rails-profiler 0.30.6 → 0.30.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e7a2ea61f4463670763c8c3c2d92f98a1f4ff2917fb9a2f5e0d245ea1860d2f1
-  data.tar.gz: ba467072b67f027565a29c99f458cd959933de512cdfa054ddde052d3e65ddb1
+  metadata.gz: 7edf1c383b05c79e4013d76c96fa57077b376f3a312c27aa355927ca1bb7e362
+  data.tar.gz: b1b9b6bd25f7f739c14d2afe72309fac7455e8f2c62b5e7d81e206a09b8ba4fa
 SHA512:
-  metadata.gz: b2a1049428bab86d06ba54bba7cd373bfc3ebe606137bd2e6bfda46d5b1501c10574ebcec632125efd9e5c6b6a0be2d11c763b15e670a06aaaac384c0e028c6e
-  data.tar.gz: 561590eb7eadc20139ea79a0005efefbf9de88da0010db4ae20903360d3199342ba9648fe9d6d4bc1452c62e18c61f47311f19bb78f68a3307791f3089a11f06
+  metadata.gz: ca0ca79568606603601b5b33aa3ee69fb54d6497e8c8e2087f45cb8d78092ad0264ed8a8794472955e6b5608f743d198de31fcdf63493e40b7f538fd4c4d8298
+  data.tar.gz: fd3f7cb5326209b731f11abbca7e7e0b3b226ce019ea62f32636a137d1d402c26f692dc11754e27d3144bae0814524ea7be282031d8adacfe3bda5a97d3d4cc9

data/CHANGELOG.md

@@ -19,6 +19,87 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.8] - 2026-10-04
+
+<!-- stamped -->
+
+### Fixed
+
+- **Env overrides:** Keep every override when several are set, deleted or reset at the same
+  time, from threads of the web process or from Sidekiq processes. Each writer read the file,
+  changed it and saved it over the others' changes, and a reader could see a half-written file as
+  no override at all. The file is now changed under a lock (`env_overrides.json.lock`, next to
+  it) and replaced in one step.
+
+### Security
+
+- **Env overrides:** Stop applying the environment variable overrides saved from the Env tab or
+  the MCP env tools in production, and while the profiler is disabled. They were written into
+  `ENV` at every boot whatever `enabled` said and whatever the environment, so an
+  `env_overrides.json` left under `tmp/` and shipped with a deployment changed the environment of
+  the production application, and an application with `config.enabled = false` still had them
+  applied without a word. Sidekiq jobs and console evaluations, which apply them again, follow the
+  same rules. When overrides are left out, the boot logs one warning to `Rails.logger` with the
+  file, the number of overrides and the reason, never a name or a value.
+- **Env overrides:** Apply them at boot once the application's `config/initializers` have run,
+  where `enabled` is decided, instead of before. An initializer of the application that reads
+  `ENV` while it runs no longer sees them; requests, jobs, eager loading and `after_initialize`
+  still do.
+- **Env overrides:** Resetting one override, or all of them, from the Env tab or the MCP env
+  tools no longer writes into `ENV` the "original" values saved in `env_overrides.json` in
+  production, nor while the profiler is disabled: those values come from the machine that wrote
+  the file, so a reset could put a development value into a production variable, or delete it.
+  There, a reset restores only the variables the running process changed itself, to the values
+  they had before.
+- **Env overrides:** In production, or with the profiler disabled, typing back in the Env tab the
+  original value the overrides file shows for a variable now records the running value first, so
+  a later reset puts it back instead of keeping the file's value. A reset also restores a variable
+  this process changed even when its entry has gone from the file. The `reset_env_var` MCP tool
+  now says whether the original value was restored in the process or `ENV` was left unchanged,
+  and no longer prints a value, masked or not.
+- **Upgrading:** to apply the env overrides while the profiler is disabled outside production,
+  as before, set `config.apply_env_overrides_when_disabled = true`. Nothing applies them in
+  production. If an initializer of yours needs them, call `Profiler.env_override_store.apply!` at
+  the end of `config/initializers/profiler.rb`; initializers loaded after it then see them, under
+  the same rules.
+
+## [0.30.7] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Sensitive data:** Mask sensitive values with `[FILTERED]` before a profile is stored. Until
+  now `Authorization`, `Cookie` and `Set-Cookie` headers, raw request and response bodies
+  (passwords included), outbound request headers and bodies, and the whole of `ENV` were stored in
+  clear, and params lost only four exact root keys. The profiler now builds one filter from your
+  `Rails.application.config.filter_parameters` plus its own `config.filter_parameters`, with Rails
+  semantics (nested keys, any case, regexps, procs), and applies it to params and route params,
+  JSON, NDJSON and form bodies, incoming, response and outbound headers (the query string of
+  `Referer`, `Location` and `Content-Location` included), outbound URLs, SQL binds of filtered
+  columns, job arguments and mailer arguments. `multipart` bodies, and JSON bodies that cannot be
+  parsed and in which a filter matches, are masked entirely; HTML and other unstructured bodies are
+  kept. A params key that matches the filter is now kept with a masked value instead of being
+  removed.
+- **Sensitive data:** `ENV` values are shown only for the variables in `config.env_allowlist`, in
+  the Env tab, the `env_vars` endpoint and the `list_env_vars`, `reset_env_var` and `get_profile`
+  MCP tools alike. `[FILTERED]` is refused as a value by the `env_vars` endpoint (422), the
+  `set_env_var` MCP tool and the Env tab import, so re-importing an export cannot overwrite a
+  secret. EXPLAIN is refused, with a message, for a query whose bind values were masked.
+- **Sensitive data:** Procs of `filter_parameters` run once per string value, with the original
+  params for a proc of three arguments, as in Rails; other objects, Active Record models included,
+  are neither copied nor passed to them. When the filter fails, the value is masked rather than
+  the error reaching the application, and the error class is logged once, without the value. A
+  JSON body in whose text no filter matches is not parsed.
+- **Upgrade note:** To get the previous behaviour back, set `config.redact_sensitive_data = false`
+  (no masking) and `config.env_allowlist = :all` (every `ENV` value); `config.filter_parameters = []`
+  keeps masking but relies on your application's list alone. Profiles stored before the upgrade
+  are not rewritten and keep their values in clear until they rotate out: clear them after
+  upgrading with `bin/rails runner 'Profiler.storage.clear'` (every storage backend), the
+  `clear_profiles` MCP tool or the dashboard; the memory store is emptied by a restart. Update
+  every node of a cluster: a node still on an older version returns its data in clear to the
+  master.
+
 ## [0.30.6] - 2026-10-03
 
