rails-profiler 0.30.4 → 0.30.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2940fc44efea04a648f7bba562f2fc19be1639d996525e9d08483ef7093baa16
-  data.tar.gz: 1b9f6534d20625950aef62f906319942d7327ea609649aef00b70ba88c9b17ce
+  metadata.gz: e7a2ea61f4463670763c8c3c2d92f98a1f4ff2917fb9a2f5e0d245ea1860d2f1
+  data.tar.gz: ba467072b67f027565a29c99f458cd959933de512cdfa054ddde052d3e65ddb1
 SHA512:
-  metadata.gz: 6ce1584ab5b3d70a6262d205cfbd0e4876d29e89b3766efde13fe345966734c20f6a73df1fe1e14b71f7b8af5c588b04e02c7e9a8b16a0f00c902ff8f5a55aa6
-  data.tar.gz: 6e02c794a279605d81ac11c5f31f099378af2d82c967e757bf571ce2ff27ec7ca3f7c342f7e90cca628c5a406c253b0f0252971a723d0c4970db86ec35bd5c4e
+  metadata.gz: b2a1049428bab86d06ba54bba7cd373bfc3ebe606137bd2e6bfda46d5b1501c10574ebcec632125efd9e5c6b6a0be2d11c763b15e670a06aaaac384c0e028c6e
+  data.tar.gz: 561590eb7eadc20139ea79a0005efefbf9de88da0010db4ae20903360d3199342ba9648fe9d6d4bc1452c62e18c61f47311f19bb78f68a3307791f3089a11f06

