rails-profiler 0.30.5 → 0.30.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 04defc47e71c610492ff23fbce13ebf669f459a1cac74c5933200bdf4d52365c
-  data.tar.gz: d99cf7c5531fd369aa8c9367d95b0a5314f71f38de6ed64a7c81a9693f69566a
+  metadata.gz: f606ebbea7d5aecac4c62d789f07ddab9b4942269d4f8246441b3f37bc3220e7
+  data.tar.gz: 53f89719e215f799ba93d436fbace90ee45b38b0ec8d7f453cd2d2410e50cc0e
 SHA512:
-  metadata.gz: '09ba67258286ddc275d2d1cc36234dd8f0e7d24783034dd3959c666b41d96bb334d5c38d720ceca2254d205449094aa57cac9de6afb1842e3437fbd2d238eac3'
-  data.tar.gz: '0936d7ca150be6a80809739a2d9b94f77c51c80fad8796bb01d93fb2ca0047a5da3eb4ae832f9567c381bd3dcaacad3000b0273664362570306060c8b3b3eeec'
+  metadata.gz: 3fe0149c4be61248f1fbfdfa381083a01710248c81a8e02dfec015bd721e7ff0238c2296dbcb4df141701603f8f1a3b03cabd4ef839c3031006215680e34bed9
+  data.tar.gz: 1aca6f23e91b25b303db9d68f970f4878a222bb02cb5d1e5b89533f07c99306d38bec2f004b8471d8790bb6990b8a59a2a68a86cc00e50becb23b85020f8bdae

data/CHANGELOG.md

@@ -19,6 +19,86 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.7] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Sensitive data:** Mask sensitive values with `[FILTERED]` before a profile is stored. Until
+  now `Authorization`, `Cookie` and `Set-Cookie` headers, raw request and response bodies
+  (passwords included), outbound request headers and bodies, and the whole of `ENV` were stored in
+  clear, and params lost only four exact root keys. The profiler now builds one filter from your
+  `Rails.application.config.filter_parameters` plus its own `config.filter_parameters`, with Rails
+  semantics (nested keys, any case, regexps, procs), and applies it to params and route params,
+  JSON, NDJSON and form bodies, incoming, response and outbound headers (the query string of
+  `Referer`, `Location` and `Content-Location` included), outbound URLs, SQL binds of filtered
+  columns, job arguments and mailer arguments. `multipart` bodies, and JSON bodies that cannot be
+  parsed and in which a filter matches, are masked entirely; HTML and other unstructured bodies are
+  kept. A params key that matches the filter is now kept with a masked value instead of being
+  removed.
+- **Sensitive data:** `ENV` values are shown only for the variables in `config.env_allowlist`, in
+  the Env tab, the `env_vars` endpoint and the `list_env_vars`, `reset_env_var` and `get_profile`
+  MCP tools alike. `[FILTERED]` is refused as a value by the `env_vars` endpoint (422), the
+  `set_env_var` MCP tool and the Env tab import, so re-importing an export cannot overwrite a
+  secret. EXPLAIN is refused, with a message, for a query whose bind values were masked.
+- **Sensitive data:** Procs of `filter_parameters` run once per string value, with the original
+  params for a proc of three arguments, as in Rails; other objects, Active Record models included,
+  are neither copied nor passed to them. When the filter fails, the value is masked rather than
+  the error reaching the application, and the error class is logged once, without the value. A
+  JSON body in whose text no filter matches is not parsed.
+- **Upgrade note:** To get the previous behaviour back, set `config.redact_sensitive_data = false`
+  (no masking) and `config.env_allowlist = :all` (every `ENV` value); `config.filter_parameters = []`
+  keeps masking but relies on your application's list alone. Profiles stored before the upgrade
+  are not rewritten and keep their values in clear until they rotate out: clear them after
+  upgrading with `bin/rails runner 'Profiler.storage.clear'` (every storage backend), the
+  `clear_profiles` MCP tool or the dashboard; the memory store is emptied by a restart. Update
+  every node of a cluster: a node still on an older version returns its data in clear to the
+  master.
+
+## [0.30.6] - 2026-10-03
+
+<!-- stamped -->
+
+### Security
+
+- **Access control:** Check `authorization_mode` on every page and endpoint of the profiler (UI,
+  API, server-sent events, test runner, toolbar), answering `403` otherwise. It used to decide only
+  which requests were captured: with `:allow_authorized` and a block that refused everybody, the API
+  still listed and deleted profiles and wrote `ENV`. The gem's static JS and CSS stay public.
+- **Access control:** The new default `authorization_mode`, `:allow_local`, only lets in requests
+  made from this machine: a loopback `REMOTE_ADDR`, no forwarding header naming a remote client, and
+  a local `Host` (or one listed in `config.hosts`), against DNS rebinding; the test environment
+  also accepts the reserved hosts `www.example.com`, `example.com` and `example.org`, so the
+  application's request specs are still captured. It also decides
+  which requests are captured, and logs the reason for a refusal once per process. The previous
+  default, `:allow_all`, let anybody who could reach the application read and change everything.
+- **Access control:** API requests that change something (including a form `POST` turned into
+  another verb by `_method`) must carry an `X-Profiler-Request` header or a CSRF token, so that a
+  page on another site can no longer trigger them, even when the application turns
+  `allow_forgery_protection` off. The dashboard, the toolbar and the cluster send the header.
+- **Access control:** CORS is off by default (`extension_cors_enabled = false`,
+  `cors_allowed_origins = []`), and `Access-Control-Allow-Origin: *` is never sent to a request
+  carrying a cookie or an `Authorization` header. It used to be `*` for everybody.
+- **Access control:** Profiler pages may only be framed by the profiler itself and by the Chrome
+  extension's DevTools panel (`frame-ancestors 'self' chrome-extension: devtools:`, configurable
+  with the new `frame_ancestors` option), and send `X-Frame-Options: SAMEORIGIN`. Any website could
+  frame them, and with `?embed=true` a profile page carried no framing protection at all.
+- **Upgrading:** Nothing to do when you browse the profiler from the machine that runs Rails. Each
+  previous behavior can be restored in `config/initializers/profiler.rb`:
+  - Docker, a VM or a remote proxy: admit your network with `config.authorization_mode =
+    :allow_authorized` and an `authorize_with` block reading `REMOTE_ADDR` (example in the README), or
+    go back to `config.authorization_mode = :allow_all`, which offers no protection.
+  - A cluster whose master and slaves run on different machines: each side admits the other's address
+    the same way.
+  - Your own scripts calling the API: send `X-Profiler-Request: 1`, or set
+    `config.api_forgery_protection = false`.
+  - Cross-origin clients: `config.extension_cors_enabled = true` and
+    `config.cors_allowed_origins = ["https://your.origin"]`. `["*"]` restores the behavior before
+    0.30.6 and reopens the profiler to every website you visit: under `:allow_local` or `:allow_all`,
+    any page open in your browser can read its data and change it.
+  - Framing by other sites: `config.frame_ancestors = ["'self'", "http:", "https:"]`.
+
 ## [0.30.5] - 2026-10-03
 
