rails-profiler 0.30.6 → 0.30.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7a2ea61f4463670763c8c3c2d92f98a1f4ff2917fb9a2f5e0d245ea1860d2f1
-  data.tar.gz: ba467072b67f027565a29c99f458cd959933de512cdfa054ddde052d3e65ddb1
+  metadata.gz: f606ebbea7d5aecac4c62d789f07ddab9b4942269d4f8246441b3f37bc3220e7
+  data.tar.gz: 53f89719e215f799ba93d436fbace90ee45b38b0ec8d7f453cd2d2410e50cc0e
 SHA512:
-  metadata.gz: b2a1049428bab86d06ba54bba7cd373bfc3ebe606137bd2e6bfda46d5b1501c10574ebcec632125efd9e5c6b6a0be2d11c763b15e670a06aaaac384c0e028c6e
-  data.tar.gz: 561590eb7eadc20139ea79a0005efefbf9de88da0010db4ae20903360d3199342ba9648fe9d6d4bc1452c62e18c61f47311f19bb78f68a3307791f3089a11f06
+  metadata.gz: 3fe0149c4be61248f1fbfdfa381083a01710248c81a8e02dfec015bd721e7ff0238c2296dbcb4df141701603f8f1a3b03cabd4ef839c3031006215680e34bed9
+  data.tar.gz: 1aca6f23e91b25b303db9d68f970f4878a222bb02cb5d1e5b89533f07c99306d38bec2f004b8471d8790bb6990b8a59a2a68a86cc00e50becb23b85020f8bdae

data/CHANGELOG.md

@@ -19,6 +19,43 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.7] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Sensitive data:** Mask sensitive values with `[FILTERED]` before a profile is stored. Until
+  now `Authorization`, `Cookie` and `Set-Cookie` headers, raw request and response bodies
+  (passwords included), outbound request headers and bodies, and the whole of `ENV` were stored in
+  clear, and params lost only four exact root keys. The profiler now builds one filter from your
+  `Rails.application.config.filter_parameters` plus its own `config.filter_parameters`, with Rails
+  semantics (nested keys, any case, regexps, procs), and applies it to params and route params,
+  JSON, NDJSON and form bodies, incoming, response and outbound headers (the query string of
+  `Referer`, `Location` and `Content-Location` included), outbound URLs, SQL binds of filtered
+  columns, job arguments and mailer arguments. `multipart` bodies, and JSON bodies that cannot be
+  parsed and in which a filter matches, are masked entirely; HTML and other unstructured bodies are
+  kept. A params key that matches the filter is now kept with a masked value instead of being
+  removed.
+- **Sensitive data:** `ENV` values are shown only for the variables in `config.env_allowlist`, in
+  the Env tab, the `env_vars` endpoint and the `list_env_vars`, `reset_env_var` and `get_profile`
+  MCP tools alike. `[FILTERED]` is refused as a value by the `env_vars` endpoint (422), the
+  `set_env_var` MCP tool and the Env tab import, so re-importing an export cannot overwrite a
+  secret. EXPLAIN is refused, with a message, for a query whose bind values were masked.
+- **Sensitive data:** Procs of `filter_parameters` run once per string value, with the original
+  params for a proc of three arguments, as in Rails; other objects, Active Record models included,
+  are neither copied nor passed to them. When the filter fails, the value is masked rather than
+  the error reaching the application, and the error class is logged once, without the value. A
+  JSON body in whose text no filter matches is not parsed.
+- **Upgrade note:** To get the previous behaviour back, set `config.redact_sensitive_data = false`
+  (no masking) and `config.env_allowlist = :all` (every `ENV` value); `config.filter_parameters = []`
+  keeps masking but relies on your application's list alone. Profiles stored before the upgrade
+  are not rewritten and keep their values in clear until they rotate out: clear them after
+  upgrading with `bin/rails runner 'Profiler.storage.clear'` (every storage backend), the
+  `clear_profiles` MCP tool or the dashboard; the memory store is emptied by a restart. Update
+  every node of a cluster: a node still on an older version returns its data in clear to the
+  master.
+
 ## [0.30.6] - 2026-10-03
 