data/CHANGELOG.md

@@ -0,0 +1,445 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+Write your entry under `[Unreleased]`, for a user of the gem. When your branch is
+ready, run `bin/changelog stamp`: it works out the version the merge will publish
+and turns `[Unreleased]` into `[X.Y.Z] - <date>`, reopening an empty one above.
+Run it again after a rebase or a new commit, it corrects the number and folds the
+new entries in. Never edit a section that already carries a tag.
+
+A section written by `stamp` carries `<!-- stamped -->`. In the older sections,
+each bullet carries the short sha of the commit it describes, and commits left out
+on purpose are listed in that version's `excluded:` comment with the reason; all of
+it in HTML comments, invisible once rendered. `bin/changelog coverage` checks that
+every commit of every tag interval is accounted for one way or the other.
+
+## [Unreleased]
+
+## [0.30.6] - 2026-10-03
+
+<!-- stamped -->
+
+### Security
+
+- **Access control:** Check `authorization_mode` on every page and endpoint of the profiler (UI,
+  API, server-sent events, test runner, toolbar), answering `403` otherwise. It used to decide only
+  which requests were captured: with `:allow_authorized` and a block that refused everybody, the API
+  still listed and deleted profiles and wrote `ENV`. The gem's static JS and CSS stay public.
+- **Access control:** The new default `authorization_mode`, `:allow_local`, only lets in requests
+  made from this machine: a loopback `REMOTE_ADDR`, no forwarding header naming a remote client, and
+  a local `Host` (or one listed in `config.hosts`), against DNS rebinding; the test environment
+  also accepts the reserved hosts `www.example.com`, `example.com` and `example.org`, so the
+  application's request specs are still captured. It also decides
+  which requests are captured, and logs the reason for a refusal once per process. The previous
+  default, `:allow_all`, let anybody who could reach the application read and change everything.
+- **Access control:** API requests that change something (including a form `POST` turned into
+  another verb by `_method`) must carry an `X-Profiler-Request` header or a CSRF token, so that a
+  page on another site can no longer trigger them, even when the application turns
+  `allow_forgery_protection` off. The dashboard, the toolbar and the cluster send the header.
+- **Access control:** CORS is off by default (`extension_cors_enabled = false`,
+  `cors_allowed_origins = []`), and `Access-Control-Allow-Origin: *` is never sent to a request
+  carrying a cookie or an `Authorization` header. It used to be `*` for everybody.
+- **Access control:** Profiler pages may only be framed by the profiler itself and by the Chrome
+  extension's DevTools panel (`frame-ancestors 'self' chrome-extension: devtools:`, configurable
+  with the new `frame_ancestors` option), and send `X-Frame-Options: SAMEORIGIN`. Any website could
+  frame them, and with `?embed=true` a profile page carried no framing protection at all.
+- **Upgrading:** Nothing to do when you browse the profiler from the machine that runs Rails. Each
+  previous behavior can be restored in `config/initializers/profiler.rb`:
+  - Docker, a VM or a remote proxy: admit your network with `config.authorization_mode =
+    :allow_authorized` and an `authorize_with` block reading `REMOTE_ADDR` (example in the README), or
+    go back to `config.authorization_mode = :allow_all`, which offers no protection.
+  - A cluster whose master and slaves run on different machines: each side admits the other's address
+    the same way.
+  - Your own scripts calling the API: send `X-Profiler-Request: 1`, or set
+    `config.api_forgery_protection = false`.
+  - Cross-origin clients: `config.extension_cors_enabled = true` and
+    `config.cors_allowed_origins = ["https://your.origin"]`. `["*"]` restores the behavior before
+    0.30.6 and reopens the profiler to every website you visit: under `:allow_local` or `:allow_all`,
+    any page open in your browser can read its data and change it.
+  - Framing by other sites: `config.frame_ancestors = ["'self'", "http:", "https:"]`.
+
+## [0.30.5] - 2026-10-03
+
+<!-- stamped -->
+
+### Fixed
+
+- **Instrumentation:** Pass the arguments of `Thread.new` on to its block, and keep keyword
+  arguments as keywords. While a profile was being collected the block got none at all, which on
+  Ruby 3.4 broke the Happy Eyeballs hostname resolution of `Socket.tcp`: connections by hostname
+  timed out, for example as `Redis::CannotConnectError`. Keyword arguments were flattened at all
+  times, on every Ruby. Affects v0.22.1 through v0.30.4.
+- **Instrumentation:** Raise `ThreadError` on a `Thread.new` with no block during a profiled
+  request, as Ruby does.
+
+## [0.30.4] - 2026-07-01
+
+### Fixed
+
+- **Cluster:** Resolve profiles across slaves from the master `ProfilesController` <!-- 9236c4c -->
+
+## [0.30.3] - 2026-06-29
+
+### Fixed
+
+- Wrap the profile dashboards and `TestRunnerPage` with `QueryClientProvider` <!-- 420ae2f -->
+
+## [0.30.2] - 2026-06-29
+
+### Fixed
+
+- **Middleware:** Duplicate downstream headers before mutating them <!-- 3efb20c -->
+
+## [0.30.1] - 2026-06-29
+
+### Fixed
+
+- **Cluster:** Fix sentinel mismatch, profile list pagination, nil safety in MCP tools and HTTPS slave URLs <!-- 4b5fb1c -->
+
+## [0.30.0] - 2026-06-28
+
+### Added
+
+- **Cluster:** Add master/slave profiler clustering <!-- 1435f22 -->
+
+## [0.29.0] - 2026-06-28
+
+### Added
+
+- **SSE:** Push live profile updates over server-sent events <!-- fa0ae2e -->
+
+## [0.28.0] - 2026-06-06
+
+### Added
+
+- **HTTP:** Add the `http_backtrace_depth` configuration option <!-- 25b4f99 -->
+
+## [0.27.1] - 2026-06-06
+
+### Changed
+
+- **API:** Replace manual `fetch()` calls with `orval` generated TanStack Query hooks <!-- e33341e -->
+
+### Fixed
+
+- **File store:** Prevent `ENOENT` errors on concurrent profile file deletion <!-- 8898f0e -->
+
+## [0.27.0] - 2026-06-02
+
+### Added
+
+- **MCP:** Add console profiling, mailer detail, logs/env/i18n sections and full documentation <!-- ca362a1 -->
+
+## [0.26.0] - 2026-06-02
+
+### Added
+
+- **Test profiler:** Add the `run_tests` MCP tool, the `track_tests` option, specs and docs <!-- 265ce03 -->
+- **Test profiler:** Enrich reporter, add SSE streaming, MCP tools and env safety <!-- a410c4b -->
+- **Test profiler:** Add test profiling, test runner UI and MCP tool <!-- a116fcb -->
+
+## [0.25.0] - 2026-06-01
+
+### Added
+
+- **Console:** Add a console profiling tab with IRB instrumentation <!-- f29937a -->
+
+### Changed
+
+- **Docs:** Document the console profiling tab and the env override behaviour <!-- 031cac6 -->
+
+<!-- excluded:
+  bd55e9b specs only, no visible change
+-->
+
+## [0.24.0] - 2026-06-01
+
+### Added
+
+- **MCP:** Add tools to manage `ENV` variables <!-- 9126194 -->
+
+## [0.23.0] - 2026-05-27
+
+### Added
+
+- **Profile list:** Add a global clear-all button and auto-refresh on tab switch <!-- 460a110 -->
+
+## [0.22.1] - 2026-05-26
+
+### Fixed
+
+- **HTTP:** Propagate collector to child threads, add fire-and-forget support, fix deep backtrace capture <!-- 9d0bd61 -->
+
+## [0.22.0] - 2026-05-04
+
+### Added
+
+- **Mailer:** Add a body preview, a variables display, a queued badge and design alignment <!-- b7d608f -->
+- **Collector:** Implement `MailerCollector`, tracking ActionMailer deliveries <!-- e59dd72 -->
+
+### Changed
+
+- **Toolbar:** Remove the emoji from the mailer toolbar item and the dashboard tab <!-- 55df9bb -->
+
+### Fixed
+
+- **Mailer:** Add the Mailers tab to `JobProfileDashboard` <!-- 4ce145d -->
+- **Mailer:** Fix thread isolation and `deliver_later` mode detection <!-- 6e76a99 -->