 <!-- stamped -->

data/app/assets/builds/profiler-toolbar.js

@@ -4167,10 +4167,11 @@
     const { method, params, data, headers = {}, signal } = config;
     const url = resolvedUrl;
     const qs = params ? "?" + new URLSearchParams(Object.entries(params).map(([k3, v3]) => [k3, String(v3)])).toString() : "";
+    const baseHeaders = { "X-Profiler-Request": "1", ...headers };
     const res = await fetch(url + qs, {
       method,
       signal,
-      headers: data !== void 0 ? { "Content-Type": "application/json", ...headers } : headers,
+      headers: data !== void 0 ? { "Content-Type": "application/json", ...baseHeaders } : baseHeaders,
       body: data !== void 0 ? JSON.stringify(data) : void 0
     });
     if (res.status === 204) return {};

data/app/assets/builds/profiler.js

@@ -3456,10 +3456,11 @@
     const { method, params, data, headers = {}, signal } = config;
     const url = resolvedUrl;
     const qs = params ? "?" + new URLSearchParams(Object.entries(params).map(([k3, v3]) => [k3, String(v3)])).toString() : "";
+    const baseHeaders = { "X-Profiler-Request": "1", ...headers };
     const res = await fetch(url + qs, {
       method,
       signal,
-      headers: data !== void 0 ? { "Content-Type": "application/json", ...headers } : headers,
+      headers: data !== void 0 ? { "Content-Type": "application/json", ...baseHeaders } : baseHeaders,
       body: data !== void 0 ? JSON.stringify(data) : void 0
     });
     if (res.status === 204) return {};
@@ -4498,6 +4499,7 @@
   }
 