 <!-- stamped -->

data/app/assets/builds/profiler.js

@@ -4499,6 +4499,7 @@
   }
 
   // app/assets/typescript/profiler/components/dashboard/tabs/EnvTab.tsx
+  var FILTERED_MASK = "[FILTERED]";
   function detectType(value) {
     if (value === "") return { label: "empty", color: "var(--profiler-text-muted)" };
     if (/^(true|false|yes|no)$/i.test(value)) return { label: "bool", color: "#a78bfa" };
@@ -4653,8 +4654,13 @@
       URL.revokeObjectURL(url);
       showFlash("success", `Exported ${entries.length} variables`);
     };
-    const importPreview = T2(() => parseEnvFile(importContent), [importContent]);
+    const importParsed = T2(() => parseEnvFile(importContent), [importContent]);
+    const importPreview = T2(
+      () => Object.fromEntries(Object.entries(importParsed).filter(([, v3]) => v3 !== FILTERED_MASK)),
+      [importParsed]
+    );
     const importCount = Object.keys(importPreview).length;
+    const importMaskedCount = Object.keys(importParsed).length - importCount;
     const importEnv = async () => {
       const entries = Object.entries(importPreview);
       if (!entries.length) return;
@@ -4664,7 +4670,8 @@
         setVariables((prev) => ({ ...prev, ...importPreview }));
         setImportContent("");
         setShowImport(false);
-        showFlash("success", `Imported ${entries.length} variables`);
+        const skipped = importMaskedCount > 0 ? `, skipped ${importMaskedCount} masked` : "";
+        showFlash("success", `Imported ${entries.length} variables${skipped}`);
       } catch (e3) {
         showFlash("error", e3.message ?? "Import failed");
       } finally {
@@ -4933,6 +4940,12 @@
             importCount !== 1 ? "s" : "",
             " to import"
           ] }),
+          importMaskedCount > 0 && /* @__PURE__ */ u3("span", { class: "profiler-text--xs profiler-text--muted", children: [
+            importMaskedCount,
+            " masked (",
+            FILTERED_MASK,
+            ") skipped"
+          ] }),
           /* @__PURE__ */ u3(
             "button",
             {

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -4,8 +4,8 @@ module Profiler
   module Api
     class EnvVarsController < ApplicationController
       def show
-        variables = ENV.to_h.sort.to_h
-        overrides = Profiler.env_override_store.all_overrides
+        variables = Profiler::Redaction.env_snapshot
+        overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
         render json: { variables: variables, total: variables.size, overrides: overrides }
       end
 
@@ -19,10 +19,17 @@ module Profiler
 
         value = params[:value]
 
+        if Profiler::Redaction.mask?(value)
+          render json: { error: "#{Profiler::Redaction::MASK} is the mask the profiler shows in place of a " \
+                                "hidden value, not a value; #{key} was left unchanged" },
+                 status: :unprocessable_entity
+          return
+        end
+
         if value.nil? || value.to_s.empty?
           Profiler.env_override_store.delete(key)
           ENV.delete(key)
-          render json: { key: key, value: nil, deleted: true, override: Profiler.env_override_store.all_overrides[key] }
+          render json: { key: key, value: nil, deleted: true, override: redacted_override(key) }
         else
           current_original = Profiler.env_override_store.all_overrides.dig(key, "original")
           if current_original == value.to_s
@@ -31,7 +38,7 @@ module Profiler
             Profiler.env_override_store.set(key, value.to_s)
           end
           ENV[key] = value.to_s
-          render json: { key: key, value: ENV[key], override: Profiler.env_override_store.all_overrides[key] }
+          render json: { key: key, value: redacted_value(key), override: redacted_override(key) }
         end
       end
 
@@ -44,13 +51,23 @@ module Profiler
         end
 
         Profiler.env_override_store.reset(key)
-        render json: { key: key, value: ENV[key], reset: true }
+        render json: { key: key, value: redacted_value(key), reset: true }
       end
 
       def reset_all
         Profiler.env_override_store.reset_all
         render json: { reset: true }
       end
+
+      private
+
+      def redacted_value(key)
+        ENV[key].nil? ? nil : Profiler::Redaction.env_value(key, ENV[key])
+      end
+
+      def redacted_override(key)
+        Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)[key]
+      end
     end
   end
 end

data/lib/profiler/collectors/database_collector.rb

@@ -96,11 +96,15 @@ module Profiler
 
         binds.map do |bind|
           if bind.respond_to?(:value)
-            bind.value
+            name = bind.name if bind.respond_to?(:name)
+            Profiler::Redaction.filter_named(name, bind.value)
           else
             bind
           end
         end
+      rescue StandardError
+        # Never let the profiler raise into the application's query.
+        binds.map { Profiler::Redaction::MASK }
       end
 
       def extract_backtrace

data/lib/profiler/collectors/env_collector.rb

@@ -25,7 +25,7 @@ module Profiler
       end
 
       def collect
-        variables = ENV.to_h.sort.to_h
+        variables = Profiler::Redaction.env_snapshot
         store_data({ variables: variables, total: variables.size })
       end
 