+- **Mailer:** Add `MailerCollector` to the job profiler and align the toolbar item design <!-- 915be28 -->
+- **Mailer:** Handle the Rails 7 encoded mail string in the `deliver.action_mailer` payload <!-- 5479dcf -->
+- **Mailer:** Replace `Thread.current.delete` with a read and nil write for fiber local variables <!-- 8787201 -->
+- **Version:** Remove the pre-release suffix, which broke Bundler resolution <!-- 98caecd -->
+- **Mailer:** Address code review findings from MR !32 <!-- b46d3d2 -->
+
+## [0.21.0] - 2026-05-02
+
+### Added
+
+- **Toolbar:** Add a collapse/expand toggle <!-- 8f0669a -->
+
+## [0.20.0] - 2026-05-01
+
+### Added
+
+- **UI:** Display the gem version and warn on a mismatch <!-- 64ff6eb -->
+
+## [0.19.2] - 2026-04-24
+
+### Fixed
+
+- **HTTP:** Capture `RestClient` `body_stream`, remove body size limits, show bodies in MCP tool results <!-- 89fb0e5 -->
+
+<!-- excluded:
+  4527e12 release plumbing, version placeholder reset
+-->
+
+## [0.19.1] - 2026-04-17
+
+### Fixed
+
+- **Env vars:** Fix revert restoring wrong value, SQLite busy errors, middleware rescue handling and UI refresh <!-- 55c8661 -->
+
+<!-- excluded:
+  4637391 pipeline only
+  b53b4d7 pipeline only
+  7b33bf6 pipeline only
+-->
+
+## [0.19.0] - 2026-04-15
+
+### Added
+
+- **Env:** Propagate env var overrides to Sidekiq workers <!-- e75a883 -->
+
+## [0.18.0] - 2026-04-14
+
+### Changed
+
+- **UI:** Extract shared tab utilities and redesign the Request tab <!-- 7aa8adb -->
+
+### Fixed
+
+- **HTTP:** Capture outbound request body passed as second argument to `http.request()` <!-- 5a59665 -->
+
+## [0.17.0] - 2026-04-13
+
+### Added
+
+- **Dashboard:** Add env tab on the home page and env/job toolbar items <!-- d0277ab -->
+
+## [0.16.0] - 2026-04-13
+
+### Added
+
+- **Function profiler:** Add `stackprof` sampling mode with multi-clock support and GC visibility <!-- 5f73512 -->
+
+### Fixed
+
+- **Function profiler:** Fix `stackprof` bugs, remove minimal mode, improve performance <!-- 76c6197 -->
+
+## [0.15.0] - 2026-04-11
+
+### Added
+
+- **Env:** Add environment variables tab <!-- 0e85f18 -->
+
+## [0.14.0] - 2026-04-09
+
+### Added
+
+- **Profiler:** Link jobs to their triggering request or parent job <!-- 74ba5e3 -->
+
+## [0.13.0] - 2026-04-09
+
+### Added
+
+- **UI:** Add copy/download buttons on HTTP bodies, waterfall view, date sort, and other UX improvements <!-- 5afd003 -->
+- **UI:** Always show waterfall above the HTTP request list <!-- 32c6b6d -->
+- **UI:** Use `SmartBodyPreview` in RequestTab for copy/download on request and response bodies <!-- aef4c0c -->
+
+### Fixed
+
+- **UI:** Derive download file extension from actual MIME type instead of body category <!-- 1dc0bc8 -->
+- **UI:** Move `sortedJobs` after `filteredJobs` to fix TDZ error <!-- d4de7bc -->
+
+## [0.12.0] - 2026-04-09
+
+### Added
+
+- **Profiler:** Add function-level profiling with flamegraph and stats table <!-- fcb04a6 -->
+
+## [0.11.1] - 2026-04-09
+
+### Added
+
+- **Config:** Add `tmp_path` option to centralize the storage directory <!-- 5e77944 -->
+
+### Fixed
+
+- **MCP:** Decompress gzip+base64 bodies before returning to UI and MCP tool results <!-- 8f5ac47 -->
+
+## [0.11.0] - 2026-04-06
+
+### Added
+
+- **UI:** Add load-more pagination to the profile list <!-- 9f8458b -->
+
+## [0.10.1] - 2026-04-06
+
+### Changed
+
+- **Docs:** Add full user documentation, with a UI guide, an MCP guide and screenshots <!-- 80a9198 -->
+
+## [0.10.0] - 2026-04-06
+
+### Added
+
+- **Middleware:** Add configurable CORS origins, CSP nonce support and body compression <!-- 3a42188 -->
+
+## [0.9.1] - 2026-04-06
+
+### Removed
+
+- **Collectors:** Remove `PerformanceCollector`, replaced by `FlameGraphCollector` <!-- 212e155 -->
+
+## [0.9.0] - 2026-04-06
+
+### Added
+
+- **Profiler:** Add the `Profiler.measure` custom instrumentation API <!-- 0a3044e -->
+
+## [0.8.0] - 2026-04-05
+
+### Added
+
+- **UI:** Add sortable columns, quick filter presets and flamegraph search <!-- ffd2e6f -->
+
+## [0.7.0] - 2026-04-05
+
+### Added
+
+- **Database:** Add N+1 visual detection and `EXPLAIN ANALYZE` integration <!-- a22902d -->
+
+## [0.6.0] - 2026-04-05
+
+### Added
+
+- **MCP:** Reduce token usage with filtering, body file saving and pagination <!-- 834251d -->
+
+## [0.5.0] - 2026-04-04
+
+### Added
+
+- **MCP:** Add outbound IDs, a domain filter, datetimes, a latest token, exceptions and copy helpers <!-- 9330545 -->
+
+## [0.4.0] - 2026-04-03
+
+### Added
+
+- **Collector:** Add an I18n panel tracking translation lookups per request <!-- 3032a15 -->
+
+<!-- excluded:
+  b50d1eb pipeline only
+-->
+
+## [0.3.0] - 2026-04-02
+
+### Added
+
+- **Collector:** Add a routes panel and enrich the request collector <!-- bdf0e3c -->
+
+## [0.2.0] - 2026-03-29
+
+### Added
+
+- **Collector:** Add a Logs panel, capturing `Rails.logger` messages per request <!-- 0e0e7ce -->
+- Publish the gem to RubyGems.org <!-- f292a21 -->
+
+<!-- excluded:
+  10c1314 pipeline only, despite the fix: type
+  3f97b1d pipeline only
+  a8c2044 pipeline only
+  27cc550 pipeline only
+-->
+
+## [0.1.4] - 2026-03-29
+
+### Added
+
+- **Profiler:** Capture the full request and response, and add an MCP history clear <!-- 9922c8a -->
+
+## [0.1.3] - 2026-03-29
+
+### Changed
+
+- **Assets:** Migrate Sass `@import` to `@use`, which removes the build deprecation warnings <!-- 1a67e48 -->
+
+## [0.1.2] - 2026-03-25
+
+This tag holds nothing but the release commit the pipeline wrote. The interval
+carries no change to the gem, so there is nothing to report for this version.
+
+## [0.1.1] - 2026-03-25
+
+### Added
+
+- **HTTP:** Decompress gzip and deflate response bodies before storing them <!-- f71a5c7 -->
+- **Flamegraph:** Add an interactive flame graph tab <!-- 63c4b67 -->
+- **Config:** Add `.well-known` and `favicon.ico` to the default `skip_paths` <!-- 1286447 -->
+- **Storage:** Add an SQLite backend, a blob store and delete/clear APIs <!-- 544015b -->
+- **UI:** Add filters to the profile list action bar and fix the badge colours <!-- 40d4081 -->
+- **HTTP:** Add binary download, inline preview and smart text formatting <!-- b09eab8 -->
+- Rename the HTTP tab, add the outbound HTTP list and extend MCP coverage <!-- 71bc537 -->
+- **Jobs:** Add background job profiling for Sidekiq and ActiveJob <!-- 27b87db -->
+- Add an outbound HTTP request collector <!-- e5f2ac9 -->
+- **MCP:** Migrate to the official Ruby SDK, over HTTP transport <!-- 3fc2d45 -->
+- Implement the dashboard UI, with a tab system and a design system <!-- beb83f7 -->
+- Add the AJAX and dump collectors, and the CORS middleware <!-- 08bad9f -->
+- First implementation of the gem <!-- 360c6fa -->
+
+### Changed
+
+- **Docs:** Document installation from the GitLab Package Registry <!-- 527c32b -->
+- **Assets:** Serve every gem asset exclusively under `/_profiler/` <!-- e8ae1ae -->
+- **Config:** Add `manifest.json` to the default `skip_paths` <!-- 350f16c -->
+- **Docs:** Correct the installation instructions in the README and remove the dashboard README <!-- e44c8a2 -->
+
+### Fixed
+
+- **Packaging:** Fix the gemspec metadata and file glob, and exclude source assets <!-- 195b609 -->
+- **Packaging:** Switch to the yarn build scripts and update dependencies <!-- b62f2d8 -->
+- **Packaging:** Fix the `http_collector` require, the collectors option override and asset serving in API only applications <!-- 729f20f -->
+- **Packaging:** Exclude `.gem` build artifacts from the file list <!-- 9b97f60 -->
+- **Profiler:** Improve memory tracking and profile deserialisation <!-- a0af47e -->
+
+<!-- excluded:
+  e27cdae pipeline only
+  02d63c9 pipeline only
+  9f598d9 subject is not conventional, tooling only
+  7d1d823 tests only
+  c0d46e6 licence file, not a change to the gem
+-->

