rails-profiler 0.30.8 → 0.30.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7edf1c383b05c79e4013d76c96fa57077b376f3a312c27aa355927ca1bb7e362
-  data.tar.gz: b1b9b6bd25f7f739c14d2afe72309fac7455e8f2c62b5e7d81e206a09b8ba4fa
+  metadata.gz: 9d1f1618012f3a987e45ec2f18c565acc7cda82685806ca78801e6fb892012b3
+  data.tar.gz: 0f8e433032ac46e974c6a4162afa9c44610f5fd424afdcaf7f12a601f983cfab
 SHA512:
-  metadata.gz: ca0ca79568606603601b5b33aa3ee69fb54d6497e8c8e2087f45cb8d78092ad0264ed8a8794472955e6b5608f743d198de31fcdf63493e40b7f538fd4c4d8298
-  data.tar.gz: fd3f7cb5326209b731f11abbca7e7e0b3b226ce019ea62f32636a137d1d402c26f692dc11754e27d3144bae0814524ea7be282031d8adacfe3bda5a97d3d4cc9
+  metadata.gz: 30be96f28f9d20d285b9105725cb0704ed97af7ea8e34d425f7bf3fb8b4ef2f739cded05ab68b1c2931a8424058c18245e72eddb797bbee15c8d2fc1754175e7
+  data.tar.gz: 70021a953b7a36fdff2287d9e46242761e02ea114aa6ad16344860e04cb1973d6a87095d120216b4c60b48e9187130ca7a8461b0627c35a90f683931f3ac632c

data/CHANGELOG.md

@@ -19,6 +19,69 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.10] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Test runner:** The test runner (the dashboard page and the MCP tool `run_tests`) only runs
+  the test files it discovers, `spec/**/*_spec.rb` and `test/**/*_test.rb` under the Rails root,
+  optionally with a line number (`spec/models/user_spec.rb:12`). Paths are compared after resolving
+  symbolic links. Any other path answers `422` over HTTP, or a tool error over MCP, and nothing is
+  started. The HTTP endpoint used to run any file under the Rails root, and `run_tests` any path at all.
+- **Test runner:** A selection sent with the wrong framework (a `test/**/*_test.rb` file for
+  `rspec`, or a spec for `minitest`) now answers `422` too, and so does a path holding a null byte,
+  which used to raise an error.
+- **Test runner:** The test process starts from the environment the shell gave Rails, copied when
+  the gem is loaded, plus the environment overrides set from the profiler, instead of the current
+  environment of the application. Overrides that make the test process, or the rbenv or asdf shim
+  that starts it, load or run other code are left out, with a warning naming them once: names
+  starting with `RUBY`, `GEM_`, `BUNDLE_`, `LD_`, `BASH_`, `RBENV_` and others, `NODE_OPTIONS`,
+  `PATH`, `SPEC_OPTS`, `PS4`, `SHELLOPTS`, any name holding a character other than a letter, a
+  digit or `_`, and the rest of the list in the README. Those keep their shell value, and so do
+  `DATABASE_URL` and `SECRET_KEY_BASE`, whose overrides were skipped but still reached the test
+  process, since an override is also written into the environment of the running application. A
+  variable deleted from the profiler is now unset in the test process, where it used to hold the
+  text `__profiler_deleted__`. Variables the application writes into `ENV` once loaded (`dotenv`
+  for instance) no longer reach the test process, which loads them itself when your test setup does.
+  The test process, which boots the same application, no longer replays the overrides on its own:
+  the runner marks it with `PROFILER_TEST_RUNNER_CHILD=1`, a name the env tools and the env vars
+  endpoint now refuse to set or delete (`422`, or a tool error over MCP).
+- **Test runner:** Test files are found when the path of the application holds `[` or `{`.
+- **Upgrading:** Nothing to do when you run the specs the profiler lists. To run any file under the
+  Rails root again, set `config.test_runner_allow_undiscovered_files = true`. The environment
+  overrides left out have no option, the list being a deny list that cannot be complete: set those
+  variables in the shell that starts Rails instead, the test process inherits them.
+
+## [0.30.9] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Database:** Explain only read-only queries. The **Explain** button, `POST /_profiler/api/explain`
+  and the MCP `explain_query` tool ran `EXPLAIN ANALYZE` on any stored query, and PostgreSQL's
+  `EXPLAIN ANALYZE` runs the statement it explains: explaining a `DELETE`, `UPDATE` or `INSERT` the
+  application had just run ran it a second time, for real. Only statements starting with `SELECT`,
+  `WITH`, `TABLE` or `VALUES` are explained now, and a writing CTE, `SELECT ... INTO`, `FOR UPDATE`
+  or a second statement is refused too, with a 422 from the endpoint and an error from the MCP tool.
+  The probe also runs in a transaction that is always rolled back, read-only on PostgreSQL.
+  Upgrading: nothing to set, and no setting brings back the explaining of writes, since the old
+  behaviour was to run them again; to see the plan of a write, run it yourself in `psql` between
+  `BEGIN` and `ROLLBACK`, as the README shows.
+- **Database:** Run the Explain probe on a connection of its own, opened outside the pool and closed
+  afterwards, so that nothing it does to its session outlives it: a `SELECT pg_try_advisory_lock(...)`
+  explained from a profile left the lock held by a connection of the pool. On PostgreSQL the probe
+  is also limited to 30 seconds (`statement_timeout`), and its EXPLAIN goes by the extended
+  protocol, which refuses a second statement.
+
+### Fixed
+
+- **Database:** Put bind values back correctly when explaining a query with ten binds or more
+  (`$10` was read as `$1` followed by `0`), and leave alone a `?` or `$1` inside a string literal or
+  inside a value already put back.
+
 ## [0.30.8] - 2026-10-04
 
