rails-profiler 0.30.5 → 0.30.7

data/lib/profiler/instrumentation/net_http_instrumentation.rb

@@ -5,6 +5,7 @@ require "base64"
 require "zlib"
 require "stringio"
 require "securerandom"
+require_relative "../redaction"
 
 module Profiler
   module Instrumentation
@@ -20,7 +21,7 @@ module Profiler
           host = address.to_s
           return super if NetHttpInstrumentation.skip_host?(host)
 
-          url = build_url(host, port, req.path, use_ssl?)
+          url = Redaction.filter_url(build_url(host, port, req.path, use_ssl?))
           req_body = req.body.to_s
           # Fallback: body may be passed as the 2nd argument and only applied
           # to req inside super via req.set_body_internal(body)
@@ -43,7 +44,7 @@ module Profiler
               req_body = ""
             end
           end
-          req_headers = req.to_hash.transform_values { |v| v.join(", ") }
+          req_headers = Redaction.filter_headers(req.to_hash.transform_values { |v| v.join(", ") })
           req_content_type = req["content-type"].to_s
           processed_req = req_body.empty? ? { body: nil, encoding: "text" } : NetHttpInstrumentation.process_body(req_body, req_content_type)
 
@@ -83,7 +84,7 @@ module Profiler
             entry,
             status: response.code.to_i,
             duration: duration,
-            response_headers: response.to_hash.transform_values { |v| v.join(", ") },
+            response_headers: Redaction.filter_headers(response.to_hash.transform_values { |v| v.join(", ") }),
             response_body: processed_resp[:body],
             response_body_encoding: processed_resp[:encoding],
             response_size: resp_body_raw.bytesize
@@ -151,7 +152,8 @@ module Profiler
         if mime.match?(BINARY_CONTENT_TYPES)
           { body: Base64.strict_encode64(body.b), encoding: "base64" }
         else
-          text = body.encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")
+          text = Redaction.filter_body(body, content_type)
+                          .encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")
           { body: text, encoding: "text" }
         end
       end

data/lib/profiler/job_profiler.rb

@@ -2,6 +2,7 @@
 
 require_relative "models/profile"
 require_relative "current_context"
+require_relative "redaction"
 require_relative "collectors/job_collector"
 require_relative "collectors/database_collector"
 require_relative "collectors/cache_collector"
@@ -115,7 +116,7 @@ module Profiler
     def sanitize_arguments(args)
       return [] unless args
 
-      args.map do |arg|
+      Redaction.filter_value(args).map do |arg|
         case arg
         when String then arg.length > 200 ? "#{arg[0, 200]}..." : arg
         when Numeric, TrueClass, FalseClass, NilClass then arg