data/app/assets/builds/profiler-toolbar.js

@@ -4167,10 +4167,11 @@
     const { method, params, data, headers = {}, signal } = config;
     const url = resolvedUrl;
     const qs = params ? "?" + new URLSearchParams(Object.entries(params).map(([k3, v3]) => [k3, String(v3)])).toString() : "";
+    const baseHeaders = { "X-Profiler-Request": "1", ...headers };
     const res = await fetch(url + qs, {
       method,
       signal,
-      headers: data !== void 0 ? { "Content-Type": "application/json", ...headers } : headers,
+      headers: data !== void 0 ? { "Content-Type": "application/json", ...baseHeaders } : baseHeaders,
       body: data !== void 0 ? JSON.stringify(data) : void 0
     });
     if (res.status === 204) return {};

data/app/assets/builds/profiler.js

@@ -3456,10 +3456,11 @@
     const { method, params, data, headers = {}, signal } = config;
     const url = resolvedUrl;
     const qs = params ? "?" + new URLSearchParams(Object.entries(params).map(([k3, v3]) => [k3, String(v3)])).toString() : "";
+    const baseHeaders = { "X-Profiler-Request": "1", ...headers };
     const res = await fetch(url + qs, {
       method,
       signal,
-      headers: data !== void 0 ? { "Content-Type": "application/json", ...headers } : headers,
+      headers: data !== void 0 ? { "Content-Type": "application/json", ...baseHeaders } : baseHeaders,
       body: data !== void 0 ? JSON.stringify(data) : void 0
     });
     if (res.status === 204) return {};

data/app/controllers/profiler/api/ajax_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class AjaxController < ApplicationController
-      skip_before_action :verify_authenticity_token, only: [:link]
-
       def link
         parent_token = params[:parent_token]
         child_token = params[:child_token]

data/app/controllers/profiler/api/cluster_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ClusterController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def register
         name = params[:name].to_s
         url  = params[:url].to_s

data/app/controllers/profiler/api/console_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ConsoleController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class EnvVarsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def show
         variables = ENV.to_h.sort.to_h
         overrides = Profiler.env_override_store.all_overrides

data/app/controllers/profiler/api/events_controller.rb

@@ -4,7 +4,6 @@ module Profiler
   module Api
     class EventsController < Profiler::ApplicationController
       include ActionController::Live
-      skip_before_action :verify_authenticity_token
 
       def subscribe
         response.headers["Content-Type"]      = "text/event-stream"

data/app/controllers/profiler/api/explain_controller.rb

@@ -5,8 +5,6 @@ require "profiler/explain_runner"
 module Profiler
   module Api
     class ExplainController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def create
         unless Profiler.configuration.enabled
           return render json: { error: "EXPLAIN is only available when the profiler is enabled" }, status: :forbidden

data/app/controllers/profiler/api/function_profiling_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class FunctionProfilingController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def show
         render json: {
           enabled:    Profiler.function_profiling_enabled,

data/app/controllers/profiler/api/jobs_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class JobsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/outbound_http_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class OutboundHttpController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       # GET /_profiler/api/outbound_http
       def index
         limit = (params[:limit] || 200).to_i

data/app/controllers/profiler/api/profiles_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ProfilesController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/slave_proxy_controller.rb

