ac27423d378532fad2b6858586a3b565bf985719f60aedb3a75aab5a47b86bd28ff3bbf36ce5c1280366
+  metadata.gz: f1984f7c3ef795d9f318ddc33b64e964a8ed0171878fd913a927ad7c7d4479ba4523159598e75ddd3f52a8985bdaca9cb24bd49a8e0a0f6e1fbc025b904254ba
+  data.tar.gz: 855f08439f3cd174f3686150eed1f813b349e7591dd731b554941be172b9557ff835229268a3dce9605825e161b353a4456e444f1680ed239f40ebf1a6c37abc

data/CHANGELOG.md

@@ -19,6 +19,25 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.31.0] - 2026-10-05
+
+<!-- stamped -->
+
+### Added
+
+- **Cluster:** `config.cluster_allowed_slave_urls` accepts `Regexp` entries next to URLs, for
+  slaves whose names are not known in advance, such as one container per git worktree:
+  `[%r{\Ahttp://travel-api-[a-z0-9-]+:3000\z}]`. Until now such a setup had to fall back to
+  `:any`, which reopens the server-side request forgery closed in 0.30.11. A pattern must start
+  with `\A` and end with `\z`, and compile once wrapped to match the whole URL; any other `Regexp`
+  raises an `ArgumentError` when assigned. It is matched as a whole against the URL as the master
+  keeps it (lower-case scheme and host, no default port, no trailing slash), after the existing
+  checks, which it cannot lift: user info, a query, a fragment or a `.` or `..` segment are still
+  refused, and plain HTTP to a host that is not a loopback address still needs
+  `cluster_allow_insecure_http`. A `String` entry is always a URL, never a pattern. The default,
+  `[]`, still refuses every URL. A slave URL whose path segment decodes to a `\` is now refused
+  like one that decodes to a `/`.
+
 ## [0.30.15] - 2026-10-05
 
 <!-- stamped -->

data/lib/profiler/cluster/security.rb

@@ -82,11 +82,27 @@ module Profiler
 
           allowed = config.cluster_allowed_slave_urls
           return nil if allowed == :any
-          return nil if Array(allowed).any? { |entry| covers?(normalize(entry), target) }
+
+          registered = normalized_url(url)
+          return nil if Array(allowed).any? { |entry| entry_allows?(entry, target, registered) }
 
           "#{url} is not allowed by config.cluster_allowed_slave_urls"
         end
 
+        # Whether a Regexp entry of cluster_allowed_slave_urls is anchored at both ends: its source
+        # starts with \A and ends with an unescaped \z. \Z, ^ and $ do not count, since they let a
+        # trailing newline or another line through. A check of the written form, so that a pattern
+        # reads as what it does; the match itself is made whole by whole_url_pattern.
+        def anchored_pattern?(pattern)
+          return false unless pattern.is_a?(Regexp)
+
+          source = pattern.source
+          return false unless source.start_with?("\\A")
+
+          ending = source.match(/(\\+)z\z/)
+          !ending.nil? && ending[1].length.odd? && source.length > 4
+        end
+
         # Same transport rule for the master URL a slave sends its secret to.
         def master_url_denial(url)
           target = normalize(url)
@@ -139,6 +155,32 @@ module Profiler
           "#{path.inspect} is not a valid path"
         end
 