   // app/assets/typescript/profiler/components/dashboard/tabs/EnvTab.tsx
+  var FILTERED_MASK = "[FILTERED]";
   function detectType(value) {
     if (value === "") return { label: "empty", color: "var(--profiler-text-muted)" };
     if (/^(true|false|yes|no)$/i.test(value)) return { label: "bool", color: "#a78bfa" };
@@ -4652,8 +4654,13 @@
       URL.revokeObjectURL(url);
       showFlash("success", `Exported ${entries.length} variables`);
     };
-    const importPreview = T2(() => parseEnvFile(importContent), [importContent]);
+    const importParsed = T2(() => parseEnvFile(importContent), [importContent]);
+    const importPreview = T2(
+      () => Object.fromEntries(Object.entries(importParsed).filter(([, v3]) => v3 !== FILTERED_MASK)),
+      [importParsed]
+    );
     const importCount = Object.keys(importPreview).length;
+    const importMaskedCount = Object.keys(importParsed).length - importCount;
     const importEnv = async () => {
       const entries = Object.entries(importPreview);
       if (!entries.length) return;
@@ -4663,7 +4670,8 @@
         setVariables((prev) => ({ ...prev, ...importPreview }));
         setImportContent("");
         setShowImport(false);
-        showFlash("success", `Imported ${entries.length} variables`);
+        const skipped = importMaskedCount > 0 ? `, skipped ${importMaskedCount} masked` : "";
+        showFlash("success", `Imported ${entries.length} variables${skipped}`);
       } catch (e3) {
         showFlash("error", e3.message ?? "Import failed");
       } finally {
@@ -4932,6 +4940,12 @@
             importCount !== 1 ? "s" : "",
             " to import"
           ] }),
+          importMaskedCount > 0 && /* @__PURE__ */ u3("span", { class: "profiler-text--xs profiler-text--muted", children: [
+            importMaskedCount,
+            " masked (",
+            FILTERED_MASK,
+            ") skipped"
+          ] }),
           /* @__PURE__ */ u3(
             "button",
             {

data/app/controllers/profiler/api/ajax_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class AjaxController < ApplicationController
-      skip_before_action :verify_authenticity_token, only: [:link]
-
       def link
         parent_token = params[:parent_token]
         child_token = params[:child_token]

data/app/controllers/profiler/api/cluster_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ClusterController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def register
         name = params[:name].to_s
         url  = params[:url].to_s

data/app/controllers/profiler/api/console_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ConsoleController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -3,11 +3,9 @@
 module Profiler
   module Api
     class EnvVarsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def show
-        variables = ENV.to_h.sort.to_h
-        overrides = Profiler.env_override_store.all_overrides
+        variables = Profiler::Redaction.env_snapshot
+        overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
         render json: { variables: variables, total: variables.size, overrides: overrides }
       end
 
@@ -21,10 +19,17 @@ module Profiler
 
         value = params[:value]
 
+        if Profiler::Redaction.mask?(value)
+          render json: { error: "#{Profiler::Redaction::MASK} is the mask the profiler shows in place of a " \
+                                "hidden value, not a value; #{key} was left unchanged" },
+                 status: :unprocessable_entity
+          return
+        end
+
         if value.nil? || value.to_s.empty?
           Profiler.env_override_store.delete(key)
           ENV.delete(key)
-          render json: { key: key, value: nil, deleted: true, override: Profiler.env_override_store.all_overrides[key] }
+          render json: { key: key, value: nil, deleted: true, override: redacted_override(key) }
         else
           current_original = Profiler.env_override_store.all_overrides.dig(key, "original")
           if current_original == value.to_s
@@ -33,7 +38,7 @@ module Profiler
             Profiler.env_override_store.set(key, value.to_s)
           end
           ENV[key] = value.to_s
-          render json: { key: key, value: ENV[key], override: Profiler.env_override_store.all_overrides[key] }
+          render json: { key: key, value: redacted_value(key), override: redacted_override(key) }
         end
       end
 