@@ -5,8 +5,6 @@ require_relative "../../../../lib/profiler/cluster/slave_proxy"
 module Profiler
   module Api
     class SlaveProxyController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def forward
         proxy = Cluster::SlaveProxy.new(params[:slave_name])
         sub_path = params[:path].to_s

data/app/controllers/profiler/api/test_runner_controller.rb

@@ -8,8 +8,6 @@ module Profiler
     class TestRunnerController < ApplicationController
       include ActionController::Live
 
-      skip_before_action :verify_authenticity_token
-
       def files
         framework = params[:framework]
         tree = Profiler::TestRunner::Discovery.files(framework: framework)

data/app/controllers/profiler/api/tests_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class TestsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/toolbar_controller.rb

@@ -3,7 +3,6 @@
 module Profiler
   module Api
     class ToolbarController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
       skip_before_action :check_authorization
 
       def show

data/app/controllers/profiler/application_controller.rb

@@ -2,11 +2,12 @@
 
 module Profiler
   class ApplicationController < ActionController::Base
-    protect_from_forgery with: :exception
-
     layout "profiler/application"
 
     before_action :check_authorization
+    before_action :authorize_request
+    # Declared after the access checks, so that an unauthorized request gets its 403 first.
+    protect_from_forgery with: :exception
 
     private
 
@@ -16,6 +17,36 @@ module Profiler
       end
     end
 
+    def authorize_request
+      return if Profiler.configuration.authorized?(request)
+
+      deny("Not authorized to access the profiler")
+    end
+
+    # Decided by the profiler's own setting, not by the application's allow_forgery_protection,
+    # which the config/environments/test.rb generated by Rails turns off.
+    def protect_against_forgery?
+      Profiler.configuration.api_forgery_protection ? true : false
+    end
+
+    # Rails' token, or the header every profiler client sends. A third-party page cannot add a
+    # custom header without a CORS preflight, which is refused unless an origin was allowed.
+    def verified_request?
+      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present?
+    end
+
+    def handle_unverified_request
+      deny("Missing #{Profiler::FORGERY_PROTECTION_HEADER} header or CSRF token")
+    end
+
+    def deny(message)
+      if controller_path.start_with?("profiler/api/")
+        render json: { error: message }, status: :forbidden
+      else
+        render plain: message, status: :forbidden
+      end
+    end
+
     def build_child_jobs(profile)
       storage = @resolved_storage || Profiler.storage
       storage.find_by_parent(profile.token)

data/app/controllers/profiler/assets_controller.rb

@@ -2,8 +2,11 @@
 
 module Profiler
   class AssetsController < ApplicationController
+    # The gem's own static JS and CSS: no application data, cached publicly. Every piece of
+    # data they display comes from the API, which keeps the authorization check.
     skip_before_action :verify_authenticity_token
     skip_before_action :check_authorization
+    skip_before_action :authorize_request
 
     def toolbar_js
       path = Profiler::Engine.root.join("app", "assets", "builds", "profiler-toolbar.js")

data/app/controllers/profiler/profiles_controller.rb

@@ -2,8 +2,6 @@
 
 module Profiler
   class ProfilesController < ApplicationController
-    before_action :allow_iframe_embedding, only: [:show], if: -> { params[:embed] == "true" }
-
     def index
       limit = params[:limit]&.to_i || 50
       offset = params[:offset]&.to_i || 0
@@ -158,13 +156,6 @@ module Profiler
       end
     end
 
-    def allow_iframe_embedding
-      response.headers.delete('X-Frame-Options')
-      # Don't set frame-ancestors CSP to allow Chrome extensions to embed
-      # Mark that CSP should not be set by middleware
-      request.env['profiler.skip_csp'] = true
-    end
-
     def filter_profiles(profiles)
       filtered = profiles
 

data/lib/profiler/cluster/master_client.rb

@@ -24,7 +24,8 @@ module Profiler
         config = Profiler.configuration
         uri = URI("#{config.master_url}/_profiler/api/cluster/register")
         body = { name: config.resolved_name, url: config.self_url }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json")
+        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
+                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
         unless resp.code.to_i.between?(200, 299)
           raise "Master returned #{resp.code}: #{resp.body.to_s.slice(0, 200)}"
         end
@@ -36,7 +37,8 @@ module Profiler
         config = Profiler.configuration
         uri = URI("#{config.master_url}/_profiler/api/cluster/heartbeat")
         body = { name: config.resolved_name }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json")
+        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
+                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
         raise "Heartbeat rejected #{resp.code}" unless resp.code.to_i.between?(200, 299)
       end
 

data/lib/profiler/cluster/slave_proxy.rb

@@ -86,6 +86,7 @@ module Profiler
       end
 
       def request(uri, req)
+        req[Profiler::FORGERY_PROTECTION_HEADER] = "1"
         resp = Net::HTTP.start(uri.hostname, uri.port,
                                open_timeout: @open_timeout, read_timeout: @read_timeout,
                                use_ssl: uri.scheme == "https") do |http|