 <!-- stamped -->

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -17,6 +17,12 @@ module Profiler
           return
         end
 
+        if Profiler::EnvOverrideStore.reserved_key?(key)
+          render json: { error: "#{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged" },
+                 status: :unprocessable_entity
+          return
+        end
+
         value = params[:value]
 
         if Profiler::Redaction.mask?(value)

data/app/controllers/profiler/api/test_runner_controller.rb

@@ -27,17 +27,11 @@ module Profiler
           return render json: { error: "No files selected" }, status: :unprocessable_entity
         end
 
-        # Validate paths are within Rails root (prevent path traversal)
-        root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
-        files.each do |f|
-          expanded = File.expand_path(File.join(root, f))
-          unless expanded.start_with?(root)
-            return render json: { error: "Invalid file path: #{f}" }, status: :unprocessable_entity
-          end
-        end
-
+        # Runner.start accepts only discovered test files
         run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
         render json: run.to_h, status: :created
+      rescue Profiler::TestRunner::InvalidFileError => e
+        render json: { error: e.message }, status: :unprocessable_entity
       end
 
       def show

data/lib/profiler/boot_env.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Profiler
+  # ENV as the shell gave it to the process, captured when the gem is loaded, before
+  # EnvOverrideStore#apply! or any override set from the profiler writes into ENV. The test
+  # runner builds the environment of the processes it starts from this copy, not from ENV.
+  BOOT_ENV = ENV.to_h.freeze unless const_defined?(:BOOT_ENV)
+end

data/lib/profiler/configuration.rb

@@ -36,7 +36,7 @@ module Profiler
                   :track_jobs,
                   :track_console,
                   :apply_env_overrides_when_disabled,
-                  :track_tests,
+                  :track_tests, :test_runner_allow_undiscovered_files,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold,
                   :redact_sensitive_data, :filter_parameters, :env_allowlist,
@@ -80,6 +80,9 @@ module Profiler
       @track_console = true
       @apply_env_overrides_when_disabled = false
       @track_tests = false
+      # The test runner only runs the files listed by its discovery. true restores the
+      # previous behavior: any file under the Rails root.
+      @test_runner_allow_undiscovered_files = false
       @track_mailers = true
       @capture_mail_body = false
       @sanitize_mailer_recipients = false

data/lib/profiler/env_override_store.rb

@@ -107,7 +107,18 @@ module Profiler
       warn "[Profiler] EnvOverrideStore: failed to check overrides at boot: #{e.message}"
     end
 
+    # Set by the test runner in the environment of the test process, to which it already gave
+    # the admitted overrides only (TestRunner::Runner.build_env).
+    TEST_RUNNER_CHILD_ENV = "PROFILER_TEST_RUNNER_CHILD"
+    RESERVED_KEY_ERROR = "#{TEST_RUNNER_CHILD_ENV} is reserved for the test runner"
+
+    # The env tools may not set or delete the test runner marker, whatever its case.
+    def self.reserved_key?(key)
+      key.to_s.upcase == TEST_RUNNER_CHILD_ENV
+    end
+
     def apply!
+      return if ENV[TEST_RUNNER_CHILD_ENV] == "1"
       return if blocked_reason
 
       overrides = load_overrides

data/lib/profiler/explain_runner.rb

@@ -1,9 +1,23 @@
 # frozen_string_literal: true
 
+require "profiler/sql_statement"
+
 module Profiler
   # Shared service for running EXPLAIN ANALYZE on a stored query.
   # Used by both the HTTP API controller and the MCP explain_query tool.
+  #
+  # Only read-only statements are explained: PostgreSQL's EXPLAIN ANALYZE runs the
+  # statement, so explaining a write would replay it. The probe itself runs, for
+  # what no reading of the statement can rule out (a function with a side effect),
+  # on a connection of its own that is closed afterwards, in a transaction that is
+  # always rolled back, read-only and time-limited on PostgreSQL.
   module ExplainRunner
+    # An ArgumentError, so callers answer it as a bad request (422, MCP error).
+    class UnsafeStatementError < ArgumentError; end
+
+    # PostgreSQL's EXPLAIN ANALYZE runs the query: a slow one is stopped after this.
+    PROBE_STATEMENT_TIMEOUT = "30s"
+
     # @param profile_token [String]
     # @param query_index   [Integer]
     # @return [Hash] { result:, format: "json"|"text", adapter: String }
@@ -35,11 +49,14 @@ module Profiler
 
       conn    = ActiveRecord::Base.connection
       adapter = conn.adapter_name.downcase
+      refusal = SqlStatement.read_only_refusal(sql, dialect: dialect_for(adapter))
+      raise UnsafeStatementError, refusal if refusal
+
       full_sql = reconstruct_sql(sql, binds, conn, adapter)
 
       explain_sql, format = build_explain_statement(full_sql, adapter)
 
-      rows = conn.exec_query(explain_sql, "EXPLAIN").to_a
+      rows = probe(explain_sql, adapter)
 
       result = if format == "json"
         # PostgreSQL / MySQL return JSON in rows[0]["QUERY PLAN"] or rows[0]["EXPLAIN"]
@@ -55,21 +72,51 @@ module Profiler
     private
 
     def self.reconstruct_sql(sql, binds, conn, adapter)
-      return sql if binds.empty?
+      SqlStatement.substitute(sql, binds, dialect: dialect_for(adapter)) { |value| conn.quote(value) }
+    end
 
-      if adapter.include?("postgresql")
-        result = sql.dup
-        binds.each_with_index do |value, i|
-          result = result.gsub("$#{i + 1}", conn.quote(value))
+    def self.dialect_for(adapter)
+      if adapter.include?("postgresql") then :postgresql
+      elsif adapter.include?("mysql") || adapter.include?("trilogy") then :mysql
+      else :sqlite
+      end
+    end
+
+    # Runs on a connection of its own, opened outside the pool and closed
+    # afterwards, so that nothing the probe does to its session outlives it (an
+    # advisory lock, a setting, a LISTEN), the application's own transaction is
+    # never touched, and a full pool does not keep Explain waiting.
+    # The transaction is always rolled back. On PostgreSQL it is also read-only and
+    # time-limited, and the EXPLAIN goes by the extended protocol, which refuses
+    # more than one statement: a COMMIT slipped in could not end the read-only
+    # transaction. Neither MySQL's EXPLAIN nor SQLite's EXPLAIN QUERY PLAN runs the
+    # statement.
+    def self.probe(explain_sql, adapter)
+      conn = open_probe_connection
+      begin
+        rows = nil
+        conn.transaction do
+          if adapter.include?("postgresql")
+            conn.execute("SET TRANSACTION READ ONLY")
+            conn.execute("SET LOCAL statement_timeout = #{conn.quote(PROBE_STATEMENT_TIMEOUT)}")
+            rows = conn.raw_connection.exec_params(explain_sql, []).to_a
+          else
+            rows = conn.exec_query(explain_sql, "EXPLAIN").to_a
+          end
+          raise ActiveRecord::Rollback
         end
-        result
+        rows
+      ensure
+        conn.disconnect!
+      end
+    end
+
+    def self.open_probe_connection
+      db_config = ActiveRecord::Base.connection_pool.db_config
+      if db_config.respond_to?(:new_connection) # Active Record 7.2 and later
+        db_config.new_connection
       else
-        # MySQL / SQLite: replace ? sequentially
-        result = sql.dup
-        binds.each do |value|
-          result = result.sub("?", conn.quote(value))
-        end
-        result
+        ActiveRecord::Base.public_send(db_config.adapter_method, db_config.configuration_hash)
       end
     end
 

data/lib/profiler/mcp/server.rb

@@ -139,7 +139,7 @@ module Profiler
           ),
           define_tool(
             name: "explain_query",
-            description: "Run EXPLAIN ANALYZE on a specific query from a profile. Returns the query execution plan with cost and row estimates. Only available in development/test environments.",
+            description: "Run EXPLAIN ANALYZE on a specific query from a profile. Returns the query execution plan with cost and row estimates. Only read-only statements (SELECT, WITH ... SELECT, TABLE, VALUES) are explained, in a transaction always rolled back; other queries return an error. Only available in development/test environments.",
             input_schema: {
               properties: {
                 token: { type: "string", description: "Profile token, or 'latest' for the most recent profile (required)" },
@@ -389,7 +389,7 @@ module Profiler
       def define_tool(name:, description:, input_schema:, handler:)
         ::MCP::Tool.define(name: name, description: description, input_schema: input_schema) do |server_context: nil, **args|
           result = handler.call(args.transform_keys(&:to_s))
-          ::MCP::Tool::Response.new(result)
+          result.is_a?(::MCP::Tool::Response) ? result : ::MCP::Tool::Response.new(result)
         end
       end
 

data/lib/profiler/mcp/tools/delete_env_var.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 
 module Profiler
@@ -10,6 +11,12 @@ module Profiler
           key = params["key"].to_s.strip
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::EnvOverrideStore.reserved_key?(key)
+            return ::MCP::Tool::Response.new(
+              [{ type: "text", text: "Error: #{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged." }],
+              error: true
+            )
+          end
 
           if (proxy = MCP::SlaveSupport.with_slave_proxy(params))
             proxy.patch_json("/_profiler/api/env_vars", { key: key, value: "" })

data/lib/profiler/mcp/tools/run_tests.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "mcp"
+
 require_relative "../slave_support"
 
 require_relative "../../test_runner/discovery"
@@ -41,7 +43,11 @@ module Profiler
           end
 
           run_started_at = Time.now
-          run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
+          begin
+            run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
+          rescue Profiler::TestRunner::InvalidFileError => e
+            return ::MCP::Tool::Response.new([{ type: "text", text: e.message }], error: true)
+          end
 
           output_pos = 0
           deadline   = Time.now + timeout_secs

data/lib/profiler/mcp/tools/set_env_var.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 require_relative "../../redaction"
 