+        # One entry of cluster_allowed_slave_urls against a URL already through normalize and the
+        # transport rule. A Regexp is matched, as a whole, against the URL as the registry keeps it
+        # (normalized_url), and only when anchored; anything else is an URL compared by covers?,
+        # so a String is never read as a pattern.
+        def entry_allows?(entry, target, registered)
+          if entry.is_a?(Regexp)
+            return false unless registered && anchored_pattern?(entry)
+
+            whole_url_pattern(entry).match?(registered)
+          else
+            covers?(normalize(entry), target)
+          end
+        rescue RegexpError
+          false
+        end
+
+        # The pattern wrapped again in \A(?:...)\z, so that a top-level alternation (\Aa|b\z)
+        # cannot leave one branch anchored at a single end: this wrapping, not anchored_pattern?,
+        # is what makes the match cover the whole URL. Compiled once per pattern. Raises
+        # RegexpError when the wrapping does not compile, for instance when an x-mode comment
+        # swallows the closing \z.
+        def whole_url_pattern(pattern)
+          @whole_url_patterns ||= {}
+          @whole_url_patterns[pattern] ||= Regexp.new("\\A(?:#{pattern.source})\\z", pattern.options)
+        end
+
         # Scheme, host and port compared after normalization (case, default port, IPv6 brackets),
         # and a path prefix compared segment by segment.
         def covers?(entry, target)
@@ -149,8 +191,8 @@ module Profiler
         end
 
         # Returns { scheme:, host:, port:, segments: }, or nil for anything that is not a plain
-        # http(s) URL: user info, a query, a fragment, or a "." or ".." path segment are refused
-        # rather than interpreted.
+        # http(s) URL: user info, a query, a fragment, or a "." or ".." path segment, or one that
+        # decodes to a "/" or a "\\", are refused rather than interpreted.
         def normalize(url)
           uri = URI.parse(url.to_s.strip)
           return nil unless uri.is_a?(URI::HTTP) && uri.host && !uri.host.empty?
@@ -158,7 +200,7 @@ module Profiler
 
           segments = uri.path.to_s.split("/").reject(&:empty?)
           decoded = segments.map { |segment| URI.decode_www_form_component(segment) }
-          return nil if decoded.any? { |segment| segment == "." || segment == ".." || segment.include?("/") }
+          return nil if decoded.any? { |segment| segment == "." || segment == ".." || segment.match?(%r{[/\\]}) }
 
           { scheme: uri.scheme.downcase, host: uri.hostname.downcase, port: uri.port, segments: decoded }
         rescue URI::Error, ArgumentError

data/lib/profiler/configuration.rb

@@ -47,7 +47,7 @@ module Profiler
                   :name, :master_url, :self_url,
                   :cluster_heartbeat_interval, :cluster_offline_threshold,
                   :cluster_master, :cluster_secret, :cluster_require_secret,
-                  :cluster_allowed_slave_urls, :cluster_allow_insecure_http
+                  :cluster_allow_insecure_http
 
     attr_writer :tmp_path
 
@@ -117,6 +117,30 @@ module Profiler
       @tmp_path || default_tmp_path
     end
 
+    attr_reader :cluster_allowed_slave_urls
+
+    # :any, or a list of slave URLs and anchored Regexp patterns (see Profiler::Cluster::Security).
+    # A Regexp that is not anchored with \A and \z is refused here, at boot, rather than ignored.
+    def cluster_allowed_slave_urls=(value)
+      unless value == :any
+        require_relative "cluster/security"
+        Array(value).grep(Regexp).each do |pattern|
+          unless Profiler::Cluster::Security.anchored_pattern?(pattern)
+            raise ArgumentError, "config.cluster_allowed_slave_urls: #{pattern.inspect} must start with \\A and " \
+                                 "end with \\z, so that it matches the whole slave URL"
+          end
+
+          begin
+            Profiler::Cluster::Security.whole_url_pattern(pattern)
+          rescue RegexpError => e
+            raise ArgumentError, "config.cluster_allowed_slave_urls: #{pattern.inspect} cannot be matched against " \
+                                 "the whole slave URL (#{e.message}); an x-mode comment must not hide the \\z"
+          end
+        end
+      end
+      @cluster_allowed_slave_urls = value
+    end
+
     def enabled=(value)
       @assigned |= [:enabled]
       @enabled = value

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.15"
+  VERSION = "0.31.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.15
+  version: 0.31.0
 platform: ruby
 authors:
 - Sébastien Duplessy