data/lib/profiler/configuration.rb

@@ -1,13 +1,20 @@
 # frozen_string_literal: true
 
+require_relative "local_request"
+
 module Profiler
+  # Header the profiler's own clients send on every request. A page on another origin cannot
+  # add it without a CORS preflight, which the profiler does not grant by default, so its
+  # presence proves the request is not a cross-site forgery.
+  FORGERY_PROTECTION_HEADER = "X-Profiler-Request"
+
   class Configuration
     attr_accessor :enabled, :storage_options, :collectors,
                   :skip_paths, :slow_query_threshold, :max_queries_warning,
                   :track_memory, :memory_warning_threshold,
                   :mcp_enabled, :mcp_transport, :mcp_port,
                   :authorization_mode, :max_profiles, :extension_cors_enabled,
-                  :cors_allowed_origins,
+                  :cors_allowed_origins, :api_forgery_protection, :frame_ancestors,
                   :track_ajax, :ajax_skip_paths,
                   :track_http, :slow_http_threshold, :http_skip_hosts, :http_backtrace_depth,
                   :track_jobs,
@@ -35,11 +42,16 @@ module Profiler
       @mcp_enabled = false
       @mcp_transport = :stdio
       @mcp_port = 3001
-      @authorization_mode = :allow_all
+      @authorization_mode = :allow_local
       @authorize_block = nil
       @max_profiles = 100
-      @extension_cors_enabled = true
-      @cors_allowed_origins = ["*"]
+      @extension_cors_enabled = false
+      @cors_allowed_origins = []
+      @api_forgery_protection = true
+      # The Chrome extension shows the profiler in a DevTools panel: an iframe inside a
+      # chrome-extension:// page, itself inside the devtools://devtools front end. Chrome
+      # checks frame-ancestors against every ancestor, so both schemes are needed.
+      @frame_ancestors = ["'self'", "chrome-extension:", "devtools:"]
       @track_ajax = true
       @ajax_skip_paths = [/^\/_profiler/]
       @track_http = true
@@ -87,6 +99,12 @@ module Profiler
       case @authorization_mode
       when :allow_all
         true
+      when :allow_local
+        reason = LocalRequest.denial_reason(request)
+        return true if reason.nil?
+
+        LocalRequest.warn_once(reason)
+        false
       when :allow_authorized
         @authorize_block ? @authorize_block.call(request) : false
       else

data/lib/profiler/instrumentation/thread_context_propagation.rb

@@ -9,24 +9,39 @@ module Profiler
       ].freeze
 
       def initialize(*args, &block)
+        # Ruby refuses a Thread with no block, and the wrapper below is a block, so
+        # without this the error would never come while a profile is being collected.
+        return super if block.nil?
+
         parent_context = PROPAGATED_KEYS.filter_map do |key|
           val = Thread.current[key]
           [key, val] unless val.nil?
         end.to_h
 
-        if parent_context.empty?
-          super
-        else
-          super(*args) do
-            parent_context.each { |k, v| Thread.current[k] = v }
-            begin
-              block&.call
-            ensure
-              PROPAGATED_KEYS.each { |k| Thread.current[k] = nil }
-            end
+        return super if parent_context.empty?
+
+        # Thread.new hands its arguments to the block, so the wrapper has to take
+        # them and pass them on. Ruby 3.4 depends on it in the stdlib: the Happy
+        # Eyeballs hostname resolution of Socket.tcp runs
+        #   Thread.new(*thread_args) { |*thread_args| resolve_hostname(*thread_args) }
+        # and a wrapper that swallows the arguments leaves the name unresolved.
+        # The wrapper is a named proc rather than a literal block because only a
+        # proc can be given the ruby2_keywords flag, which, together with the one
+        # on this method, keeps a trailing keyword hash a keyword hash rather than
+        # flattening it into a positional argument.
+        wrapper = proc do |*block_args|
+          parent_context.each { |k, v| Thread.current[k] = v }
+          begin
+            block&.call(*block_args)
+          ensure
+            PROPAGATED_KEYS.each { |k| Thread.current[k] = nil }
           end
         end
+        wrapper.ruby2_keywords
+
+        super(*args, &wrapper)
       end
+      ruby2_keywords :initialize
     end
   end
 end