@@ -12,6 +13,12 @@ module Profiler
           value = params["value"].to_s
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::EnvOverrideStore.reserved_key?(key)
+            return ::MCP::Tool::Response.new(
+              [{ type: "text", text: "Error: #{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged." }],
+              error: true
+            )
+          end
           if Profiler::Redaction.mask?(value)
             return [{ type: "text", text: "Error: #{Profiler::Redaction::MASK} is the mask the profiler shows " \
                                           "in place of a hidden value, not a value; #{key} was left unchanged." }]

data/lib/profiler/sql_statement.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require "strscan"
+
+module Profiler
+  # Reads a stored SQL statement the way the database would, one token at a time:
+  # comments, string literals and quoted identifiers are never mistaken for keywords
+  # or placeholders. Used by ExplainRunner to refuse anything but a read, and to put
+  # the bind values back into the statement.
+  module SqlStatement
+    # The first keyword of a statement EXPLAIN may run.
+    READ_ONLY_VERBS = %w[SELECT WITH TABLE VALUES].freeze
+
+    # Keywords that make a read-only verb write or lock: a CTE that writes,
+    # SELECT ... INTO (and MySQL's INTO OUTFILE), FOR UPDATE / FOR SHARE,
+    # LOCK IN SHARE MODE. Matched as whole words outside literals, so a column
+    # named `updated_at` is fine and an unquoted column named `share` is refused.
+    WRITE_KEYWORDS = %w[INSERT UPDATE DELETE MERGE TRUNCATE DROP ALTER CREATE INTO LOCK SHARE].freeze
+
+    Token = Struct.new(:type, :text)
+
+    # 'it''s' everywhere; 'it\'s' too where a backslash escapes. An unterminated
+    # literal runs to the end: the database refuses such a statement anyway.
+    PLAIN_LITERAL = /[Nn]?'(?:[^']|'')*'?/m
+    BACKSLASH_LITERAL = /[Nn]?'(?:[^'\\]|''|\\.)*'?/m
+    ESCAPE_LITERAL = /[Ee]'(?:[^'\\]|''|\\.)*'?/m
+
+    # Dialects differ in what a literal or a comment is: a backslash escapes a quote
+    # in every MySQL string but only in PostgreSQL's E'...' strings, dollar quoting
+    # is PostgreSQL's, backticks quote identifiers in MySQL and SQLite, MySQL starts
+    # a comment with `#` and needs a space after `--`, and only PostgreSQL nests
+    # block comments.
+    DIALECTS = %i[postgresql mysql sqlite].freeze
+
+    # @param dialect [Symbol] one of DIALECTS
+    # @return [String, nil] why the statement must not be explained, or nil when it reads only
+    def self.read_only_refusal(sql, dialect:)
+      all = tokenize(sql, dialect)
+      if dialect == :mysql && all.any? { |t| t.type == :comment && t.text.start_with?("/*!") }
+        return refusal("it holds a MySQL executable comment (/*! ... */)")
+      end
+
+      tokens = all.reject { |t| %i[space comment].include?(t.type) }
+      first = tokens.find { |t| t.type != :punct || t.text != "(" }
+      return refusal("it is empty") if first.nil?
+
+      verb = first.text.upcase
+      return refusal("it starts with #{verb}") unless first.type == :word && READ_ONLY_VERBS.include?(verb)
+
+      tokens.each_with_index do |token, i|
+        if token.type == :word && WRITE_KEYWORDS.include?(token.text.upcase)
+          return refusal("it contains #{token.text.upcase}")
+        end
+        if token.type == :punct && token.text == ";" && i != tokens.size - 1
+          return refusal("it holds more than one statement")
+        end
+      end
+      nil
+    end
+
+    # Replaces each placeholder by its quoted value in a single pass: `$1`, `$10`...
+    # by number (PostgreSQL), or `?` in order (MySQL, SQLite). Placeholders inside
+    # literals or comments stay as they are, and a substituted value is never read
+    # again. A placeholder without a value is left in place.
+    def self.substitute(sql, binds, dialect:, &quote)
+      return sql if binds.empty?
+
+      position = 0
+      tokenize(sql, dialect).map do |token|
+        index = case token.type
+                when :numbered then token.text[1..].to_i - 1
+                when :question then (position += 1) - 1
+                end
+        index && index >= 0 && index < binds.size ? quote.call(binds[index]) : token.text
+      end.join
+    end
+
+    def self.refusal(reason)
+      "EXPLAIN refused: only read-only statements (SELECT, WITH ... SELECT, TABLE, VALUES) " \
+        "are explained, and #{reason}. PostgreSQL's EXPLAIN ANALYZE runs the statement it explains."
+    end
+
+    # Splits the statement into tokens whose texts, joined, give it back unchanged.
+    def self.tokenize(sql, dialect)
+      raise ArgumentError, "unknown SQL dialect: #{dialect.inspect}" unless DIALECTS.include?(dialect)
+
+      s = StringScanner.new(sql.to_s)
+      tokens = []
+      until s.eos?
+        tokens << if s.scan(/\s+/)
+          Token.new(:space, s.matched)
+        elsif s.scan(dialect == :mysql ? /(?:--(?=\s|\z)|#)[^\n]*/ : /--[^\n]*/)
+          Token.new(:comment, s.matched)
+        elsif s.check(%r{/\*})
+          Token.new(:comment, scan_block_comment(s, nested: dialect == :postgresql))
+        elsif s.scan(dialect == :mysql ? BACKSLASH_LITERAL : PLAIN_LITERAL) ||
+              (dialect == :postgresql && s.scan(ESCAPE_LITERAL))
+          Token.new(:literal, s.matched)
+        elsif s.scan(/"(?:[^"]|"")*"?/m) || (dialect != :postgresql && s.scan(/`(?:[^`]|``)*`?/m))
+          Token.new(:identifier, s.matched)
+        elsif dialect == :postgresql && s.scan(/\$\d+/)
+          Token.new(:numbered, s.matched)
+        elsif dialect == :postgresql && s.scan(/\$([A-Za-z_][A-Za-z0-9_]*)?\$/)
+          tag = s.matched
+          body = s.scan_until(/#{Regexp.escape(tag)}/) || s.rest.tap { s.terminate }
+          Token.new(:literal, tag + body)
+        elsif dialect != :postgresql && s.scan(/\?/)
+          Token.new(:question, s.matched)
+        elsif s.scan(/[A-Za-z_][A-Za-z0-9_$]*/)
+          Token.new(:word, s.matched)
+        else
+          Token.new(:punct, s.getch)
+        end
+      end
+      tokens
+    end
+
+    # An unterminated block comment runs to the end.
+    def self.scan_block_comment(s, nested:)
+      text = +""
+      depth = 0
+      until s.eos?
+        if s.scan(%r{/\*})
+          depth += 1 if nested || depth.zero?
+        elsif s.scan(%r{\*/})
+          depth -= 1
+        else
+          s.getch
+        end
+        text << s.matched
+        break if depth.zero?
+      end
+      text
+    end
+
+    private_class_method :refusal, :tokenize, :scan_block_comment
+  end
+end

data/lib/profiler/test_runner/discovery.rb

@@ -24,8 +24,8 @@ module Profiler
                 end
 
         globs.each do |glob|
-          Dir.glob(File.join(root, glob)).each do |path|
-            relative = path.sub("#{root}/", "")
+          # base: keeps glob metacharacters of the root ([, {, *) out of the pattern
+          Dir.glob(glob, base: root).each do |relative|
             parts = relative.split("/")
             dir   = parts[0..-2].join("/")
             result[dir] ||= []

data/lib/profiler/test_runner/runner.rb

@@ -1,12 +1,27 @@
 # frozen_string_literal: true
 
+require "set"
+require_relative "../boot_env"
+require_relative "../env_override_store"
 require_relative "run_store"
 require_relative "discovery"
 
 module Profiler
   module TestRunner
+    # Raised by Runner.start when the selection holds a file that is not a discovered test.
+    class InvalidFileError < ArgumentError; end
+
     class Runner
+      # "spec/models/user_spec.rb:12" or ":12:30": the line selection rspec and minitest accept.
+      LINE_SUFFIX = /\A(.+?)((?::\d+)+)\z/
+
+      @warn_mutex = Mutex.new
+      @warned = {}
+
+      # Every caller (the HTTP controller, the MCP run_tests tool) goes through here, so the
+      # selection is checked once, before any run is recorded or any process is started.
       def self.start(files:, framework:)
+        validate_files!(files, framework)
         run = Profiler::TestRunner.run_store.create(files: files, framework: framework)
         spawn_async(run)
         run
@@ -26,6 +41,77 @@ module Profiler
         end
       end
 
+      # Accepts only files listed by Discovery.files for the framework, compared by their
+      # canonical path (File.realpath, symbolic links resolved), so that a test run cannot be
+      # used to execute any other Ruby file of the application.
+      def self.validate_files!(files, framework)
+        files = Array(files)
+        raise InvalidFileError, "No files selected" if files.empty?
+
+        root = project_root
+        allowed = if Profiler.configuration.test_runner_allow_undiscovered_files
+                    warn_once(:undiscovered,
+                              "[Profiler] config.test_runner_allow_undiscovered_files is enabled: the test runner " \
+                              "runs any file under the Rails root, not only the discovered tests.")
+                    nil
+                  else
+                    discovered_real_paths(root, framework)
+                  end
+
+        refused = files.reject do |entry|
+          next false unless entry.is_a?(String) && !entry.empty? && !entry.include?("\0")
+
+          path = entry[LINE_SUFFIX, 1] || entry
+          allowed ? allowed.include?(real_path(File.join(root, path))) : under_root?(root, File.join(root, path))
+        end
+        return if refused.empty?
+
+        message = allowed ? "Not a discovered test file" : "Not a file under the Rails root"
+        raise InvalidFileError, "#{message}: #{refused.map(&:to_s).join(", ")}"
+      end
+
+      def self.discovered_real_paths(root, framework)
+        real_root = real_path(root)
+        Discovery.files(framework: framework).flat_map { |dir| dir[:files] }.filter_map do |file|
+          path = real_path(File.join(root, file[:path]))
+          # A discovered symbolic link whose target leaves the project is not a project test.
+          path if path && real_root && path.start_with?("#{real_root}/")
+        end.to_set
+      end
+
+      def self.real_path(path)
+        File.realpath(path)
+      rescue SystemCallError, ArgumentError
+        nil
+      end
+
+      def self.under_root?(root, path)
+        expanded = File.expand_path(path)
+        expanded == root || expanded.start_with?("#{root}/")
+      end
+
+      def self.project_root
+        defined?(Rails) ? Rails.root.to_s : Dir.pwd
+      end
+
+      def self.warn_once(key, message)
+        @warn_mutex.synchronize do
+          return if @warned[key]
+
+          @warned[key] = true
+        end
+
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger.warn(message)
+        else
+          warn(message)
+        end
+      end
+
+      def self.reset_warnings!
+        @warn_mutex.synchronize { @warned = {} }
+      end
+
       private
 
       def self.spawn_async(run)
@@ -47,7 +133,8 @@ module Profiler
 
         Profiler::TestRunner.run_store.update(run.id, status: "running", started_at: Time.now)
 
-        IO.popen([env, *cmd, err: [:child, :out]], "r") do |io|
+        # unsetenv_others: the child gets exactly env, not the ENV of this process
+        IO.popen([env, *cmd, unsetenv_others: true, err: [:child, :out]], "r") do |io|
           Profiler::TestRunner.run_store.update(run.id, pid: io.pid)
 
           while (chunk = io.read(256))
@@ -69,7 +156,7 @@ module Profiler
       end
 
       def self.build_command(files, framework)
-        root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
+        root = project_root
         absolute_files = files.map { |f| File.join(root, f) }
 
         case framework.to_sym
@@ -82,22 +169,63 @@ module Profiler
         end
       end
 
-      BLOCKED_ENV_KEYS = %w[RAILS_ENV RACK_ENV DATABASE_URL SECRET_KEY_BASE].freeze
+      BLOCKED_ENV_KEYS = %w[RAILS_ENV RACK_ENV DATABASE_URL SECRET_KEY_BASE PROFILER_TEST_RUNNER_CHILD].freeze
+
+      # Overrides of these variables make the test process, or the shell shims (rbenv, asdf) that
+      # start it, load or run code other than the selected tests. It is a deny list, so it cannot
+      # be complete; a variable needed by the tests can be set in the shell that starts Rails.
+      CODE_LOADING_ENV_KEYS = %w[
+        SPEC_OPTS TESTOPTS TEST PATH HOME XDG_CONFIG_HOME GEMRC NODE_OPTIONS NODE_PATH
+        SHELLOPTS BASHOPTS PS4 ENV CDPATH IFS
+      ].freeze
+      CODE_LOADING_ENV_PREFIXES = %w[
+        RUBY GEM_ BUNDLE_ BUNDLER_ LD_ DYLD_ BASH_ RBENV_ ASDF_ RVM_ CHRUBY GIT_ BOOTSNAP_
+        PYTHON PERL5
+      ].freeze
+      ENV_NAME = /\A[A-Z_][A-Z0-9_]*\z/i
+
+      def self.code_loading_env_key?(key)
+        name = key.to_s.upcase
+        return true unless ENV_NAME.match?(name)
+
+        CODE_LOADING_ENV_KEYS.include?(name) || CODE_LOADING_ENV_PREFIXES.any? { |prefix| name.start_with?(prefix) }
+      end
 
+      # Starts from the copy of ENV taken when the gem was loaded, not from ENV: the overrides are
+      # also written into ENV (by the env vars endpoint, the MCP tools and EnvOverrideStore#apply!),
+      # and one whose entry the store lost would pass unnoticed. Only the overrides read from the
+      # store and admitted are applied on top; a left-out or blocked key keeps its shell value.
       def self.build_env
-        base = ENV.to_h
+        base = Profiler::BOOT_ENV.dup
+        left_out = []
 
-        # Inject env var overrides configured in the profiler — skip blocked keys
         overrides = Profiler.env_override_store.all_overrides
         overrides.each do |key, entry|
-          next if BLOCKED_ENV_KEYS.include?(key.upcase)
+          blocked = BLOCKED_ENV_KEYS.include?(key.upcase)
+          if blocked || code_loading_env_key?(key)
+            left_out << key unless blocked
+            next
+          end
           value = entry.is_a?(Hash) ? entry["value"] : entry
-          base[key] = value
+          if value == EnvOverrideStore::DELETED_SENTINEL
+            base.delete(key)
+          else
+            base[key] = value
+          end
+        end
+
+        unless left_out.empty?
+          warn_once([:env, left_out.sort],
+                    "[Profiler] Environment overrides not passed to the test runner, because they make it " \
+                    "load other code: #{left_out.sort.join(", ")}.")
         end
 
         # Ensure test environment regardless of overrides
         base["RAILS_ENV"] = "test"
         base["RACK_ENV"]  = "test"
+        # The test process boots the same application: its EnvOverrideStore#apply! must not
+        # replay the overrides left out above
+        base[EnvOverrideStore::TEST_RUNNER_CHILD_ENV] = "1"
 
         base
       end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.8"
+  VERSION = "0.30.10"
 end

data/lib/profiler.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# First, so that the copy of ENV is taken before anything writes into it
+require_relative "profiler/boot_env"
 require_relative "profiler/version"
 require_relative "profiler/configuration"
 require_relative "profiler/redaction"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.8
+  version: 0.30.10
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.3'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -133,6 +133,7 @@ files:
 - config/routes.rb
 - exe/profiler-mcp
 - lib/profiler.rb
+- lib/profiler/boot_env.rb
 - lib/profiler/cluster/master_client.rb
 - lib/profiler/cluster/slave_proxy.rb
 - lib/profiler/cluster/slave_registry.rb
@@ -210,6 +211,7 @@ files:
 - lib/profiler/models/timeline_event.rb
 - lib/profiler/railtie.rb
 - lib/profiler/redaction.rb
+- lib/profiler/sql_statement.rb
 - lib/profiler/sse/bus.rb
 - lib/profiler/sse/event_bus.rb
 - lib/profiler/sse/redis_event_bus.rb