data/lib/profiler/collectors/mailer_collector.rb

@@ -199,7 +199,19 @@ module Profiler
         klass = Object.const_get(mailer_class)
         params = klass.instance_method(action).parameters
         params.each_with_index.each_with_object({}) do |((_, name), i), h|
-          h[name.to_s] = serialize_assign(args[i])
+          h[name.to_s] = if Profiler::Redaction.sensitive_key?(name)
+            Profiler::Redaction::MASK
+          else
+            value = args[i]
+            # A hash or array goes through the filter by its keys, anything
+            # else by the parameter name: never both, so a proc runs once.
+            filtered = if value.is_a?(Hash) || value.is_a?(Array)
+              Profiler::Redaction.filter_value(value)
+            else
+              Profiler::Redaction.filter_named(name, value)
+            end
+            serialize_assign(filtered)
+          end
         end
       rescue StandardError
         {}

data/lib/profiler/collectors/request_collector.rb

@@ -91,7 +91,7 @@ module Profiler
         {
           route_name:        route_name ? "#{route_name}_path" : nil,
           route_pattern:     matched_route&.path&.spec&.to_s&.sub(/\(\.:format\)$/, ""),
-          route_params:      route_params,
+          route_params:      Profiler::Redaction.filter_hash(route_params),
           controller_action: controller_action
         }
       rescue StandardError

data/lib/profiler/configuration.rb

@@ -9,6 +9,22 @@ module Profiler
   FORGERY_PROTECTION_HEADER = "X-Profiler-Request"
 
   class Configuration
+    # Added to the application's own config.filter_parameters: the list of the
+    # Rails 7.1 application template, without :email.
+    DEFAULT_FILTER_PARAMETERS = %i[
+      passw secret token _key crypt salt certificate otp ssn cvv cvc
+    ].freeze
+
+    # ENV variables whose values the profiler shows; every other one is listed
+    # with its value masked.
+    DEFAULT_ENV_ALLOWLIST = %w[
+      RAILS_ENV RACK_ENV NODE_ENV RAILS_LOG_LEVEL RAILS_LOG_TO_STDOUT RAILS_SERVE_STATIC_FILES
+      RAILS_MAX_THREADS RAILS_MIN_THREADS WEB_CONCURRENCY PORT PIDFILE
+      LANG LANGUAGE LC_ALL LC_CTYPE TZ HOME PWD PATH SHELL USER HOSTNAME TERM
+      RUBY_VERSION RUBYOPT RUBY_YJIT_ENABLE MALLOC_ARENA_MAX
+      BUNDLE_GEMFILE BUNDLE_PATH BUNDLE_WITHOUT GEM_HOME GEM_PATH BOOTSNAP_CACHE_DIR
+    ].freeze
+
     attr_accessor :enabled, :storage_options, :collectors,
                   :skip_paths, :slow_query_threshold, :max_queries_warning,
                   :track_memory, :memory_warning_threshold,
@@ -22,6 +38,7 @@ module Profiler
                   :track_tests,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold,
+                  :redact_sensitive_data, :filter_parameters, :env_allowlist,
                   :name, :master_url, :self_url,
                   :cluster_heartbeat_interval, :cluster_offline_threshold
 
@@ -67,6 +84,9 @@ module Profiler
       @mailer_skip_actions = []
       @compress_bodies = true
       @compress_body_threshold = 10 * 1024 # 10 KB
+      @redact_sensitive_data = true
+      @filter_parameters = DEFAULT_FILTER_PARAMETERS.dup
+      @env_allowlist = DEFAULT_ENV_ALLOWLIST.dup
       @tmp_path = nil
       @name = nil
       @master_url = nil

data/lib/profiler/explain_runner.rb

@@ -28,6 +28,10 @@ module Profiler
       query = queries[query_index]
       sql   = query["sql"].to_s
       binds = Array(query["binds"])
+      if binds.include?(Redaction::MASK)
+        raise ArgumentError, "EXPLAIN refused for query #{query_index}: one of its bind values was " \
+                             "filtered when captured (config.filter_parameters), so the query cannot be rebuilt"
+      end
 
       conn    = ActiveRecord::Base.connection
       adapter = conn.adapter_name.downcase

data/lib/profiler/instrumentation/net_http_instrumentation.rb

@@ -5,6 +5,7 @@ require "base64"
 require "zlib"
 require "stringio"
 require "securerandom"
+require_relative "../redaction"
 
 module Profiler
   module Instrumentation
@@ -20,7 +21,7 @@ module Profiler
           host = address.to_s
           return super if NetHttpInstrumentation.skip_host?(host)
 