 <!-- stamped -->

data/app/assets/builds/profiler.js

@@ -4499,6 +4499,7 @@
   }
 
   // app/assets/typescript/profiler/components/dashboard/tabs/EnvTab.tsx
+  var FILTERED_MASK = "[FILTERED]";
   function detectType(value) {
     if (value === "") return { label: "empty", color: "var(--profiler-text-muted)" };
     if (/^(true|false|yes|no)$/i.test(value)) return { label: "bool", color: "#a78bfa" };
@@ -4653,8 +4654,13 @@
       URL.revokeObjectURL(url);
       showFlash("success", `Exported ${entries.length} variables`);
     };
-    const importPreview = T2(() => parseEnvFile(importContent), [importContent]);
+    const importParsed = T2(() => parseEnvFile(importContent), [importContent]);
+    const importPreview = T2(
+      () => Object.fromEntries(Object.entries(importParsed).filter(([, v3]) => v3 !== FILTERED_MASK)),
+      [importParsed]
+    );
     const importCount = Object.keys(importPreview).length;
+    const importMaskedCount = Object.keys(importParsed).length - importCount;
     const importEnv = async () => {
       const entries = Object.entries(importPreview);
       if (!entries.length) return;
@@ -4664,7 +4670,8 @@
         setVariables((prev) => ({ ...prev, ...importPreview }));
         setImportContent("");
         setShowImport(false);
-        showFlash("success", `Imported ${entries.length} variables`);
+        const skipped = importMaskedCount > 0 ? `, skipped ${importMaskedCount} masked` : "";
+        showFlash("success", `Imported ${entries.length} variables${skipped}`);
       } catch (e3) {
         showFlash("error", e3.message ?? "Import failed");
       } finally {
@@ -4933,6 +4940,12 @@
             importCount !== 1 ? "s" : "",
             " to import"
           ] }),
+          importMaskedCount > 0 && /* @__PURE__ */ u3("span", { class: "profiler-text--xs profiler-text--muted", children: [
+            importMaskedCount,
+            " masked (",
+            FILTERED_MASK,
+            ") skipped"
+          ] }),
           /* @__PURE__ */ u3(
             "button",
             {

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -4,8 +4,8 @@ module Profiler
   module Api
     class EnvVarsController < ApplicationController
       def show
-        variables = ENV.to_h.sort.to_h
-        overrides = Profiler.env_override_store.all_overrides
+        variables = Profiler::Redaction.env_snapshot
+        overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
         render json: { variables: variables, total: variables.size, overrides: overrides }
       end
 
@@ -19,19 +19,27 @@ module Profiler
 
         value = params[:value]
 
+        if Profiler::Redaction.mask?(value)
+          render json: { error: "#{Profiler::Redaction::MASK} is the mask the profiler shows in place of a " \
+                                "hidden value, not a value; #{key} was left unchanged" },
+                 status: :unprocessable_entity
+          return
+        end
+
         if value.nil? || value.to_s.empty?
           Profiler.env_override_store.delete(key)
           ENV.delete(key)
-          render json: { key: key, value: nil, deleted: true, override: Profiler.env_override_store.all_overrides[key] }
+          render json: { key: key, value: nil, deleted: true, override: redacted_override(key) }
         else
           current_original = Profiler.env_override_store.all_overrides.dig(key, "original")
-          if current_original == value.to_s
+          # Where the overrides are blocked, set records this process's value, which reset would not.
+          if current_original == value.to_s && Profiler.env_override_store.blocked_reason.nil?
             Profiler.env_override_store.reset(key)
           else
             Profiler.env_override_store.set(key, value.to_s)
           end
           ENV[key] = value.to_s
-          render json: { key: key, value: ENV[key], override: Profiler.env_override_store.all_overrides[key] }
+          render json: { key: key, value: redacted_value(key), override: redacted_override(key) }
         end
       end
 
@@ -44,13 +52,23 @@ module Profiler
         end
 
         Profiler.env_override_store.reset(key)
-        render json: { key: key, value: ENV[key], reset: true }
+        render json: { key: key, value: redacted_value(key), reset: true }
       end
 
       def reset_all
         Profiler.env_override_store.reset_all
         render json: { reset: true }
       end
+
+      private
+
+      def redacted_value(key)
+        ENV[key].nil? ? nil : Profiler::Redaction.env_value(key, ENV[key])
+      end
+
+      def redacted_override(key)
+        Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)[key]
+      end
     end
   end
 end

data/lib/profiler/collectors/database_collector.rb

@@ -96,11 +96,15 @@ module Profiler
 
         binds.map do |bind|
           if bind.respond_to?(:value)
-            bind.value
+            name = bind.name if bind.respond_to?(:name)
+            Profiler::Redaction.filter_named(name, bind.value)
           else
             bind
           end
         end
+      rescue StandardError
+        # Never let the profiler raise into the application's query.
+        binds.map { Profiler::Redaction::MASK }
       end
 
       def extract_backtrace

data/lib/profiler/collectors/env_collector.rb

@@ -25,7 +25,7 @@ module Profiler
       end
 
       def collect
-        variables = ENV.to_h.sort.to_h
+        variables = Profiler::Redaction.env_snapshot
         store_data({ variables: variables, total: variables.size })
       end
 

data/lib/profiler/collectors/mailer_collector.rb

@@ -199,7 +199,19 @@ module Profiler
         klass = Object.const_get(mailer_class)
         params = klass.instance_method(action).parameters
         params.each_with_index.each_with_object({}) do |((_, name), i), h|
-          h[name.to_s] = serialize_assign(args[i])
+          h[name.to_s] = if Profiler::Redaction.sensitive_key?(name)
+            Profiler::Redaction::MASK
+          else
+            value = args[i]
+            # A hash or array goes through the filter by its keys, anything
+            # else by the parameter name: never both, so a proc runs once.
+            filtered = if value.is_a?(Hash) || value.is_a?(Array)
+              Profiler::Redaction.filter_value(value)
+            else
+              Profiler::Redaction.filter_named(name, value)
+            end
+            serialize_assign(filtered)
+          end
         end
       rescue StandardError
         {}