data/lib/profiler/local_request.rb

@@ -0,0 +1,163 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Profiler
+  # Decides whether a request comes from this machine, for authorization_mode :allow_local.
+  #
+  # The client address is read from REMOTE_ADDR only. Forwarding headers (X-Forwarded-For,
+  # X-Real-IP, Forwarded, X-Forwarded-Host) can be forged, so they never grant access: they
+  # can only refuse it, when a local reverse proxy reports a remote client. The Host header
+  # has to be a local name, or one the application allows in config.hosts, which defeats DNS
+  # rebinding: a rebound page reaches 127.0.0.1 under the attacker's own domain name. The
+  # test environment also accepts the default hosts of rack-test and of Rails integration
+  # tests, reserved names (RFC 2606) that no attacker can point at a server of his own.
+  module LocalRequest
+    FORWARDING_HEADERS = {
+      "HTTP_X_FORWARDED_FOR" => "X-Forwarded-For",
+      "HTTP_X_REAL_IP" => "X-Real-IP",
+      "HTTP_FORWARDED" => "Forwarded"
+    }.freeze
+
+    TEST_HOSTS = %w[www.example.com example.com example.org].freeze
+
+    @warned = false
+    @warn_mutex = Mutex.new
+
+    class << self
+      # Returns nil when the request is local, otherwise a sentence naming the cause.
+      def denial_reason(request)
+        remote_addr = request.get_header("REMOTE_ADDR").to_s
+        unless loopback_address?(remote_addr)
+          return "REMOTE_ADDR #{remote_addr.empty? ? "(missing)" : remote_addr} is not a loopback address"
+        end
+
+        FORWARDING_HEADERS.each do |key, name|
+          value = request.get_header(key)
+          next if value.nil? || value.empty?
+
+          nodes = key == "HTTP_FORWARDED" ? forwarded_param(value, "for") : value.split(",")
+          remote = nodes.map { |node| strip_port(node) }.find { |address| !loopback_address?(address) }
+          return "the #{name} header reports a non-local client (#{remote})" if remote
+        end
+
+        host_denial_reason(request)
+      end
+
+      def local?(request)
+        denial_reason(request).nil?
+      end
+
+      # Logs why a request was refused, once per process, so that an application running in
+      # Docker does not just stop being profiled with no explanation.
+      def warn_once(reason)
+        @warn_mutex.synchronize do
+          return if @warned
+
+          @warned = true
+        end
+
+        message = "[Profiler] Request refused or not profiled by authorization_mode :allow_local: #{reason}. " \
+                  "The profiler only serves and captures requests made from this machine. " \
+                  "If the application runs in Docker or behind a remote proxy, either set " \
+                  "config.authorization_mode = :allow_authorized with a config.authorize_with block " \
+                  "that admits your network (see the Access control section of the README), or set " \
+                  "config.authorization_mode = :allow_all, which offers no protection at all. " \
+                  "This message is logged once per process."
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger.warn(message)
+        else
+          warn(message)
+        end
+      end
+
+      def reset_warning!
+        @warn_mutex.synchronize { @warned = false }
+      end
+
+      def loopback_address?(value)
+        address = value.to_s.strip
+        address = address[1..-2] if address.start_with?("[") && address.end_with?("]")
+        # Only an IPv6 address carries a zone identifier ("fe80::1%eth0").
+        address = address.sub(/%.*\z/, "") if address.include?(":")
+        return false if address.empty?
+
+        ip = IPAddr.new(address)
+        ip = ip.native if ip.ipv6? && ip.ipv4_mapped?
+        ip.loopback?
+      rescue IPAddr::Error
+        false
+      end
+
+      private
+
+      def host_denial_reason(request)
+        # A request with no Host header does not come from a browser, so it cannot be a
+        # rebound page; REMOTE_ADDR alone decides.
+        raw_host = request.get_header("HTTP_HOST").to_s
+        unless raw_host.empty?
+          host = host_name(raw_host)
+          return "the Host header #{host.inspect} is not a local name" unless allowed_host?(host)
+        end
+
+        forwarded_hosts = request.get_header("HTTP_X_FORWARDED_HOST").to_s.split(",")
+        remote = forwarded_hosts.map { |h| host_name(h) }.find { |h| !allowed_host?(h) }
+        return "the X-Forwarded-Host header #{remote.inspect} is not a local name" if remote
+
+        forwarded = request.get_header("HTTP_FORWARDED").to_s
+        remote = forwarded_param(forwarded, "host").map { |h| host_name(h) }.find { |h| !allowed_host?(h) }
+        return "the Forwarded header names a non-local host (#{remote.inspect})" if remote
+
+        nil
+      end
+
+      def test_environment?
+        defined?(Rails) && Rails.respond_to?(:env) && Rails.env.test?
+      end
+
+      # Values of one parameter (for=, host=) of a Forwarded header (RFC 7239), quotes removed.
+      def forwarded_param(value, param)
+        value.split(/[,;]/).filter_map do |pair|
+          name, node = pair.split("=", 2)
+          next unless name.to_s.strip.casecmp?(param)
+
+          node.to_s.strip.delete_prefix('"').delete_suffix('"')
+        end
+      end
+
+      # "127.0.0.1:5555" -> "127.0.0.1", "[::1]:5555" -> "::1", "localhost:3000" -> "localhost".
+      # Any other form, a bare IPv6 address included, is returned as is: a malformed value is
+      # then refused unless it is local by itself.
+      def strip_port(value)
+        value = value.to_s.strip
+        match = value.match(/\A\[([^\]]+)\](?::\d+)?\z/) || value.match(/\A([^:]+)(?::\d+)?\z/)
+        match ? match[1] : value
+      end
+
+      def host_name(value)
+        strip_port(value).downcase.chomp(".")
+      end
+
+      def allowed_host?(host)
+        return false if host.empty?
+        return true if host == "localhost" || host.end_with?(".localhost")
+        return true if loopback_address?(host)
+        return true if test_environment? && TEST_HOSTS.include?(host)
+
+        permitted_by_rails_hosts?(host)
+      end
+
+      # When the application restricts config.hosts, ActionDispatch::HostAuthorization has
+      # already refused every other host; a host it lists is one the developer trusts.
+      def permitted_by_rails_hosts?(host)
+        return false unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        return false unless defined?(ActionDispatch::HostAuthorization::Permissions)
+
+        hosts = Rails.application.config.hosts
+        return false if hosts.nil? || hosts.empty?
+
+        ActionDispatch::HostAuthorization::Permissions.new(hosts).allows?(host)
+      end
+    end
+  end
+end