-          url = build_url(host, port, req.path, use_ssl?)
+          url = Redaction.filter_url(build_url(host, port, req.path, use_ssl?))
           req_body = req.body.to_s
           # Fallback: body may be passed as the 2nd argument and only applied
           # to req inside super via req.set_body_internal(body)
@@ -43,7 +44,7 @@ module Profiler
               req_body = ""
             end
           end
-          req_headers = req.to_hash.transform_values { |v| v.join(", ") }
+          req_headers = Redaction.filter_headers(req.to_hash.transform_values { |v| v.join(", ") })
           req_content_type = req["content-type"].to_s
           processed_req = req_body.empty? ? { body: nil, encoding: "text" } : NetHttpInstrumentation.process_body(req_body, req_content_type)
 
@@ -83,7 +84,7 @@ module Profiler
             entry,
             status: response.code.to_i,
             duration: duration,
-            response_headers: response.to_hash.transform_values { |v| v.join(", ") },
+            response_headers: Redaction.filter_headers(response.to_hash.transform_values { |v| v.join(", ") }),
             response_body: processed_resp[:body],
             response_body_encoding: processed_resp[:encoding],
             response_size: resp_body_raw.bytesize
@@ -151,7 +152,8 @@ module Profiler
         if mime.match?(BINARY_CONTENT_TYPES)
           { body: Base64.strict_encode64(body.b), encoding: "base64" }
         else
-          text = body.encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")
+          text = Redaction.filter_body(body, content_type)
+                          .encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")
           { body: text, encoding: "text" }
         end
       end

data/lib/profiler/job_profiler.rb

@@ -2,6 +2,7 @@
 
 require_relative "models/profile"
 require_relative "current_context"
+require_relative "redaction"
 require_relative "collectors/job_collector"
 require_relative "collectors/database_collector"
 require_relative "collectors/cache_collector"
@@ -115,7 +116,7 @@ module Profiler
     def sanitize_arguments(args)
       return [] unless args
 
-      args.map do |arg|
+      Redaction.filter_value(args).map do |arg|
         case arg
         when String then arg.length > 200 ? "#{arg[0, 200]}..." : arg
         when Numeric, TrueClass, FalseClass, NilClass then arg

data/lib/profiler/mcp/tools/list_env_vars.rb

@@ -2,6 +2,7 @@
 
 require_relative "../slave_support"
 require_relative "../../env_override_store"
+require_relative "../../redaction"
 
 module Profiler
   module MCP
@@ -19,8 +20,8 @@ module Profiler
           filter = params["filter"]&.downcase
 
           if include_all
-            vars = ENV.to_h.sort.to_h
-            overrides = Profiler.env_override_store.all_overrides
+            vars = Profiler::Redaction.env_snapshot
+            overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
 
             vars = vars.select { |k, _| k.downcase.include?(filter) } if filter
 
@@ -39,7 +40,7 @@ module Profiler
             text += "|-----|--------------|------------|\n"
             text += rows.join("\n")
           else
-            overrides = Profiler.env_override_store.all_overrides
+            overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
             overrides = overrides.select { |k, _| k.downcase.include?(filter) } if filter
 
             if overrides.empty?

data/lib/profiler/mcp/tools/reset_env_var.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../slave_support"
+require_relative "../../redaction"
 
 require "uri"
 
@@ -26,7 +27,7 @@ module Profiler
           original = overrides[key]["original"]
           Profiler.env_override_store.reset(key)
 
-          restored = original || "(unset)"
+          restored = original.nil? ? "(unset)" : Profiler::Redaction.env_value(key, original)
           [{ type: "text", text: "Reset #{key} to original value: #{restored}" }]
         end
       end

data/lib/profiler/mcp/tools/set_env_var.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../slave_support"
+require_relative "../../redaction"
 
 module Profiler
   module MCP
@@ -11,6 +12,10 @@ module Profiler
           value = params["value"].to_s
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::Redaction.mask?(value)
+            return [{ type: "text", text: "Error: #{Profiler::Redaction::MASK} is the mask the profiler shows " \
+                                          "in place of a hidden value, not a value; #{key} was left unchanged." }]
+          end
 
           if (proxy = MCP::SlaveSupport.with_slave_proxy(params))
             proxy.patch_json("/_profiler/api/env_vars", { key: key, value: value })

data/lib/profiler/models/profile.rb

@@ -4,6 +4,7 @@ require "base64"
 require "securerandom"
 require "json"
 require "zlib"
+require_relative "../redaction"
 
 module Profiler
   module Models
@@ -46,7 +47,7 @@ module Profiler
         @finished_at = Time.now
         @duration = ((@finished_at - @started_at) * 1000).round(2) # milliseconds
         @status = status
-        @response_headers = response_headers
+        @response_headers = Redaction.filter_headers(response_headers)
       end
 
       def add_collector_data(name, data)
@@ -161,7 +162,7 @@ module Profiler
         if binary_content_type?(content_type)
           { body: Base64.strict_encode64(raw.b), encoding: "base64" }
         else
-          text = raw.encode("UTF-8", invalid: :replace, undef: :replace)
+          text = Redaction.filter_body(raw, content_type).encode("UTF-8", invalid: :replace, undef: :replace)
           if compress_body?(text)
             { body: Base64.strict_encode64(Zlib::Deflate.deflate(text)), encoding: "gzip+base64" }
           else
@@ -189,10 +190,14 @@ module Profiler
         ct.to_s.match?(%r{image/(?!svg)|application/(?:pdf|octet-stream|zip)|audio/|video/})
       end
 