@@ -46,13 +51,23 @@ module Profiler
         end
 
         Profiler.env_override_store.reset(key)
-        render json: { key: key, value: ENV[key], reset: true }
+        render json: { key: key, value: redacted_value(key), reset: true }
       end
 
       def reset_all
         Profiler.env_override_store.reset_all
         render json: { reset: true }
       end
+
+      private
+
+      def redacted_value(key)
+        ENV[key].nil? ? nil : Profiler::Redaction.env_value(key, ENV[key])
+      end
+
+      def redacted_override(key)
+        Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)[key]
+      end
     end
   end
 end

data/app/controllers/profiler/api/events_controller.rb

@@ -4,7 +4,6 @@ module Profiler
   module Api
     class EventsController < Profiler::ApplicationController
       include ActionController::Live
-      skip_before_action :verify_authenticity_token
 
       def subscribe
         response.headers["Content-Type"]      = "text/event-stream"

data/app/controllers/profiler/api/explain_controller.rb

@@ -5,8 +5,6 @@ require "profiler/explain_runner"
 module Profiler
   module Api
     class ExplainController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def create
         unless Profiler.configuration.enabled
           return render json: { error: "EXPLAIN is only available when the profiler is enabled" }, status: :forbidden

data/app/controllers/profiler/api/function_profiling_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class FunctionProfilingController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def show
         render json: {
           enabled:    Profiler.function_profiling_enabled,

data/app/controllers/profiler/api/jobs_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class JobsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/outbound_http_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class OutboundHttpController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       # GET /_profiler/api/outbound_http
       def index
         limit = (params[:limit] || 200).to_i

data/app/controllers/profiler/api/profiles_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class ProfilesController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/slave_proxy_controller.rb

@@ -5,8 +5,6 @@ require_relative "../../../../lib/profiler/cluster/slave_proxy"
 module Profiler
   module Api
     class SlaveProxyController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def forward
         proxy = Cluster::SlaveProxy.new(params[:slave_name])
         sub_path = params[:path].to_s

data/app/controllers/profiler/api/test_runner_controller.rb

@@ -8,8 +8,6 @@ module Profiler
     class TestRunnerController < ApplicationController
       include ActionController::Live
 
-      skip_before_action :verify_authenticity_token
-
       def files
         framework = params[:framework]
         tree = Profiler::TestRunner::Discovery.files(framework: framework)

data/app/controllers/profiler/api/tests_controller.rb

@@ -3,8 +3,6 @@
 module Profiler
   module Api
     class TestsController < ApplicationController
-      skip_before_action :verify_authenticity_token
-
       def index
         limit  = (params[:limit]  || 50).to_i
         offset = (params[:offset] || 0).to_i

data/app/controllers/profiler/api/toolbar_controller.rb

@@ -3,7 +3,6 @@
 module Profiler
   module Api
     class ToolbarController < Profiler::ApplicationController
-      skip_before_action :verify_authenticity_token
       skip_before_action :check_authorization
 
       def show

data/app/controllers/profiler/application_controller.rb

@@ -2,11 +2,12 @@
 
 module Profiler
   class ApplicationController < ActionController::Base
-    protect_from_forgery with: :exception
-
     layout "profiler/application"
 
     before_action :check_authorization
+    before_action :authorize_request
+    # Declared after the access checks, so that an unauthorized request gets its 403 first.
+    protect_from_forgery with: :exception
 
     private
 
@@ -16,6 +17,36 @@ module Profiler
       end
     end
 
+    def authorize_request
+      return if Profiler.configuration.authorized?(request)
+
+      deny("Not authorized to access the profiler")
+    end
+
+    # Decided by the profiler's own setting, not by the application's allow_forgery_protection,
+    # which the config/environments/test.rb generated by Rails turns off.
+    def protect_against_forgery?
+      Profiler.configuration.api_forgery_protection ? true : false
+    end
+
+    # Rails' token, or the header every profiler client sends. A third-party page cannot add a
+    # custom header without a CORS preflight, which is refused unless an origin was allowed.
+    def verified_request?
+      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present?
+    end
+
+    def handle_unverified_request
+      deny("Missing #{Profiler::FORGERY_PROTECTION_HEADER} header or CSRF token")
+    end
+
+    def deny(message)
+      if controller_path.start_with?("profiler/api/")
+        render json: { error: message }, status: :forbidden
+      else
+        render plain: message, status: :forbidden
+      end
+    end
+
     def build_child_jobs(profile)
       storage = @resolved_storage || Profiler.storage
       storage.find_by_parent(profile.token)

data/app/controllers/profiler/assets_controller.rb

@@ -2,8 +2,11 @@
 
 module Profiler
   class AssetsController < ApplicationController
+    # The gem's own static JS and CSS: no application data, cached publicly. Every piece of
+    # data they display comes from the API, which keeps the authorization check.
     skip_before_action :verify_authenticity_token
     skip_before_action :check_authorization
+    skip_before_action :authorize_request
 
     def toolbar_js
       path = Profiler::Engine.root.join("app", "assets", "builds", "profiler-toolbar.js")

data/app/controllers/profiler/profiles_controller.rb

@@ -2,8 +2,6 @@
 
 module Profiler
   class ProfilesController < ApplicationController
-    before_action :allow_iframe_embedding, only: [:show], if: -> { params[:embed] == "true" }
-
     def index
       limit = params[:limit]&.to_i || 50
       offset = params[:offset]&.to_i || 0
@@ -158,13 +156,6 @@ module Profiler
       end
     end
 
-    def allow_iframe_embedding
-      response.headers.delete('X-Frame-Options')
-      # Don't set frame-ancestors CSP to allow Chrome extensions to embed
-      # Mark that CSP should not be set by middleware
-      request.env['profiler.skip_csp'] = true
-    end
-
     def filter_profiles(profiles)
       filtered = profiles
 

data/lib/profiler/cluster/master_client.rb

@@ -24,7 +24,8 @@ module Profiler
         config = Profiler.configuration
         uri = URI("#{config.master_url}/_profiler/api/cluster/register")
         body = { name: config.resolved_name, url: config.self_url }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json")
+        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
+                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
         unless resp.code.to_i.between?(200, 299)
           raise "Master returned #{resp.code}: #{resp.body.to_s.slice(0, 200)}"
         end
@@ -36,7 +37,8 @@ module Profiler
         config = Profiler.configuration
         uri = URI("#{config.master_url}/_profiler/api/cluster/heartbeat")
         body = { name: config.resolved_name }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json")
+        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
+                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
         raise "Heartbeat rejected #{resp.code}" unless resp.code.to_i.between?(200, 299)
       end
 

data/lib/profiler/cluster/slave_proxy.rb

@@ -86,6 +86,7 @@ module Profiler
       end
 
       def request(uri, req)
+        req[Profiler::FORGERY_PROTECTION_HEADER] = "1"
         resp = Net::HTTP.start(uri.hostname, uri.port,
                                open_timeout: @open_timeout, read_timeout: @read_timeout,
                                use_ssl: uri.scheme == "https") do |http|

data/lib/profiler/collectors/database_collector.rb

@@ -96,11 +96,15 @@ module Profiler
 
         binds.map do |bind|
           if bind.respond_to?(:value)
-            bind.value
+            name = bind.name if bind.respond_to?(:name)
+            Profiler::Redaction.filter_named(name, bind.value)
           else
             bind
           end
         end
+      rescue StandardError
+        # Never let the profiler raise into the application's query.
+        binds.map { Profiler::Redaction::MASK }
       end
 
       def extract_backtrace

data/lib/profiler/collectors/env_collector.rb

@@ -25,7 +25,7 @@ module Profiler
       end
 
       def collect
-        variables = ENV.to_h.sort.to_h
+        variables = Profiler::Redaction.env_snapshot
         store_data({ variables: variables, total: variables.size })
       end
 

data/lib/profiler/collectors/mailer_collector.rb

@@ -199,7 +199,19 @@ module Profiler
         klass = Object.const_get(mailer_class)
         params = klass.instance_method(action).parameters
         params.each_with_index.each_with_object({}) do |((_, name), i), h|
-          h[name.to_s] = serialize_assign(args[i])
+          h[name.to_s] = if Profiler::Redaction.sensitive_key?(name)
+            Profiler::Redaction::MASK
+          else
+            value = args[i]
+            # A hash or array goes through the filter by its keys, anything
+            # else by the parameter name: never both, so a proc runs once.
+            filtered = if value.is_a?(Hash) || value.is_a?(Array)
+              Profiler::Redaction.filter_value(value)
+            else
+              Profiler::Redaction.filter_named(name, value)
+            end
+            serialize_assign(filtered)
+          end
         end
       rescue StandardError
         {}

data/lib/profiler/collectors/request_collector.rb

@@ -91,7 +91,7 @@ module Profiler
         {
           route_name:        route_name ? "#{route_name}_path" : nil,
           route_pattern:     matched_route&.path&.spec&.to_s&.sub(/\(\.:format\)$/, ""),
-          route_params:      route_params,
+          route_params:      Profiler::Redaction.filter_hash(route_params),
           controller_action: controller_action
         }
       rescue StandardError