data/lib/profiler/local_request.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Profiler
+  # Decides whether a request comes from this machine, for authorization_mode :allow_local.
+  #
+  # The client address is read from REMOTE_ADDR only. Forwarding headers (X-Forwarded-For,
+  # X-Real-IP, Forwarded, X-Forwarded-Host) can be forged, so they never grant access: they
+  # can only refuse it, when a local reverse proxy reports a remote client. The Host header
+  # has to be a local name, or one the application allows in config.hosts, which defeats DNS
+  # rebinding: a rebound page reaches 127.0.0.1 under the attacker's own domain name. The
+  # test environment also accepts the default hosts of rack-test and of Rails integration
+  # tests, reserved names (RFC 2606) that no attacker can point at a server of his own.
+  module LocalRequest
+    FORWARDING_HEADERS = {
+      "HTTP_X_FORWARDED_FOR" => "X-Forwarded-For",
+      "HTTP_X_REAL_IP" => "X-Real-IP",
+      "HTTP_FORWARDED" => "Forwarded"
+    }.freeze
+
+    TEST_HOSTS = %w[www.example.com example.com example.org].freeze
+
+    @warned = false
+    @warn_mutex = Mutex.new
+
+    class << self
+      # Returns nil when the request is local, otherwise a sentence naming the cause.
+      def denial_reason(request)
+        remote_addr = request.get_header("REMOTE_ADDR").to_s
+        unless loopback_address?(remote_addr)
+          return "REMOTE_ADDR #{remote_addr.empty? ? "(missing)" : remote_addr} is not a loopback address"
+        end
+
+        FORWARDING_HEADERS.each do |key, name|
+          value = request.get_header(key)
+          next if value.nil? || value.empty?
+
+          nodes = key == "HTTP_FORWARDED" ? forwarded_param(value, "for") : value.split(",")
+          remote = nodes.map { |node| strip_port(node) }.find { |address| !loopback_address?(address) }
+          return "the #{name} header reports a non-local client (#{remote})" if remote
+        end
+
+        host_denial_reason(request)
+      end
+
+      def local?(request)
+        denial_reason(request).nil?
+      end
+
+      # Logs why a request was refused, once per process, so that an application running in
+      # Docker does not just stop being profiled with no explanation.
+      def warn_once(reason)
+        @warn_mutex.synchronize do
+          return if @warned
+
+          @warned = true
+        end
+
+        message = "[Profiler] Request refused or not profiled by authorization_mode :allow_local: #{reason}. " \
+                  "The profiler only serves and captures requests made from this machine. " \
+                  "If the application runs in Docker or behind a remote proxy, either set " \
+                  "config.authorization_mode = :allow_authorized with a config.authorize_with block " \
+                  "that admits your network (see the Access control section of the README), or set " \
+                  "config.authorization_mode = :allow_all, which offers no protection at all. " \
+                  "This message is logged once per process."
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger.warn(message)
+        else
+          warn(message)
+        end
+      end
+
+      def reset_warning!
+        @warn_mutex.synchronize { @warned = false }
+      end
+
+      def loopback_address?(value)
+        address = value.to_s.strip
+        address = address[1..-2] if address.start_with?("[") && address.end_with?("]")
+        # Only an IPv6 address carries a zone identifier ("fe80::1%eth0").
+        address = address.sub(/%.*\z/, "") if address.include?(":")
+        return false if address.empty?
+
+        ip = IPAddr.new(address)
+        ip = ip.native if ip.ipv6? && ip.ipv4_mapped?
+        ip.loopback?
+      rescue IPAddr::Error
+        false
+      end
+
+      private
+
+      def host_denial_reason(request)
+        # A request with no Host header does not come from a browser, so it cannot be a
+        # rebound page; REMOTE_ADDR alone decides.
+        raw_host = request.get_header("HTTP_HOST").to_s
+        unless raw_host.empty?
+          host = host_name(raw_host)
+          return "the Host header #{host.inspect} is not a local name" unless allowed_host?(host)
+        end
+
+        forwarded_hosts = request.get_header("HTTP_X_FORWARDED_HOST").to_s.split(",")
+        remote = forwarded_hosts.map { |h| host_name(h) }.find { |h| !allowed_host?(h) }
+        return "the X-Forwarded-Host header #{remote.inspect} is not a local name" if remote
+
+        forwarded = request.get_header("HTTP_FORWARDED").to_s
+        remote = forwarded_param(forwarded, "host").map { |h| host_name(h) }.find { |h| !allowed_host?(h) }
+        return "the Forwarded header names a non-local host (#{remote.inspect})" if remote
+
+        nil
+      end
+
+      def test_environment?
+        defined?(Rails) && Rails.respond_to?(:env) && Rails.env.test?
+      end
+
+      # Values of one parameter (for=, host=) of a Forwarded header (RFC 7239), quotes removed.
+      def forwarded_param(value, param)
+        value.split(/[,;]/).filter_map do |pair|
+          name, node = pair.split("=", 2)
+          next unless name.to_s.strip.casecmp?(param)
+
+          node.to_s.strip.delete_prefix('"').delete_suffix('"')
+        end
+      end
+
+      # "127.0.0.1:5555" -> "127.0.0.1", "[::1]:5555" -> "::1", "localhost:3000" -> "localhost".
+      # Any other form, a bare IPv6 address included, is returned as is: a malformed value is
+      # then refused unless it is local by itself.
+      def strip_port(value)
+        value = value.to_s.strip
+        match = value.match(/\A\[([^\]]+)\](?::\d+)?\z/) || value.match(/\A([^:]+)(?::\d+)?\z/)
+        match ? match[1] : value
+      end
+
+      def host_name(value)
+        strip_port(value).downcase.chomp(".")
+      end
+
+      def allowed_host?(host)
+        return false if host.empty?
+        return true if host == "localhost" || host.end_with?(".localhost")
+        return true if loopback_address?(host)
+        return true if test_environment? && TEST_HOSTS.include?(host)
+
+        permitted_by_rails_hosts?(host)
+      end
+
+      # When the application restricts config.hosts, ActionDispatch::HostAuthorization has
+      # already refused every other host; a host it lists is one the developer trusts.
+      def permitted_by_rails_hosts?(host)
+        return false unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        return false unless defined?(ActionDispatch::HostAuthorization::Permissions)
+
+        hosts = Rails.application.config.hosts
+        return false if hosts.nil? || hosts.empty?
+
+        ActionDispatch::HostAuthorization::Permissions.new(hosts).allows?(host)
+      end
+    end
+  end
+end

data/lib/profiler/middleware/cors_middleware.rb

@@ -2,60 +2,62 @@
 
 module Profiler
   module Middleware
+    # Sets the framing headers of every profiler response, and its CORS headers when
+    # extension_cors_enabled is set. Both settings are read on each request.
     class CorsMiddleware
       def initialize(app)
         @app = app
       end
 