+      LEGACY_FILTERED_PARAMS = %w[password password_confirmation token secret].freeze
+
       def sanitize_params(params)
         return {} unless params
 
-        params.to_h.except("password", "password_confirmation", "token", "secret")
+        return params.to_h.except(*LEGACY_FILTERED_PARAMS) unless Redaction.enabled?
+
+        Redaction.filter_hash(params.to_h)
       end
 
       ALLOWED_HEADERS = %w[
@@ -206,6 +211,7 @@ module Profiler
         env.select { |k, _| k.start_with?("HTTP_") }
            .transform_keys { |k| k.sub(/^HTTP_/, "").split("_").map(&:capitalize).join("-") }
            .select { |k, _| ALLOWED_HEADERS.include?(k) }
+           .then { |headers| Redaction.filter_headers(headers) }
       end
     end
   end

data/lib/profiler/redaction.rb

@@ -0,0 +1,421 @@
+# frozen_string_literal: true
+
+require "json"
+require "set"
+require "rack/utils"
+require "active_support/parameter_filter"
+
+module Profiler
+  # The single filter applied to everything the profiler captures: request
+  # params, headers, bodies and URLs (incoming and outgoing), SQL binds, job
+  # arguments, mailer arguments and ENV.
+  #
+  # It is built on ActiveSupport::ParameterFilter from the host application's
+  # Rails.application.config.filter_parameters plus
+  # Profiler.configuration.filter_parameters, so it follows Rails semantics:
+  # a symbol or string matches any key containing it, case-insensitively, at
+  # any nesting depth; a regexp is used as is; a proc rewrites values.
+  #
+  # It never raises: it runs inside notification subscribers and the Net::HTTP
+  # patch, where an exception would reach the application. When the filter
+  # fails (a proc that does not expect a value, say), the value is masked and
+  # the failure is logged once per error class, without the value.
+  module Redaction
+    MASK = "[FILTERED]"
+
+    # Matched by the filter on top of filter_parameters.
+    ALWAYS_FILTERED_HEADERS = %w[authorization proxy-authorization cookie set-cookie].freeze
+
+    # Headers whose value is a URL: their query string goes through the filter.
+    URL_HEADERS = %w[referer location content-location].freeze
+
+    JSON_TYPES = %r{\A(?:application|text)/(?:[\w.+-]+\+)?json\z}i
+    NDJSON_TYPES = %r{\A[\w.+-]+/x-ndjson\z}i
+    FORM_TYPE = "application/x-www-form-urlencoded"
+    MULTIPART_TYPE = %r{\Amultipart/}i
+
+    # The characters outside ASCII whose case folding yields ASCII letters
+    # (Unicode CaseFolding.txt): with any of them, a case-insensitive regexp
+    # can match an ASCII filter where a plain ASCII search cannot.
+    FOLDS_TO_ASCII = /[ßİʼnſǰẖ-ẚẞKff-st]/
+
+    # What makes a regexp filter unfit for a search of the whole body text:
+    # anchors, word boundaries and lookarounds can match a key on its own and
+    # fail on the same key inside the text.
+    CONTEXT_SENSITIVE_REGEXP = /\\[AzZbBG]|[\^$]|\(\?<?[=!]/
+
+    # Bound on the memo of names already tested against the filter.
+    KEY_CACHE_LIMIT = 10_000
+
+    # The value a name alone is tested with: procs in filter_parameters
+    # rewrite it in place, so it has to be a string, and a throwaway one.
+    PROBE = "x"
+
+    class << self
+      def enabled?
+        Profiler.configuration.redact_sensitive_data != false
+      end
+
+      # The ParameterFilter, rebuilt only when the list of filters changes.
+      def parameter_filter
+        compiled[:filter]
+      end
+
+      # Keys are masked by the filters that are not procs; the procs then
+      # rewrite each string left, once, under its own key. Running the procs
+      # through ParameterFilter instead would dup every other value first,
+      # Active Record models included.
+      def filter_hash(hash)
+        return hash unless enabled? && hash.is_a?(Hash)
+
+        state = compiled
+        masked = state[:plain].filter(hash)
+        state[:proc_filter] ? apply_procs_tree(masked, nil, hash, state[:procs]) : masked
+      rescue StandardError => e
+        report(e, "filtering a hash")
+        hash.transform_values { MASK }
+      end
+
+      # Filters any value: hashes through the filter, arrays element by
+      # element, anything else unchanged (it carries no key to match).
+      def filter_value(value)
+        return value unless enabled?
+
+        case value
+        when Hash then filter_hash(value)
+        when Array then value.map { |v| filter_value(v) }
+        else value
+        end
+      rescue StandardError => e
+        report(e, "filtering a value")
+        MASK
+      end
+
+      # A value known by its name (SQL bind, mailer argument): MASK when the
+      # name matches the filter, else the value as the procs of
+      # filter_parameters rewrite it.
+      def filter_named(name, value)
+        return value unless enabled? && name
+        return MASK if sensitive_key?(name)
+
+        apply_procs([name.to_s], value)
+      end
+
+      # Whether the name alone matches the filter. Memoized per name: header,
+      # ENV, column and key names come from a small set. A filter that raises
+      # makes the name sensitive.
+      def sensitive_key?(name)
+        key = name.to_s
+        state = compiled
+        known = state[:keys]
+        return known[key] if known.key?(key)
+
+        result = state[:plain].filter(key => +PROBE)[key] == MASK
+        known[key] = result if known.size < KEY_CACHE_LIMIT
+        result
+      rescue StandardError => e
+        report(e, "testing a name")
+        true
+      end
+
+      # Header names are tested as written and with dashes as underscores, so
+      # that X-Api-Key matches :_key as x_api_key would.
+      def sensitive_header?(name)
+        key = name.to_s.downcase
+        ALWAYS_FILTERED_HEADERS.include?(key) || sensitive_key?(key) || sensitive_key?(key.tr("-", "_"))
+      end
+
+      def filter_headers(headers)
+        return headers unless enabled? && headers.respond_to?(:each_with_object)
+
+        headers.each_with_object({}) do |(name, value), out|
+          out[name] = filter_header(name, value)
+        end
+      end
+
+      # Filters a raw body according to its content type. JSON, NDJSON and
+      # form-urlencoded bodies have their filtered keys masked, multipart
+      # bodies are masked entirely, and every other type is kept as is: they
+      # carry no key the filter can read, and masking HTML would hide the very
+      # pages being profiled.
+      #
+      # Bodies usually arrive as binary strings (rack.input, Net::HTTP): they
+      # are read as UTF-8, or as bytes when they are not valid UTF-8.
+      def filter_body(raw, content_type)
+        return raw unless enabled? && raw.is_a?(String) && !raw.empty?
+
+        mime = content_type.to_s.split(";").first.to_s.strip.downcase
+        text = readable(raw)
+        if mime.match?(JSON_TYPES)
+          filter_json(text, mime)
+        elsif mime.match?(NDJSON_TYPES)
+          text.split("\n", -1).map { |line| line.strip.empty? ? line : filter_json(line, mime) }.join("\n")
+        elsif mime == FORM_TYPE
+          filter_query(text)
+        elsif mime.match?(MULTIPART_TYPE)
+          "[FILTERED: #{mime} body, #{raw.bytesize} bytes]"
+        else
+          raw
+        end
+      rescue StandardError => e
+        report(e, "filtering a #{mime} body")
+        "[FILTERED: #{mime} body that could not be filtered, #{raw.bytesize} bytes]"
+      end
+
+      # Masks the filtered values of a query string, pair by pair, leaving the
+      # rest of the string exactly as it was.
+      def filter_query(query)
+        return query unless enabled? && query.is_a?(String) && !query.empty?
+
+        readable(query).split("&", -1).map do |pair|
+          name, value = pair.split("=", 2)
+          next pair if value.nil? || value.empty?
+
+          parsed = Rack::Utils.parse_nested_query(pair)
+          parameter_filter.filter(parsed) == parsed ? pair : "#{name}=#{MASK}"
+        rescue StandardError
+          # A pair Rack or the filter cannot handle is masked rather than trusted.
+          "#{name}=#{MASK}"
+        end.join("&")
+      end
+
+      # A URL, or a list of them as Rack 3 gives a repeated header.
+      def filter_url(url)
+        return url unless enabled?
+        return url.map { |u| filter_url(u) } if url.is_a?(Array)
+        return url unless url.is_a?(String)
+
+        rest, fragment = readable(url).split("#", 2)
+        base, query = rest.split("?", 2)
+        return url if query.nil?
+
+        "#{base}?#{filter_query(query)}#{"##{fragment}" if fragment}"
+      rescue StandardError => e
+        report(e, "filtering a URL")
+        MASK
+      end
+
+      # ENV as the profiler shows it: names kept, values masked unless the
+      # name is in config.env_allowlist and does not match the filter.
+      def env_snapshot(env = ENV.to_h)
+        listed = env_allowlist_matcher
+        env.sort.to_h { |name, value| [name, env_visible?(name, listed) ? apply_procs([name], value) : MASK] }
+      end
+
+      def env_value(name, value)
+        env_visible?(name) ? apply_procs([name.to_s], value) : MASK
+      end
+
+      # ENV overrides with the same rule applied to their current and original
+      # values. The deleted and restore markers are kept: they are not values.
+      def env_overrides(overrides)
+        overrides.to_h do |name, entry|
+          next [name, entry] if env_visible?(name) || !entry.is_a?(Hash)
+
+          masked = entry.to_h do |field, value|
+            [field, keep_override_field?(field, value) ? value : MASK]
+          end
+          [name, masked]
+        end
+      end
+
+      def env_visible?(name, listed = env_allowlist_matcher)
+        listed.call(name.to_s) && !(enabled? && sensitive_key?(name))
+      end
+
+      # Whether +value+, stripped, is the mask: a value exported while masked,
+      # which must never be written back as if it were the real one.
+      def mask?(value)
+        value.to_s.strip == MASK
+      end
+
+      private
+
+      def compiled
+        filters = current_filters
+        state = @compiled
+        return state if state && state[:filters] == filters
+
+        @reported = Set.new
+        procs, plain = filters.partition { |f| f.respond_to?(:call) }
+        @compiled = {
+          filters: filters,
+          filter: ActiveSupport::ParameterFilter.new(filters, mask: MASK),
+          plain: ActiveSupport::ParameterFilter.new(plain, mask: MASK),
+          proc_filter: procs.empty? ? nil : ActiveSupport::ParameterFilter.new(procs, mask: MASK),
+          procs: procs,
+          keys: {}
+        }.merge(text_matchers(filters))
+      end
+
+      # What the JSON pre-test needs: the string filters, downcased, for a
+      # plain search, and as one case-insensitive alternation as
+      # ParameterFilter builds it, for text outside ASCII; the regexp filters
+      # that can be searched for in the whole text. Procs rewrite values
+      # whatever the key, dotted filters match a key path, and other regexps
+      # depend on where the key ends: any of them makes the filters opaque,
+      # and every body is then parsed.
+      def text_matchers(filters)
+        procs = filters.any? { |f| f.respond_to?(:call) }
+        regexps, strings = filters.reject { |f| f.respond_to?(:call) }.partition { |f| f.is_a?(Regexp) }
+        opaque = procs ||
+                 filters.any? { |f| !f.respond_to?(:call) && f.to_s.include?(".") } ||
+                 regexps.any? { |r| r.source.match?(CONTEXT_SENSITIVE_REGEXP) } ||
+                 strings.any? { |s| !s.to_s.ascii_only? }
+        words = strings.map { |s| s.to_s.downcase }
+        {
+          opaque: opaque,
+          words: words,
+          words_regexp: words.empty? ? nil : Regexp.new(words.map { |w| Regexp.escape(w) }.join("|"), Regexp::IGNORECASE),
+          regexps: regexps
+        }
+      end
+
+      def filter_header(name, value)
+        return MASK if sensitive_header?(name)
+
+        value = filter_url(value) if URL_HEADERS.include?(name.to_s.downcase)
+        apply_procs([name.to_s, name.to_s.tr("-", "_")], value)
+      rescue StandardError => e
+        report(e, "filtering a header")
+        MASK
+      end
+
+      # The value as the procs of filter_parameters rewrite it under each of
+      # +names+. Nothing to do without procs: the names were already tested.
+      #
+      # Only strings: any other object would be duplicated for the procs,
+      # which runs the application's copy hooks; it is shown through its
+      # inspect, as before. The procs run once: under the first of +names+
+      # that changes the value, so that a proc which undoes itself (reverse!)
+      # is not applied twice.
+      def apply_procs(names, value)
+        return value unless enabled? && value.is_a?(String)
+
+        filter = compiled[:proc_filter]
+        return value unless filter
+
+        names.uniq.each do |name|
+          result = filter.filter(name => value)[name]
+          return result unless result == value
+        end
+        value
+      rescue StandardError => e
+        report(e, "applying a filter_parameters proc")
+        MASK
+      end
+
+      # Walks a tree the non-proc filters have already masked and lets the
+      # procs rewrite each string leaf, once, as ParameterFilter does: a copy
+      # of the key and of the value, and the original params for a proc of
+      # arity 3. A leaf masked by the filter is the MASK object itself and is
+      # left alone, also as ParameterFilter does; a value that only reads
+      # "[FILTERED]" is a different object and still goes to the procs.
+      def apply_procs_tree(value, key, original, procs)
+        case value
+        when Hash then value.each_with_object(value.class.new) { |(k, v), out| out[k] = apply_procs_tree(v, k, original, procs) }
+        when Array then value.map { |v| apply_procs_tree(v, key, original, procs) }
+        when String then key.nil? || value.equal?(MASK) ? value : call_procs(procs, key, value, original)
+        else value
+        end
+      end
+
+      def call_procs(procs, key, value, original)
+        key = key.dup if key.duplicable?
+        value = value.dup
+        procs.each { |b| b.arity == 2 ? b.call(key, value) : b.call(key, value, original) }
+        value
+      rescue StandardError => e
+        report(e, "applying a filter_parameters proc")
+        MASK
+      end
+
+      def keep_override_field?(field, value)
+        value.nil? ||
+          value == EnvOverrideStore::DELETED_SENTINEL ||
+          value == EnvOverrideStore::RESTORE_SENTINEL ||
+          !%w[value original].include?(field)
+      end
+
+      def env_allowlist_matcher
+        allowlist = Profiler.configuration.env_allowlist
+        return ->(_name) { true } if allowlist == :all
+
+        regexps, names = Array(allowlist).partition { |entry| entry.is_a?(Regexp) }
+        names = names.to_set(&:to_s)
+        ->(name) { names.include?(name) || regexps.any? { |r| r.match?(name) } }
+      end
+
+      def current_filters
+        filters = Array(Profiler.configuration.filter_parameters)
+        app_filters = rails_filter_parameters
+        app_filters.empty? ? filters : app_filters + filters
+      end
+
+      def rails_filter_parameters
+        return [] unless defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application
+
+        Array(::Rails.application.config.filter_parameters)
+      rescue StandardError
+        []
+      end
+
+      # The string as UTF-8 when it is valid UTF-8, else as bytes, so that
+      # string operations and regexps never meet an incompatible encoding.
+      def readable(string)
+        return string if string.encoding == Encoding::UTF_8 && string.valid_encoding?
+
+        utf8 = string.dup.force_encoding(Encoding::UTF_8)
+        utf8.valid_encoding? ? utf8 : string.b
+      end
+
+      def filter_json(text, mime)
+        return text unless json_needs_parse?(text)
+
+        parsed = JSON.parse(text)
+        filtered = filter_value(parsed)
+        filtered == parsed ? text : JSON.generate(filtered)
+      rescue JSON::ParserError, JSON::GeneratorError
+        "[FILTERED: unparseable #{mime} body, #{text.bytesize} bytes]"
+      end
+
+      # A cheap pre-test that spares the parse of a body in whose text no
+      # filter matches anywhere: no key of it can match either. Any match, in
+      # a key or in a value, sends the body to the parser, which also masks
+      # an unreadable body entirely. Text that is not valid UTF-8, holds an
+      # escape (a key can be written password) or, for a plain ASCII
+      # search, a character that case-folds onto ASCII letters is not judged
+      # here, nor is any body under opaque filters.
+      def json_needs_parse?(text)
+        state = compiled
+        return true if state[:opaque]
+        return true if text.encoding != Encoding::UTF_8 || text.include?("\\")
+
+        state[:regexps].any? { |r| r.match?(text) } || words_in_text?(state, text)
+      end
+
+      def words_in_text?(state, text)
+        words = state[:words]
+        return false if words.empty?
+        return state[:words_regexp].match?(text) unless text.ascii_only? || !text.match?(FOLDS_TO_ASCII)
+
+        lowered = text.downcase(:ascii)
+        words.any? { |word| lowered.include?(word) }
+      end
+
+      # Logs a failure of the filter once per error class, with no value and
+      # no message: either could carry what was being masked.
+      def report(error, during)
+        reported = (@reported ||= Set.new)
+        return if reported.include?(error.class)
+
+        reported << error.class
+        message = "[Profiler] Redaction: #{error.class} while #{during}; the value was masked instead."
+        logger = ::Rails.logger if defined?(::Rails) && ::Rails.respond_to?(:logger)
+        logger ? logger.warn(message) : Kernel.warn(message)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.6"
+  VERSION = "0.30.7"
 end

data/lib/profiler.rb

@@ -2,6 +2,7 @@
 
 require_relative "profiler/version"
 require_relative "profiler/configuration"
+require_relative "profiler/redaction"
 
 module Profiler
   class Error < StandardError; end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.6
+  version: 0.30.7
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -209,6 +209,7 @@ files:
 - lib/profiler/models/sql_query.rb
 - lib/profiler/models/timeline_event.rb
 - lib/profiler/railtie.rb
+- lib/profiler/redaction.rb
 - lib/profiler/sse/bus.rb
 - lib/profiler/sse/event_bus.rb
 - lib/profiler/sse/redis_event_bus.rb