data/lib/profiler/collectors/request_collector.rb

@@ -91,7 +91,7 @@ module Profiler
         {
           route_name:        route_name ? "#{route_name}_path" : nil,
           route_pattern:     matched_route&.path&.spec&.to_s&.sub(/\(\.:format\)$/, ""),
-          route_params:      route_params,
+          route_params:      Profiler::Redaction.filter_hash(route_params),
           controller_action: controller_action
         }
       rescue StandardError

data/lib/profiler/configuration.rb

@@ -9,6 +9,22 @@ module Profiler
   FORGERY_PROTECTION_HEADER = "X-Profiler-Request"
 
   class Configuration
+    # Added to the application's own config.filter_parameters: the list of the
+    # Rails 7.1 application template, without :email.
+    DEFAULT_FILTER_PARAMETERS = %i[
+      passw secret token _key crypt salt certificate otp ssn cvv cvc
+    ].freeze
+
+    # ENV variables whose values the profiler shows; every other one is listed
+    # with its value masked.
+    DEFAULT_ENV_ALLOWLIST = %w[
+      RAILS_ENV RACK_ENV NODE_ENV RAILS_LOG_LEVEL RAILS_LOG_TO_STDOUT RAILS_SERVE_STATIC_FILES
+      RAILS_MAX_THREADS RAILS_MIN_THREADS WEB_CONCURRENCY PORT PIDFILE
+      LANG LANGUAGE LC_ALL LC_CTYPE TZ HOME PWD PATH SHELL USER HOSTNAME TERM
+      RUBY_VERSION RUBYOPT RUBY_YJIT_ENABLE MALLOC_ARENA_MAX
+      BUNDLE_GEMFILE BUNDLE_PATH BUNDLE_WITHOUT GEM_HOME GEM_PATH BOOTSNAP_CACHE_DIR
+    ].freeze
+
     attr_accessor :enabled, :storage_options, :collectors,
                   :skip_paths, :slow_query_threshold, :max_queries_warning,
                   :track_memory, :memory_warning_threshold,
@@ -19,9 +35,11 @@ module Profiler
                   :track_http, :slow_http_threshold, :http_skip_hosts, :http_backtrace_depth,
                   :track_jobs,
                   :track_console,
+                  :apply_env_overrides_when_disabled,
                   :track_tests,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold,
+                  :redact_sensitive_data, :filter_parameters, :env_allowlist,
                   :name, :master_url, :self_url,
                   :cluster_heartbeat_interval, :cluster_offline_threshold
 
@@ -60,6 +78,7 @@ module Profiler
       @http_backtrace_depth = 40
       @track_jobs = true
       @track_console = true
+      @apply_env_overrides_when_disabled = false
       @track_tests = false
       @track_mailers = true
       @capture_mail_body = false
@@ -67,6 +86,9 @@ module Profiler
       @mailer_skip_actions = []
       @compress_bodies = true
       @compress_body_threshold = 10 * 1024 # 10 KB
+      @redact_sensitive_data = true
+      @filter_parameters = DEFAULT_FILTER_PARAMETERS.dup
+      @env_allowlist = DEFAULT_ENV_ALLOWLIST.dup
       @tmp_path = nil
       @name = nil
       @master_url = nil

data/lib/profiler/env_override_store.rb

@@ -8,63 +8,108 @@ module Profiler
     DELETED_SENTINEL = "__profiler_deleted__"
     RESTORE_SENTINEL = "__profiler_restore__"
 
+    # Why the persisted overrides are left out of ENV, as logged at boot.
+    BLOCKED_REASONS = {
+      production: "persisted overrides are never applied in production; " \
+                  "delete the file if it was deployed by mistake",
+      disabled: "the profiler is disabled; set " \
+                "config.apply_env_overrides_when_disabled = true to apply them anyway"
+    }.freeze
+
     # File format: { "KEY" => { "value" => "...", "original" => "..." } }
     # Sentinels for "value":
     #   DELETED_SENTINEL  → ENV.delete(key)
     #   RESTORE_SENTINEL  → restore ENV[key] to "original" (cleaned up after apply!)
 
+    def initialize
+      # What ENV held in this process before set, delete or apply! changed a key. Where the
+      # overrides are blocked, a reset restores these and never the file's "original" values,
+      # which come from whatever machine wrote the file.
+      @process_originals = {}
+      @process_originals_lock = Mutex.new
+    end
+
     def set(key, value)
-      overrides = load_overrides
-      original = original_for(overrides, key)
-      overrides[key] = { "value" => value.to_s, "original" => original }
-      save_overrides(overrides)
+      remember_process_original(key)
+      update_overrides do |overrides|
+        overrides[key] = { "value" => value.to_s, "original" => original_for(overrides, key) }
+      end
     rescue => e
       warn "[Profiler] EnvOverrideStore: failed to set #{key}: #{e.message}"
     end
 
     def delete(key)
-      overrides = load_overrides
-      original = original_for(overrides, key)
-      overrides[key] = { "value" => DELETED_SENTINEL, "original" => original }
-      save_overrides(overrides)
+      remember_process_original(key)
+      update_overrides do |overrides|
+        overrides[key] = { "value" => DELETED_SENTINEL, "original" => original_for(overrides, key) }
+      end
     rescue => e
       warn "[Profiler] EnvOverrideStore: failed to delete #{key}: #{e.message}"
     end
 
+    # Returns whether ENV was written in this process.
     def reset(key)
-      overrides = load_overrides
-      entry = overrides[key]
-      return unless entry
-
-      original = entry["original"]
-      # Keep a RESTORE entry so Sidekiq workers pick it up on next job
-      overrides[key] = { "value" => RESTORE_SENTINEL, "original" => original }
-      save_overrides(overrides)
+      entry = nil
+      update_overrides do |overrides|
+        entry = overrides[key]
+        # Keep a RESTORE entry so Sidekiq workers pick it up on next job
+        overrides[key] = { "value" => RESTORE_SENTINEL, "original" => entry["original"] } if entry
+      end
 
       # Apply immediately to the current (web) process
-      original.nil? ? ENV.delete(key) : ENV[key] = original
+      restore_env(key, entry, blocked: blocked_reason)
     rescue => e
       warn "[Profiler] EnvOverrideStore: failed to reset #{key}: #{e.message}"
     end
 
     def reset_all
-      overrides = load_overrides
-      restore_overrides = {}
-
-      overrides.each do |key, entry|
-        original = entry.is_a?(Hash) ? entry["original"] : nil
-        # Apply immediately to the current (web) process
-        original.nil? ? ENV.delete(key) : ENV[key] = original
-        # Leave a RESTORE sentinel for Sidekiq workers to pick up
-        restore_overrides[key] = { "value" => RESTORE_SENTINEL, "original" => original }
+      originals = {}
+      update_overrides do |overrides|
+        overrides.each do |key, entry|
+          originals[key] = entry.is_a?(Hash) ? entry["original"] : nil
+          # Leave a RESTORE sentinel for Sidekiq workers to pick up
+          overrides[key] = { "value" => RESTORE_SENTINEL, "original" => originals[key] }
+        end
       end
 
-      restore_overrides.empty? ? clear : save_overrides(restore_overrides)
+      # Apply immediately to the current (web) process
+      blocked = blocked_reason
+      originals.each { |key, original| restore_env(key, { "original" => original }, blocked: blocked) }
     rescue => e
       warn "[Profiler] EnvOverrideStore: failed to reset all: #{e.message}"
     end
 
+    # Why the persisted overrides must not reach ENV in this process, or nil when they may.
+    def blocked_reason
+      return :production if defined?(Rails) && Rails.respond_to?(:env) && Rails.env.production?
+
+      config = Profiler.configuration
+      return :disabled unless config.enabled || config.apply_env_overrides_when_disabled
+
+      nil
+    end
+
+    # Applies the overrides at boot, or says once in the log why they are left out. The message
+    # carries the file and the number of keys only, never a key or a value.
+    def apply_at_boot!(logger)
+      reason = blocked_reason
+      return apply! unless reason
+      return if @boot_warning_logged
+
+      count = all_overrides.size
+      return if count.zero?
+
+      @boot_warning_logged = true
+      noun, verb = count == 1 ? %w[override was] : %w[overrides were]
+      logger&.warn("[Profiler] #{count} persisted environment #{noun} in #{override_file_path} " \
+                   "#{verb} not applied: #{BLOCKED_REASONS.fetch(reason)}.")
+    rescue => e
+      warn "[Profiler] EnvOverrideStore: failed to check overrides at boot: #{e.message}"
+    end
+
     def apply!
+      return if blocked_reason
+
       overrides = load_overrides
       restore_keys = []
 
@@ -72,6 +117,8 @@ module Profiler
         value    = entry.is_a?(Hash) ? entry["value"]    : entry
         original = entry.is_a?(Hash) ? entry["original"] : nil
 
+        remember_process_original(key) unless value == RESTORE_SENTINEL
+
         case value
         when DELETED_SENTINEL
           ENV.delete(key)
@@ -84,8 +131,13 @@ module Profiler
       end
 
       if restore_keys.any?
-        restore_keys.each { |k| overrides.delete(k) }
-        save_overrides(overrides)
+        # Read again under the lock: another writer may have changed the file since.
+        update_overrides do |current|
+          restore_keys.each do |k|
+            entry = current[k]
+            current.delete(k) if entry.is_a?(Hash) && entry["value"] == RESTORE_SENTINEL
+          end
+        end
       end
     rescue => e
       warn "[Profiler] EnvOverrideStore: failed to apply overrides: #{e.message}"
@@ -105,13 +157,34 @@ module Profiler
     end
 
     def clear
-      FileUtils.rm_f(override_file_path)
+      with_lock { FileUtils.rm_f(override_file_path) }
     rescue => e
       warn "[Profiler] EnvOverrideStore: failed to clear: #{e.message}"
     end
 
     private
 
+    def remember_process_original(key)
+      @process_originals_lock.synchronize do
+        @process_originals[key] = ENV[key] unless @process_originals.key?(key)
+      end
+    end
+
+    # Puts a reset key back to its original value and returns whether ENV was written. Where the
+    # overrides are blocked, or the file has no entry for the key, only a key this process
+    # changed itself is touched, back to the value it had here; ENV is left alone for any other.
+    def restore_env(key, file_entry, blocked:)
+      changed_here, process_original = @process_originals_lock.synchronize do
+        [@process_originals.key?(key), @process_originals.delete(key)]
+      end
+      from_process = blocked || file_entry.nil?
+      return false if from_process && !changed_here
+
+      original = from_process ? process_original : file_entry["original"]
+      original.nil? ? ENV.delete(key) : ENV[key] = original
+      true
+    end
+
     def original_for(overrides, key)
       overrides.key?(key) ? overrides[key]["original"] : ENV[key]
     end
@@ -129,10 +202,36 @@ module Profiler
       {}
     end
 
-    def save_overrides(overrides)
+    # Reads, changes and writes the file under the lock, so that the web process, its threads and
+    # the Sidekiq processes never save over each other's changes. The file is removed when the
+    # block leaves it empty.
+    def update_overrides
+      with_lock do
+        overrides = load_overrides
+        yield overrides
+        overrides.empty? ? FileUtils.rm_f(override_file_path) : save_overrides(overrides)
+      end
+    end
+
+    # An exclusive flock on a file next to the overrides file. Not reentrant: never nest it.
+    def with_lock
       path = override_file_path
       FileUtils.mkdir_p(path.dirname)
-      File.write(path, JSON.generate(overrides))
+      File.open("#{path}.lock", File::RDWR | File::CREAT, 0o644) do |lock|
+        lock.flock(File::LOCK_EX)
+        yield
+      end
+    end
+
+    # Written to a temporary file then renamed over the old one, so that a reader never sees a
+    # half-written file, which would parse as no override at all.
+    def save_overrides(overrides)
+      path = override_file_path
+      tmp = "#{path}.#{Process.pid}.#{Thread.current.object_id}.tmp"
+      File.write(tmp, JSON.generate(overrides))
+      File.rename(tmp, path)
+    ensure
+      FileUtils.rm_f(tmp) if tmp
     end
   end
 end

data/lib/profiler/explain_runner.rb

@@ -28,6 +28,10 @@ module Profiler
       query = queries[query_index]
       sql   = query["sql"].to_s
       binds = Array(query["binds"])
+      if binds.include?(Redaction::MASK)
+        raise ArgumentError, "EXPLAIN refused for query #{query_index}: one of its bind values was " \
+                             "filtered when captured (config.filter_parameters), so the query cannot be rebuilt"
+      end
 
       conn    = ActiveRecord::Base.connection
       adapter = conn.adapter_name.downcase

data/lib/profiler/instrumentation/net_http_instrumentation.rb

@@ -5,6 +5,7 @@ require "base64"
 require "zlib"
 require "stringio"
 require "securerandom"
+require_relative "../redaction"
 
 module Profiler
   module Instrumentation
@@ -20,7 +21,7 @@ module Profiler
           host = address.to_s
           return super if NetHttpInstrumentation.skip_host?(host)
 
-          url = build_url(host, port, req.path, use_ssl?)
+          url = Redaction.filter_url(build_url(host, port, req.path, use_ssl?))
           req_body = req.body.to_s
           # Fallback: body may be passed as the 2nd argument and only applied
           # to req inside super via req.set_body_internal(body)
@@ -43,7 +44,7 @@ module Profiler
               req_body = ""
             end
           end
-          req_headers = req.to_hash.transform_values { |v| v.join(", ") }
+          req_headers = Redaction.filter_headers(req.to_hash.transform_values { |v| v.join(", ") })
           req_content_type = req["content-type"].to_s
           processed_req = req_body.empty? ? { body: nil, encoding: "text" } : NetHttpInstrumentation.process_body(req_body, req_content_type)
 
@@ -83,7 +84,7 @@ module Profiler
             entry,
             status: response.code.to_i,
             duration: duration,
-            response_headers: response.to_hash.transform_values { |v| v.join(", ") },
+            response_headers: Redaction.filter_headers(response.to_hash.transform_values { |v| v.join(", ") }),
             response_body: processed_resp[:body],
             response_body_encoding: processed_resp[:encoding],
             response_size: resp_body_raw.bytesize
@@ -151,7 +152,8 @@ module Profiler
         if mime.match?(BINARY_CONTENT_TYPES)
           { body: Base64.strict_encode64(body.b), encoding: "base64" }
         else
-          text = body.encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")
+          text = Redaction.filter_body(body, content_type)
+                          .encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")
           { body: text, encoding: "text" }
         end
       end

data/lib/profiler/job_profiler.rb

@@ -2,6 +2,7 @@
 
 require_relative "models/profile"
 require_relative "current_context"
+require_relative "redaction"
 require_relative "collectors/job_collector"
 require_relative "collectors/database_collector"
 require_relative "collectors/cache_collector"
@@ -115,7 +116,7 @@ module Profiler
     def sanitize_arguments(args)
       return [] unless args
 
-      args.map do |arg|
+      Redaction.filter_value(args).map do |arg|
         case arg
         when String then arg.length > 200 ? "#{arg[0, 200]}..." : arg
         when Numeric, TrueClass, FalseClass, NilClass then arg

data/lib/profiler/mcp/tools/list_env_vars.rb

@@ -2,6 +2,7 @@
 
 require_relative "../slave_support"
 require_relative "../../env_override_store"
+require_relative "../../redaction"
 
 module Profiler
   module MCP
@@ -19,8 +20,8 @@ module Profiler
           filter = params["filter"]&.downcase
 
           if include_all
-            vars = ENV.to_h.sort.to_h
-            overrides = Profiler.env_override_store.all_overrides
+            vars = Profiler::Redaction.env_snapshot
+            overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
 
             vars = vars.select { |k, _| k.downcase.include?(filter) } if filter
 
@@ -39,7 +40,7 @@ module Profiler
             text += "|-----|--------------|------------|\n"
             text += rows.join("\n")
           else
-            overrides = Profiler.env_override_store.all_overrides
+            overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
             overrides = overrides.select { |k, _| k.downcase.include?(filter) } if filter
 
             if overrides.empty?

data/lib/profiler/mcp/tools/reset_env_var.rb

@@ -23,11 +23,10 @@ module Profiler
             return [{ type: "text", text: "No active override for #{key}." }]
           end
 
-          original = overrides[key]["original"]
-          Profiler.env_override_store.reset(key)
+          restored = Profiler.env_override_store.reset(key)
 
-          restored = original || "(unset)"
-          [{ type: "text", text: "Reset #{key} to original value: #{restored}" }]
+          done = restored ? "original value restored" : "ENV left unchanged"
+          [{ type: "text", text: "Reset #{key}: override removed, #{done} in this process." }]
         end
       end
     end

data/lib/profiler/mcp/tools/set_env_var.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "../slave_support"
+require_relative "../../redaction"
 
 module Profiler
   module MCP
@@ -11,6 +12,10 @@ module Profiler
           value = params["value"].to_s
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::Redaction.mask?(value)
+            return [{ type: "text", text: "Error: #{Profiler::Redaction::MASK} is the mask the profiler shows " \
+                                          "in place of a hidden value, not a value; #{key} was left unchanged." }]
+          end
 
           if (proxy = MCP::SlaveSupport.with_slave_proxy(params))
             proxy.patch_json("/_profiler/api/env_vars", { key: key, value: value })

data/lib/profiler/models/profile.rb

@@ -4,6 +4,7 @@ require "base64"
 require "securerandom"
 require "json"
 require "zlib"
+require_relative "../redaction"
 
 module Profiler
   module Models
@@ -46,7 +47,7 @@ module Profiler
         @finished_at = Time.now
         @duration = ((@finished_at - @started_at) * 1000).round(2) # milliseconds
         @status = status
-        @response_headers = response_headers
+        @response_headers = Redaction.filter_headers(response_headers)
       end
 
       def add_collector_data(name, data)
@@ -161,7 +162,7 @@ module Profiler
         if binary_content_type?(content_type)
           { body: Base64.strict_encode64(raw.b), encoding: "base64" }
         else
-          text = raw.encode("UTF-8", invalid: :replace, undef: :replace)
+          text = Redaction.filter_body(raw, content_type).encode("UTF-8", invalid: :replace, undef: :replace)
           if compress_body?(text)
             { body: Base64.strict_encode64(Zlib::Deflate.deflate(text)), encoding: "gzip+base64" }
           else
@@ -189,10 +190,14 @@ module Profiler
         ct.to_s.match?(%r{image/(?!svg)|application/(?:pdf|octet-stream|zip)|audio/|video/})
       end
 
+      LEGACY_FILTERED_PARAMS = %w[password password_confirmation token secret].freeze
+
       def sanitize_params(params)
         return {} unless params
 
-        params.to_h.except("password", "password_confirmation", "token", "secret")
+        return params.to_h.except(*LEGACY_FILTERED_PARAMS) unless Redaction.enabled?
+
+        Redaction.filter_hash(params.to_h)
       end
 
       ALLOWED_HEADERS = %w[
@@ -206,6 +211,7 @@ module Profiler
         env.select { |k, _| k.start_with?("HTTP_") }
            .transform_keys { |k| k.sub(/^HTTP_/, "").split("_").map(&:capitalize).join("-") }
            .select { |k, _| ALLOWED_HEADERS.include?(k) }
+           .then { |headers| Redaction.filter_headers(headers) }
       end
     end
   end

data/lib/profiler/railtie.rb

@@ -6,10 +6,6 @@ module Profiler
   class Railtie < Rails::Railtie
     config.profiler = ActiveSupport::OrderedOptions.new
 
-    initializer "profiler.apply_env_overrides" do
-      Profiler.env_override_store.apply!
-    end
-
     initializer "profiler.set_configs" do |app|
       # Set default configuration for Rails environment
       Profiler.configure do |config|
@@ -103,6 +99,13 @@ module Profiler
       end
     end
 
+    # After the application's config/initializers, so that `enabled` is the application's own.
+    # Declared last: an initializer without `after:` runs after the one declared before it, so
+    # one declared below this one would move past the application's initializers too.
+    initializer "profiler.apply_env_overrides", after: :load_config_initializers do
+      Profiler.env_override_store.apply_at_boot!(Rails.logger)
+    end
+
     console do
       next unless Profiler.configuration.enabled && Profiler.configuration.track_console
 

data/lib/profiler/redaction.rb

@@ -0,0 +1,421 @@
+# frozen_string_literal: true
+
+require "json"
+require "set"
+require "rack/utils"
+require "active_support/parameter_filter"
+
+module Profiler
+  # The single filter applied to everything the profiler captures: request
+  # params, headers, bodies and URLs (incoming and outgoing), SQL binds, job
+  # arguments, mailer arguments and ENV.
+  #
+  # It is built on ActiveSupport::ParameterFilter from the host application's
+  # Rails.application.config.filter_parameters plus
+  # Profiler.configuration.filter_parameters, so it follows Rails semantics:
+  # a symbol or string matches any key containing it, case-insensitively, at
+  # any nesting depth; a regexp is used as is; a proc rewrites values.
+  #
+  # It never raises: it runs inside notification subscribers and the Net::HTTP
+  # patch, where an exception would reach the application. When the filter
+  # fails (a proc that does not expect a value, say), the value is masked and
+  # the failure is logged once per error class, without the value.
+  module Redaction
+    MASK = "[FILTERED]"
+
+    # Matched by the filter on top of filter_parameters.
+    ALWAYS_FILTERED_HEADERS = %w[authorization proxy-authorization cookie set-cookie].freeze
+
+    # Headers whose value is a URL: their query string goes through the filter.
+    URL_HEADERS = %w[referer location content-location].freeze
+
+    JSON_TYPES = %r{\A(?:application|text)/(?:[\w.+-]+\+)?json\z}i
+    NDJSON_TYPES = %r{\A[\w.+-]+/x-ndjson\z}i
+    FORM_TYPE = "application/x-www-form-urlencoded"
+    MULTIPART_TYPE = %r{\Amultipart/}i
+
+    # The characters outside ASCII whose case folding yields ASCII letters
+    # (Unicode CaseFolding.txt): with any of them, a case-insensitive regexp
+    # can match an ASCII filter where a plain ASCII search cannot.
+    FOLDS_TO_ASCII = /[ßİʼnſǰẖ-ẚẞKff-st]/
+
+    # What makes a regexp filter unfit for a search of the whole body text:
+    # anchors, word boundaries and lookarounds can match a key on its own and
+    # fail on the same key inside the text.
+    CONTEXT_SENSITIVE_REGEXP = /\\[AzZbBG]|[\^$]|\(\?<?[=!]/
+
+    # Bound on the memo of names already tested against the filter.
+    KEY_CACHE_LIMIT = 10_000
+
+    # The value a name alone is tested with: procs in filter_parameters
+    # rewrite it in place, so it has to be a string, and a throwaway one.
+    PROBE = "x"
+
+    class << self
+      def enabled?
+        Profiler.configuration.redact_sensitive_data != false
+      end
+
+      # The ParameterFilter, rebuilt only when the list of filters changes.
+      def parameter_filter
+        compiled[:filter]
+      end
+
+      # Keys are masked by the filters that are not procs; the procs then
+      # rewrite each string left, once, under its own key. Running the procs
+      # through ParameterFilter instead would dup every other value first,
+      # Active Record models included.
+      def filter_hash(hash)
+        return hash unless enabled? && hash.is_a?(Hash)
+
+        state = compiled
+        masked = state[:plain].filter(hash)
+        state[:proc_filter] ? apply_procs_tree(masked, nil, hash, state[:procs]) : masked
+      rescue StandardError => e
+        report(e, "filtering a hash")
+        hash.transform_values { MASK }
+      end
+
+      # Filters any value: hashes through the filter, arrays element by
+      # element, anything else unchanged (it carries no key to match).
+      def filter_value(value)
+        return value unless enabled?
+
+        case value
+        when Hash then filter_hash(value)
+        when Array then value.map { |v| filter_value(v) }
+        else value
+        end
+      rescue StandardError => e
+        report(e, "filtering a value")
+        MASK
+      end
+
+      # A value known by its name (SQL bind, mailer argument): MASK when the
+      # name matches the filter, else the value as the procs of
+      # filter_parameters rewrite it.
+      def filter_named(name, value)
+        return value unless enabled? && name
+        return MASK if sensitive_key?(name)
+
+        apply_procs([name.to_s], value)
+      end
+
+      # Whether the name alone matches the filter. Memoized per name: header,
+      # ENV, column and key names come from a small set. A filter that raises
+      # makes the name sensitive.
+      def sensitive_key?(name)
+        key = name.to_s
+        state = compiled
+        known = state[:keys]
+        return known[key] if known.key?(key)
+
+        result = state[:plain].filter(key => +PROBE)[key] == MASK
+        known[key] = result if known.size < KEY_CACHE_LIMIT
+        result
+      rescue StandardError => e
+        report(e, "testing a name")
+        true
+      end
+
+      # Header names are tested as written and with dashes as underscores, so
+      # that X-Api-Key matches :_key as x_api_key would.
+      def sensitive_header?(name)
+        key = name.to_s.downcase
+        ALWAYS_FILTERED_HEADERS.include?(key) || sensitive_key?(key) || sensitive_key?(key.tr("-", "_"))
+      end
+
+      def filter_headers(headers)
+        return headers unless enabled? && headers.respond_to?(:each_with_object)
+
+        headers.each_with_object({}) do |(name, value), out|
+          out[name] = filter_header(name, value)
+        end
+      end
+
+      # Filters a raw body according to its content type. JSON, NDJSON and
+      # form-urlencoded bodies have their filtered keys masked, multipart
+      # bodies are masked entirely, and every other type is kept as is: they
+      # carry no key the filter can read, and masking HTML would hide the very
+      # pages being profiled.
+      #
+      # Bodies usually arrive as binary strings (rack.input, Net::HTTP): they
+      # are read as UTF-8, or as bytes when they are not valid UTF-8.
+      def filter_body(raw, content_type)
+        return raw unless enabled? && raw.is_a?(String) && !raw.empty?
+
+        mime = content_type.to_s.split(";").first.to_s.strip.downcase
+        text = readable(raw)
+        if mime.match?(JSON_TYPES)
+          filter_json(text, mime)
+        elsif mime.match?(NDJSON_TYPES)
+          text.split("\n", -1).map { |line| line.strip.empty? ? line : filter_json(line, mime) }.join("\n")
+        elsif mime == FORM_TYPE
+          filter_query(text)
+        elsif mime.match?(MULTIPART_TYPE)
+          "[FILTERED: #{mime} body, #{raw.bytesize} bytes]"
+        else
+          raw
+        end
+      rescue StandardError => e
+        report(e, "filtering a #{mime} body")
+        "[FILTERED: #{mime} body that could not be filtered, #{raw.bytesize} bytes]"
+      end
+
+      # Masks the filtered values of a query string, pair by pair, leaving the
+      # rest of the string exactly as it was.
+      def filter_query(query)
+        return query unless enabled? && query.is_a?(String) && !query.empty?
+
+        readable(query).split("&", -1).map do |pair|
+          name, value = pair.split("=", 2)
+          next pair if value.nil? || value.empty?
+
+          parsed = Rack::Utils.parse_nested_query(pair)
+          parameter_filter.filter(parsed) == parsed ? pair : "#{name}=#{MASK}"
+        rescue StandardError
+          # A pair Rack or the filter cannot handle is masked rather than trusted.
+          "#{name}=#{MASK}"
+        end.join("&")
+      end
+
+      # A URL, or a list of them as Rack 3 gives a repeated header.
+      def filter_url(url)
+        return url unless enabled?
+        return url.map { |u| filter_url(u) } if url.is_a?(Array)
+        return url unless url.is_a?(String)
+
+        rest, fragment = readable(url).split("#", 2)
+        base, query = rest.split("?", 2)
+        return url if query.nil?
+
+        "#{base}?#{filter_query(query)}#{"##{fragment}" if fragment}"
+      rescue StandardError => e
+        report(e, "filtering a URL")
+        MASK
+      end
+
+      # ENV as the profiler shows it: names kept, values masked unless the
+      # name is in config.env_allowlist and does not match the filter.
+      def env_snapshot(env = ENV.to_h)
+        listed = env_allowlist_matcher
+        env.sort.to_h { |name, value| [name, env_visible?(name, listed) ? apply_procs([name], value) : MASK] }
+      end
+
+      def env_value(name, value)
+        env_visible?(name) ? apply_procs([name.to_s], value) : MASK
+      end
+
+      # ENV overrides with the same rule applied to their current and original
+      # values. The deleted and restore markers are kept: they are not values.
+      def env_overrides(overrides)
+        overrides.to_h do |name, entry|
+          next [name, entry] if env_visible?(name) || !entry.is_a?(Hash)
+
+          masked = entry.to_h do |field, value|
+            [field, keep_override_field?(field, value) ? value : MASK]
+          end
+          [name, masked]
+        end
+      end
+
+      def env_visible?(name, listed = env_allowlist_matcher)
+        listed.call(name.to_s) && !(enabled? && sensitive_key?(name))
+      end
+
+      # Whether +value+, stripped, is the mask: a value exported while masked,
+      # which must never be written back as if it were the real one.
+      def mask?(value)
+        value.to_s.strip == MASK
+      end
+
+      private
+
+      def compiled
+        filters = current_filters
+        state = @compiled
+        return state if state && state[:filters] == filters
+
+        @reported = Set.new
+        procs, plain = filters.partition { |f| f.respond_to?(:call) }
+        @compiled = {
+          filters: filters,
+          filter: ActiveSupport::ParameterFilter.new(filters, mask: MASK),
+          plain: ActiveSupport::ParameterFilter.new(plain, mask: MASK),
+          proc_filter: procs.empty? ? nil : ActiveSupport::ParameterFilter.new(procs, mask: MASK),
+          procs: procs,
+          keys: {}
+        }.merge(text_matchers(filters))
+      end
+
+      # What the JSON pre-test needs: the string filters, downcased, for a
+      # plain search, and as one case-insensitive alternation as
+      # ParameterFilter builds it, for text outside ASCII; the regexp filters
+      # that can be searched for in the whole text. Procs rewrite values
+      # whatever the key, dotted filters match a key path, and other regexps
+      # depend on where the key ends: any of them makes the filters opaque,
+      # and every body is then parsed.
+      def text_matchers(filters)
+        procs = filters.any? { |f| f.respond_to?(:call) }
+        regexps, strings = filters.reject { |f| f.respond_to?(:call) }.partition { |f| f.is_a?(Regexp) }
+        opaque = procs ||
+                 filters.any? { |f| !f.respond_to?(:call) && f.to_s.include?(".") } ||
+                 regexps.any? { |r| r.source.match?(CONTEXT_SENSITIVE_REGEXP) } ||
+                 strings.any? { |s| !s.to_s.ascii_only? }
+        words = strings.map { |s| s.to_s.downcase }
+        {
+          opaque: opaque,
+          words: words,
+          words_regexp: words.empty? ? nil : Regexp.new(words.map { |w| Regexp.escape(w) }.join("|"), Regexp::IGNORECASE),
+          regexps: regexps
+        }
+      end
+
+      def filter_header(name, value)
+        return MASK if sensitive_header?(name)
+
+        value = filter_url(value) if URL_HEADERS.include?(name.to_s.downcase)
+        apply_procs([name.to_s, name.to_s.tr("-", "_")], value)
+      rescue StandardError => e
+        report(e, "filtering a header")
+        MASK
+      end
+
+      # The value as the procs of filter_parameters rewrite it under each of
+      # +names+. Nothing to do without procs: the names were already tested.
+      #
+      # Only strings: any other object would be duplicated for the procs,
+      # which runs the application's copy hooks; it is shown through its
+      # inspect, as before. The procs run once: under the first of +names+
+      # that changes the value, so that a proc which undoes itself (reverse!)
+      # is not applied twice.
+      def apply_procs(names, value)
+        return value unless enabled? && value.is_a?(String)
+
+        filter = compiled[:proc_filter]
+        return value unless filter
+
+        names.uniq.each do |name|
+          result = filter.filter(name => value)[name]
+          return result unless result == value
+        end
+        value
+      rescue StandardError => e
+        report(e, "applying a filter_parameters proc")
+        MASK
+      end
+
+      # Walks a tree the non-proc filters have already masked and lets the
+      # procs rewrite each string leaf, once, as ParameterFilter does: a copy
+      # of the key and of the value, and the original params for a proc of
+      # arity 3. A leaf masked by the filter is the MASK object itself and is
+      # left alone, also as ParameterFilter does; a value that only reads
+      # "[FILTERED]" is a different object and still goes to the procs.
+      def apply_procs_tree(value, key, original, procs)
+        case value
+        when Hash then value.each_with_object(value.class.new) { |(k, v), out| out[k] = apply_procs_tree(v, k, original, procs) }
+        when Array then value.map { |v| apply_procs_tree(v, key, original, procs) }
+        when String then key.nil? || value.equal?(MASK) ? value : call_procs(procs, key, value, original)
+        else value
+        end
+      end
+
+      def call_procs(procs, key, value, original)
+        key = key.dup if key.duplicable?
+        value = value.dup
+        procs.each { |b| b.arity == 2 ? b.call(key, value) : b.call(key, value, original) }
+        value
+      rescue StandardError => e
+        report(e, "applying a filter_parameters proc")
+        MASK
+      end
+
+      def keep_override_field?(field, value)
+        value.nil? ||
+          value == EnvOverrideStore::DELETED_SENTINEL ||
+          value == EnvOverrideStore::RESTORE_SENTINEL ||
+          !%w[value original].include?(field)
+      end
+
+      def env_allowlist_matcher
+        allowlist = Profiler.configuration.env_allowlist
+        return ->(_name) { true } if allowlist == :all
+
+        regexps, names = Array(allowlist).partition { |entry| entry.is_a?(Regexp) }
+        names = names.to_set(&:to_s)
+        ->(name) { names.include?(name) || regexps.any? { |r| r.match?(name) } }
+      end
+
+      def current_filters
+        filters = Array(Profiler.configuration.filter_parameters)
+        app_filters = rails_filter_parameters
+        app_filters.empty? ? filters : app_filters + filters
+      end
+
+      def rails_filter_parameters
+        return [] unless defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application
+
+        Array(::Rails.application.config.filter_parameters)
+      rescue StandardError
+        []
+      end
+
+      # The string as UTF-8 when it is valid UTF-8, else as bytes, so that
+      # string operations and regexps never meet an incompatible encoding.
+      def readable(string)
+        return string if string.encoding == Encoding::UTF_8 && string.valid_encoding?
+
+        utf8 = string.dup.force_encoding(Encoding::UTF_8)
+        utf8.valid_encoding? ? utf8 : string.b
+      end
+
+      def filter_json(text, mime)
+        return text unless json_needs_parse?(text)
+
+        parsed = JSON.parse(text)
+        filtered = filter_value(parsed)
+        filtered == parsed ? text : JSON.generate(filtered)
+      rescue JSON::ParserError, JSON::GeneratorError
+        "[FILTERED: unparseable #{mime} body, #{text.bytesize} bytes]"
+      end
+
+      # A cheap pre-test that spares the parse of a body in whose text no
+      # filter matches anywhere: no key of it can match either. Any match, in
+      # a key or in a value, sends the body to the parser, which also masks
+      # an unreadable body entirely. Text that is not valid UTF-8, holds an
+      # escape (a key can be written password) or, for a plain ASCII
+      # search, a character that case-folds onto ASCII letters is not judged
+      # here, nor is any body under opaque filters.
+      def json_needs_parse?(text)
+        state = compiled
+        return true if state[:opaque]
+        return true if text.encoding != Encoding::UTF_8 || text.include?("\\")
+
+        state[:regexps].any? { |r| r.match?(text) } || words_in_text?(state, text)
+      end
+
+      def words_in_text?(state, text)
+        words = state[:words]
+        return false if words.empty?
+        return state[:words_regexp].match?(text) unless text.ascii_only? || !text.match?(FOLDS_TO_ASCII)
+
+        lowered = text.downcase(:ascii)
+        words.any? { |word| lowered.include?(word) }
+      end
+
+      # Logs a failure of the filter once per error class, with no value and
+      # no message: either could carry what was being masked.
+      def report(error, during)
+        reported = (@reported ||= Set.new)
+        return if reported.include?(error.class)
+
+        reported << error.class
+        message = "[Profiler] Redaction: #{error.class} while #{during}; the value was masked instead."
+        logger = ::Rails.logger if defined?(::Rails) && ::Rails.respond_to?(:logger)
+        logger ? logger.warn(message) : Kernel.warn(message)
+      rescue StandardError
+        nil
+      end
+    end
+  end
+end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.6"
+  VERSION = "0.30.8"
 end

data/lib/profiler.rb

@@ -2,6 +2,7 @@
 
 require_relative "profiler/version"
 require_relative "profiler/configuration"
+require_relative "profiler/redaction"
 
 module Profiler
   class Error < StandardError; end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.6
+  version: 0.30.8
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -209,6 +209,7 @@ files:
 - lib/profiler/models/sql_query.rb
 - lib/profiler/models/timeline_event.rb
 - lib/profiler/railtie.rb
+- lib/profiler/redaction.rb
 - lib/profiler/sse/bus.rb
 - lib/profiler/sse/event_bus.rb
 - lib/profiler/sse/redis_event_bus.rb