data/lib/profiler/mcp/tools/list_env_vars.rb

@@ -2,6 +2,7 @@
 
 require_relative "../slave_support"
 require_relative "../../env_override_store"
+require_relative "../../redaction"
 
 module Profiler
   module MCP
@@ -19,8 +20,8 @@ module Profiler
           filter = params["filter"]&.downcase
 
           if include_all
-            vars = ENV.to_h.sort.to_h
-            overrides = Profiler.env_override_store.all_overrides
+            vars = Profiler::Redaction.env_snapshot
+            overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
 
             vars = vars.select { |k, _| k.downcase.include?(filter) } if filter
 
@@ -39,7 +40,7 @@ module Profiler
             text += "|-----|--------------|------------|\n"
             text += rows.join("\n")
           else
-            overrides = Profiler.env_override_store.all_overrides
+            overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
             overrides = overrides.select { |k, _| k.downcase.include?(filter) } if filter
 
             if overrides.empty?

data/lib/profiler/mcp/tools/reset_env_var.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../slave_support"
+require_relative "../../redaction"
 
 require "uri"
 
@@ -26,7 +27,7 @@ module Profiler
           original = overrides[key]["original"]
           Profiler.env_override_store.reset(key)
 
-          restored = original || "(unset)"
+          restored = original.nil? ? "(unset)" : Profiler::Redaction.env_value(key, original)
           [{ type: "text", text: "Reset #{key} to original value: #{restored}" }]
         end
       end

data/lib/profiler/mcp/tools/set_env_var.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../slave_support"
+require_relative "../../redaction"
 
 module Profiler
   module MCP
@@ -11,6 +12,10 @@ module Profiler
           value = params["value"].to_s
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::Redaction.mask?(value)
+            return [{ type: "text", text: "Error: #{Profiler::Redaction::MASK} is the mask the profiler shows " \
+                                          "in place of a hidden value, not a value; #{key} was left unchanged." }]
+          end
 
           if (proxy = MCP::SlaveSupport.with_slave_proxy(params))
             proxy.patch_json("/_profiler/api/env_vars", { key: key, value: value })

data/lib/profiler/middleware/cors_middleware.rb

@@ -2,60 +2,62 @@
 
 module Profiler
   module Middleware
+    # Sets the framing headers of every profiler response, and its CORS headers when
+    # extension_cors_enabled is set. Both settings are read on each request.
     class CorsMiddleware
       def initialize(app)
         @app = app
       end
 
       def call(env)
-        # Apply CORS and frame options to all profiler endpoints
-        if env['PATH_INFO'].start_with?('/_profiler/')
-          # Handle OPTIONS preflight request
-          if env['REQUEST_METHOD'] == 'OPTIONS'
-            return [
-              200,
-              cors_headers(env),
-              ['']
-            ]
-          end
-
-          status, headers, body = @app.call(env)
-          headers = headers.dup
-
-          # Add CORS headers
-          cors_headers(env).each do |key, value|
-            headers[key] = value
-          end
-
-          # Allow embedding in iframes from Chrome extensions
-          headers.delete('X-Frame-Options')
-          # Don't set CSP if controller requested to skip it
-          unless env['profiler.skip_csp']
-            # Allow embedding from standard web origins
-            headers['Content-Security-Policy'] = "frame-ancestors 'self' http: https:"
-          end
-
-          [status, headers, body]
-        else
-          @app.call(env)
+        return @app.call(env) unless profiler_path?(env['PATH_INFO'].to_s)
+
+        cors = Profiler.configuration.extension_cors_enabled
+
+        # Handle OPTIONS preflight request
+        if cors && env['REQUEST_METHOD'] == 'OPTIONS'
+          return [200, cors_headers(env), ['']]
         end
+
+        status, headers, body = @app.call(env)
+        headers = headers.dup
+
+        cors_headers(env).each { |key, value| set_header(headers, key, value) } if cors
+
+        # frame-ancestors decides in every browser that knows it, which then ignores
+        # X-Frame-Options; SAMEORIGIN only protects older browsers.
+        set_header(headers, 'X-Frame-Options', 'SAMEORIGIN')
+        set_header(headers, 'Content-Security-Policy', "frame-ancestors #{frame_ancestors}")
+
+        [status, headers, body]
       end
 
       private
 
+      # "/_profiler" itself is the dashboard URL; "/_profilerfoo" belongs to the application.
+      def profiler_path?(path)
+        path == '/_profiler' || path.start_with?('/_profiler/')
+      end
+
+      def frame_ancestors
+        sources = Array(Profiler.configuration.frame_ancestors).map(&:to_s).reject(&:empty?)
+        sources.empty? ? "'none'" : sources.join(' ')
+      end
+
       def cors_headers(env)
-        allowed_origins = Profiler.configuration.cors_allowed_origins
+        allowed_origins = Array(Profiler.configuration.cors_allowed_origins)
         request_origin = env['HTTP_ORIGIN']
 
-        if allowed_origins.include?('*')
-          origin_header = '*'
-        elsif request_origin && allowed_origins.include?(request_origin)
+        if request_origin && allowed_origins.include?(request_origin)
           origin_header = request_origin
+        elsif allowed_origins.include?('*') && !credentialed?(env)
+          # Never on a request carrying credentials: they may be what authorizes it.
+          origin_header = '*'
         end
 
         headers = {
           'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
-          'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With, Accept',
+          'Access-Control-Allow-Headers' => "Content-Type, X-Requested-With, Accept, #{Profiler::FORGERY_PROTECTION_HEADER}",
           'Access-Control-Expose-Headers' => 'X-Profiler-Token'
         }
 
@@ -66,6 +68,16 @@ module Profiler
 
         headers
       end
+
+      def credentialed?(env)
+        !env['HTTP_COOKIE'].to_s.empty? || !env['HTTP_AUTHORIZATION'].to_s.empty?
+      end
+
+      # Replaces a header whatever the case of its existing key, plain Hash or Rack::Headers.
+      def set_header(headers, name, value)
+        headers.keys.each { |key| headers.delete(key) if key.to_s.casecmp?(name) }
+        headers[name] = value
+      end
     end
   end
 end

data/lib/profiler/models/profile.rb

@@ -4,6 +4,7 @@ require "base64"
 require "securerandom"
 require "json"
 require "zlib"
+require_relative "../redaction"
 
 module Profiler
   module Models
@@ -46,7 +47,7 @@ module Profiler
         @finished_at = Time.now
         @duration = ((@finished_at - @started_at) * 1000).round(2) # milliseconds
         @status = status
-        @response_headers = response_headers
+        @response_headers = Redaction.filter_headers(response_headers)
       end
 
       def add_collector_data(name, data)
@@ -161,7 +162,7 @@ module Profiler
         if binary_content_type?(content_type)
           { body: Base64.strict_encode64(raw.b), encoding: "base64" }
         else
-          text = raw.encode("UTF-8", invalid: :replace, undef: :replace)
+          text = Redaction.filter_body(raw, content_type).encode("UTF-8", invalid: :replace, undef: :replace)
           if compress_body?(text)
             { body: Base64.strict_encode64(Zlib::Deflate.deflate(text)), encoding: "gzip+base64" }
           else
@@ -189,10 +190,14 @@ module Profiler
         ct.to_s.match?(%r{image/(?!svg)|application/(?:pdf|octet-stream|zip)|audio/|video/})
       end
 
+      LEGACY_FILTERED_PARAMS = %w[password password_confirmation token secret].freeze
+
       def sanitize_params(params)
         return {} unless params
 
-        params.to_h.except("password", "password_confirmation", "token", "secret")
+        return params.to_h.except(*LEGACY_FILTERED_PARAMS) unless Redaction.enabled?
+
+        Redaction.filter_hash(params.to_h)
       end
 
       ALLOWED_HEADERS = %w[
@@ -206,6 +211,7 @@ module Profiler
         env.select { |k, _| k.start_with?("HTTP_") }
            .transform_keys { |k| k.sub(/^HTTP_/, "").split("_").map(&:capitalize).join("-") }
            .select { |k, _| ALLOWED_HEADERS.include?(k) }
+           .then { |headers| Redaction.filter_headers(headers) }
       end
     end
   end

data/lib/profiler/railtie.rb

@@ -24,11 +24,10 @@ module Profiler
       if Profiler.configuration.enabled
         require_relative "middleware/profiler_middleware"
 
-        # Insert CORS middleware first if enabled
-        if Profiler.configuration.extension_cors_enabled
-          require_relative "middleware/cors_middleware"
-          app.middleware.insert_before 0, Profiler::Middleware::CorsMiddleware
-        end
+        # Always inserted: it sets the framing headers of every profiler response, and its
+        # CORS headers only when extension_cors_enabled is set.
+        require_relative "middleware/cors_middleware"
+        app.middleware.insert_before 0, Profiler::Middleware::CorsMiddleware
 
         app.middleware.insert_before 0, Profiler::Middleware::ProfilerMiddleware
       end