data/lib/profiler/configuration.rb

@@ -1,13 +1,36 @@
 # frozen_string_literal: true
 
+require_relative "local_request"
+
 module Profiler
+  # Header the profiler's own clients send on every request. A page on another origin cannot
+  # add it without a CORS preflight, which the profiler does not grant by default, so its
+  # presence proves the request is not a cross-site forgery.
+  FORGERY_PROTECTION_HEADER = "X-Profiler-Request"
+
   class Configuration
+    # Added to the application's own config.filter_parameters: the list of the
+    # Rails 7.1 application template, without :email.
+    DEFAULT_FILTER_PARAMETERS = %i[
+      passw secret token _key crypt salt certificate otp ssn cvv cvc
+    ].freeze
+
+    # ENV variables whose values the profiler shows; every other one is listed
+    # with its value masked.
+    DEFAULT_ENV_ALLOWLIST = %w[
+      RAILS_ENV RACK_ENV NODE_ENV RAILS_LOG_LEVEL RAILS_LOG_TO_STDOUT RAILS_SERVE_STATIC_FILES
+      RAILS_MAX_THREADS RAILS_MIN_THREADS WEB_CONCURRENCY PORT PIDFILE
+      LANG LANGUAGE LC_ALL LC_CTYPE TZ HOME PWD PATH SHELL USER HOSTNAME TERM
+      RUBY_VERSION RUBYOPT RUBY_YJIT_ENABLE MALLOC_ARENA_MAX
+      BUNDLE_GEMFILE BUNDLE_PATH BUNDLE_WITHOUT GEM_HOME GEM_PATH BOOTSNAP_CACHE_DIR
+    ].freeze
+
     attr_accessor :enabled, :storage_options, :collectors,
                   :skip_paths, :slow_query_threshold, :max_queries_warning,
                   :track_memory, :memory_warning_threshold,
                   :mcp_enabled, :mcp_transport, :mcp_port,
                   :authorization_mode, :max_profiles, :extension_cors_enabled,
-                  :cors_allowed_origins,
+                  :cors_allowed_origins, :api_forgery_protection, :frame_ancestors,
                   :track_ajax, :ajax_skip_paths,
                   :track_http, :slow_http_threshold, :http_skip_hosts, :http_backtrace_depth,
                   :track_jobs,
@@ -15,6 +38,7 @@ module Profiler
                   :track_tests,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold,
+                  :redact_sensitive_data, :filter_parameters, :env_allowlist,
                   :name, :master_url, :self_url,
                   :cluster_heartbeat_interval, :cluster_offline_threshold
 
@@ -35,11 +59,16 @@ module Profiler
       @mcp_enabled = false
       @mcp_transport = :stdio
       @mcp_port = 3001
-      @authorization_mode = :allow_all
+      @authorization_mode = :allow_local
       @authorize_block = nil
       @max_profiles = 100
-      @extension_cors_enabled = true
-      @cors_allowed_origins = ["*"]
+      @extension_cors_enabled = false
+      @cors_allowed_origins = []
+      @api_forgery_protection = true
+      # The Chrome extension shows the profiler in a DevTools panel: an iframe inside a
+      # chrome-extension:// page, itself inside the devtools://devtools front end. Chrome
+      # checks frame-ancestors against every ancestor, so both schemes are needed.
+      @frame_ancestors = ["'self'", "chrome-extension:", "devtools:"]
       @track_ajax = true
       @ajax_skip_paths = [/^\/_profiler/]
       @track_http = true
@@ -55,6 +84,9 @@ module Profiler
       @mailer_skip_actions = []
       @compress_bodies = true
       @compress_body_threshold = 10 * 1024 # 10 KB
+      @redact_sensitive_data = true
+      @filter_parameters = DEFAULT_FILTER_PARAMETERS.dup
+      @env_allowlist = DEFAULT_ENV_ALLOWLIST.dup
       @tmp_path = nil
       @name = nil
       @master_url = nil
@@ -87,6 +119,12 @@ module Profiler
       case @authorization_mode
       when :allow_all
         true
+      when :allow_local
+        reason = LocalRequest.denial_reason(request)
+        return true if reason.nil?
+
+        LocalRequest.warn_once(reason)
+        false
       when :allow_authorized
         @authorize_block ? @authorize_block.call(request) : false
       else

data/lib/profiler/explain_runner.rb

@@ -28,6 +28,10 @@ module Profiler
       query = queries[query_index]
       sql   = query["sql"].to_s
       binds = Array(query["binds"])
+      if binds.include?(Redaction::MASK)
+        raise ArgumentError, "EXPLAIN refused for query #{query_index}: one of its bind values was " \
+                             "filtered when captured (config.filter_parameters), so the query cannot be rebuilt"
+      end
 
       conn    = ActiveRecord::Base.connection
       adapter = conn.adapter_name.downcase