       def call(env)
-        # Apply CORS and frame options to all profiler endpoints
-        if env['PATH_INFO'].start_with?('/_profiler/')
-          # Handle OPTIONS preflight request
-          if env['REQUEST_METHOD'] == 'OPTIONS'
-            return [
-              200,
-              cors_headers(env),
-              ['']
-            ]
-          end
-
-          status, headers, body = @app.call(env)
-          headers = headers.dup
-
-          # Add CORS headers
-          cors_headers(env).each do |key, value|
-            headers[key] = value
-          end
-
-          # Allow embedding in iframes from Chrome extensions
-          headers.delete('X-Frame-Options')
-          # Don't set CSP if controller requested to skip it
-          unless env['profiler.skip_csp']
-            # Allow embedding from standard web origins
-            headers['Content-Security-Policy'] = "frame-ancestors 'self' http: https:"
-          end
-
-          [status, headers, body]
-        else
-          @app.call(env)
+        return @app.call(env) unless profiler_path?(env['PATH_INFO'].to_s)
+
+        cors = Profiler.configuration.extension_cors_enabled
+
+        # Handle OPTIONS preflight request
+        if cors && env['REQUEST_METHOD'] == 'OPTIONS'
+          return [200, cors_headers(env), ['']]
         end
+
+        status, headers, body = @app.call(env)
+        headers = headers.dup
+
+        cors_headers(env).each { |key, value| set_header(headers, key, value) } if cors
+
+        # frame-ancestors decides in every browser that knows it, which then ignores
+        # X-Frame-Options; SAMEORIGIN only protects older browsers.
+        set_header(headers, 'X-Frame-Options', 'SAMEORIGIN')
+        set_header(headers, 'Content-Security-Policy', "frame-ancestors #{frame_ancestors}")
+
+        [status, headers, body]
       end
 
       private
 
+      # "/_profiler" itself is the dashboard URL; "/_profilerfoo" belongs to the application.
+      def profiler_path?(path)
+        path == '/_profiler' || path.start_with?('/_profiler/')
+      end
+
+      def frame_ancestors
+        sources = Array(Profiler.configuration.frame_ancestors).map(&:to_s).reject(&:empty?)
+        sources.empty? ? "'none'" : sources.join(' ')
+      end
+
       def cors_headers(env)
-        allowed_origins = Profiler.configuration.cors_allowed_origins
+        allowed_origins = Array(Profiler.configuration.cors_allowed_origins)
         request_origin = env['HTTP_ORIGIN']
 
-        if allowed_origins.include?('*')
-          origin_header = '*'
-        elsif request_origin && allowed_origins.include?(request_origin)
+        if request_origin && allowed_origins.include?(request_origin)
           origin_header = request_origin
+        elsif allowed_origins.include?('*') && !credentialed?(env)
+          # Never on a request carrying credentials: they may be what authorizes it.
+          origin_header = '*'
         end
 
         headers = {
           'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
-          'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With, Accept',
+          'Access-Control-Allow-Headers' => "Content-Type, X-Requested-With, Accept, #{Profiler::FORGERY_PROTECTION_HEADER}",
           'Access-Control-Expose-Headers' => 'X-Profiler-Token'
         }
 
@@ -66,6 +68,16 @@ module Profiler
 
         headers
       end
+
+      def credentialed?(env)
+        !env['HTTP_COOKIE'].to_s.empty? || !env['HTTP_AUTHORIZATION'].to_s.empty?
+      end
+
+      # Replaces a header whatever the case of its existing key, plain Hash or Rack::Headers.
+      def set_header(headers, name, value)
+        headers.keys.each { |key| headers.delete(key) if key.to_s.casecmp?(name) }
+        headers[name] = value
+      end
     end
   end
 end

data/lib/profiler/railtie.rb

@@ -24,11 +24,10 @@ module Profiler
       if Profiler.configuration.enabled
         require_relative "middleware/profiler_middleware"
 
-        # Insert CORS middleware first if enabled
-        if Profiler.configuration.extension_cors_enabled
-          require_relative "middleware/cors_middleware"
-          app.middleware.insert_before 0, Profiler::Middleware::CorsMiddleware
-        end
+        # Always inserted: it sets the framing headers of every profiler response, and its
+        # CORS headers only when extension_cors_enabled is set.
+        require_relative "middleware/cors_middleware"
+        app.middleware.insert_before 0, Profiler::Middleware::CorsMiddleware
 
         app.middleware.insert_before 0, Profiler::Middleware::ProfilerMiddleware
       end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.4"
+  VERSION = "0.30.6"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.4
+  version: 0.30.6
 platform: ruby
 authors:
 - Sébastien Duplessy
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-01 00:00:00.000000000 Z
+date: 2026-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -103,6 +103,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
+- CHANGELOG.md
 - app/assets/builds/profiler-toolbar.js
 - app/assets/builds/profiler.css
 - app/assets/builds/profiler.js
@@ -167,6 +168,7 @@ files:
 - lib/profiler/instrumentation/sidekiq_middleware.rb
 - lib/profiler/instrumentation/thread_context_propagation.rb
 - lib/profiler/job_profiler.rb
+- lib/profiler/local_request.rb
 - lib/profiler/mcp/body_formatter.rb
 - lib/profiler/mcp/file_cache.rb
 - lib/profiler/mcp/path_extractor.rb
@@ -231,6 +233,7 @@ licenses:
 metadata:
   homepage_uri: https://git.duplessy.eu/sebastien/rails-profiler-gem
   source_code_uri: https://git.duplessy.eu/sebastien/rails-profiler-gem
+  changelog_uri: https://git.duplessy.eu/sebastien/rails-profiler-gem/-/blob/master/CHANGELOG.md
 post_install_message:
 rdoc_options: []
 require_paths: