rails-profiler 0.30.9 → 0.30.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3a3ebc22965fd603d63bafecef777474fc488912625ac2950e618566bce8f09
-  data.tar.gz: e82aa1ce06e0f24cfb65b86fe01a942557851735f596edb3172c3fd00d7941f3
+  metadata.gz: 9d1f1618012f3a987e45ec2f18c565acc7cda82685806ca78801e6fb892012b3
+  data.tar.gz: 0f8e433032ac46e974c6a4162afa9c44610f5fd424afdcaf7f12a601f983cfab
 SHA512:
-  metadata.gz: 857313cb42832f5992a26897cbe6cef4d7dd66d6f59b5fccc63c8758db55da54cd6e3587e254e3d1410db561b668782ef8f3fcda73e4535235efba1e9a34c9be
-  data.tar.gz: 1bd504a236e7c548011ceed8dcc1488b21bc89400d824306c2f90d8b1817290768a10264265ee093f78d295f873b72a250a00a96fc5fe04f54f85cd2d63597db
+  metadata.gz: 30be96f28f9d20d285b9105725cb0704ed97af7ea8e34d425f7bf3fb8b4ef2f739cded05ab68b1c2931a8424058c18245e72eddb797bbee15c8d2fc1754175e7
+  data.tar.gz: 70021a953b7a36fdff2287d9e46242761e02ea114aa6ad16344860e04cb1973d6a87095d120216b4c60b48e9187130ca7a8461b0627c35a90f683931f3ac632c

data/CHANGELOG.md

@@ -19,6 +19,41 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.10] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Test runner:** The test runner (the dashboard page and the MCP tool `run_tests`) only runs
+  the test files it discovers, `spec/**/*_spec.rb` and `test/**/*_test.rb` under the Rails root,
+  optionally with a line number (`spec/models/user_spec.rb:12`). Paths are compared after resolving
+  symbolic links. Any other path answers `422` over HTTP, or a tool error over MCP, and nothing is
+  started. The HTTP endpoint used to run any file under the Rails root, and `run_tests` any path at all.
+- **Test runner:** A selection sent with the wrong framework (a `test/**/*_test.rb` file for
+  `rspec`, or a spec for `minitest`) now answers `422` too, and so does a path holding a null byte,
+  which used to raise an error.
+- **Test runner:** The test process starts from the environment the shell gave Rails, copied when
+  the gem is loaded, plus the environment overrides set from the profiler, instead of the current
+  environment of the application. Overrides that make the test process, or the rbenv or asdf shim
+  that starts it, load or run other code are left out, with a warning naming them once: names
+  starting with `RUBY`, `GEM_`, `BUNDLE_`, `LD_`, `BASH_`, `RBENV_` and others, `NODE_OPTIONS`,
+  `PATH`, `SPEC_OPTS`, `PS4`, `SHELLOPTS`, any name holding a character other than a letter, a
+  digit or `_`, and the rest of the list in the README. Those keep their shell value, and so do
+  `DATABASE_URL` and `SECRET_KEY_BASE`, whose overrides were skipped but still reached the test
+  process, since an override is also written into the environment of the running application. A
+  variable deleted from the profiler is now unset in the test process, where it used to hold the
+  text `__profiler_deleted__`. Variables the application writes into `ENV` once loaded (`dotenv`
+  for instance) no longer reach the test process, which loads them itself when your test setup does.
+  The test process, which boots the same application, no longer replays the overrides on its own:
+  the runner marks it with `PROFILER_TEST_RUNNER_CHILD=1`, a name the env tools and the env vars
+  endpoint now refuse to set or delete (`422`, or a tool error over MCP).
+- **Test runner:** Test files are found when the path of the application holds `[` or `{`.
+- **Upgrading:** Nothing to do when you run the specs the profiler lists. To run any file under the
+  Rails root again, set `config.test_runner_allow_undiscovered_files = true`. The environment
+  overrides left out have no option, the list being a deny list that cannot be complete: set those
+  variables in the shell that starts Rails instead, the test process inherits them.
+
 ## [0.30.9] - 2026-10-04
 
 <!-- stamped -->

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -17,6 +17,12 @@ module Profiler
           return
         end
 
+        if Profiler::EnvOverrideStore.reserved_key?(key)
+          render json: { error: "#{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged" },
+                 status: :unprocessable_entity
+          return
+        end
+
         value = params[:value]
 
         if Profiler::Redaction.mask?(value)

data/app/controllers/profiler/api/test_runner_controller.rb

@@ -27,17 +27,11 @@ module Profiler
           return render json: { error: "No files selected" }, status: :unprocessable_entity
         end
 
-        # Validate paths are within Rails root (prevent path traversal)
-        root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
-        files.each do |f|
-          expanded = File.expand_path(File.join(root, f))
-          unless expanded.start_with?(root)
-            return render json: { error: "Invalid file path: #{f}" }, status: :unprocessable_entity
-          end
-        end
-
+        # Runner.start accepts only discovered test files
         run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
         render json: run.to_h, status: :created
+      rescue Profiler::TestRunner::InvalidFileError => e
+        render json: { error: e.message }, status: :unprocessable_entity
       end
 
       def show

data/lib/profiler/boot_env.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Profiler
+  # ENV as the shell gave it to the process, captured when the gem is loaded, before
+  # EnvOverrideStore#apply! or any override set from the profiler writes into ENV. The test
+  # runner builds the environment of the processes it starts from this copy, not from ENV.
+  BOOT_ENV = ENV.to_h.freeze unless const_defined?(:BOOT_ENV)
+end

data/lib/profiler/configuration.rb

@@ -36,7 +36,7 @@ module Profiler
                   :track_jobs,
                   :track_console,
                   :apply_env_overrides_when_disabled,
-                  :track_tests,
+                  :track_tests, :test_runner_allow_undiscovered_files,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold,
                   :redact_sensitive_data, :filter_parameters, :env_allowlist,
@@ -80,6 +80,9 @@ module Profiler
       @track_console = true
       @apply_env_overrides_when_disabled = false
       @track_tests = false
+      # The test runner only runs the files listed by its discovery. true restores the
+      # previous behavior: any file under the Rails root.
+      @test_runner_allow_undiscovered_files = false
       @track_mailers = true
       @capture_mail_body = false
       @sanitize_mailer_recipients = false

data/lib/profiler/env_override_store.rb

@@ -107,7 +107,18 @@ module Profiler
       warn "[Profiler] EnvOverrideStore: failed to check overrides at boot: #{e.message}"
     end
 
+    # Set by the test runner in the environment of the test process, to which it already gave
+    # the admitted overrides only (TestRunner::Runner.build_env).
+    TEST_RUNNER_CHILD_ENV = "PROFILER_TEST_RUNNER_CHILD"
+    RESERVED_KEY_ERROR = "#{TEST_RUNNER_CHILD_ENV} is reserved for the test runner"
+
+    # The env tools may not set or delete the test runner marker, whatever its case.
+    def self.reserved_key?(key)
+      key.to_s.upcase == TEST_RUNNER_CHILD_ENV
+    end
+
     def apply!
+      return if ENV[TEST_RUNNER_CHILD_ENV] == "1"
       return if blocked_reason
 
       overrides = load_overrides

data/lib/profiler/mcp/server.rb

@@ -389,7 +389,7 @@ module Profiler
       def define_tool(name:, description:, input_schema:, handler:)
         ::MCP::Tool.define(name: name, description: description, input_schema: input_schema) do |server_context: nil, **args|
           result = handler.call(args.transform_keys(&:to_s))
-          ::MCP::Tool::Response.new(result)
+          result.is_a?(::MCP::Tool::Response) ? result : ::MCP::Tool::Response.new(result)
         end
       end
 

data/lib/profiler/mcp/tools/delete_env_var.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 
 module Profiler
@@ -10,6 +11,12 @@ module Profiler
           key = params["key"].to_s.strip
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::EnvOverrideStore.reserved_key?(key)
+            return ::MCP::Tool::Response.new(
+              [{ type: "text", text: "Error: #{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged." }],
+              error: true
+            )
+          end
 
           if (proxy = MCP::SlaveSupport.with_slave_proxy(params))
             proxy.patch_json("/_profiler/api/env_vars", { key: key, value: "" })

data/lib/profiler/mcp/tools/run_tests.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "mcp"
+
 require_relative "../slave_support"
 
 require_relative "../../test_runner/discovery"
@@ -41,7 +43,11 @@ module Profiler
           end
 
           run_started_at = Time.now
-          run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
+          begin
+            run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
+          rescue Profiler::TestRunner::InvalidFileError => e
+            return ::MCP::Tool::Response.new([{ type: "text", text: e.message }], error: true)
+          end
 
           output_pos = 0
           deadline   = Time.now + timeout_secs

data/lib/profiler/mcp/tools/set_env_var.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 require_relative "../../redaction"
 
@@ -12,6 +13,12 @@ module Profiler
           value = params["value"].to_s
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::EnvOverrideStore.reserved_key?(key)
+            return ::MCP::Tool::Response.new(
+              [{ type: "text", text: "Error: #{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged." }],
+              error: true
+            )
+          end
           if Profiler::Redaction.mask?(value)
             return [{ type: "text", text: "Error: #{Profiler::Redaction::MASK} is the mask the profiler shows " \
                                           "in place of a hidden value, not a value; #{key} was left unchanged." }]

data/lib/profiler/test_runner/discovery.rb

@@ -24,8 +24,8 @@ module Profiler
                 end
 
         globs.each do |glob|
-          Dir.glob(File.join(root, glob)).each do |path|
-            relative = path.sub("#{root}/", "")
+          # base: keeps glob metacharacters of the root ([, {, *) out of the pattern
+          Dir.glob(glob, base: root).each do |relative|
             parts = relative.split("/")
             dir   = parts[0..-2].join("/")
             result[dir] ||= []

data/lib/profiler/test_runner/runner.rb

@@ -1,12 +1,27 @@
 # frozen_string_literal: true
 
+require "set"
+require_relative "../boot_env"
+require_relative "../env_override_store"
 require_relative "run_store"
 require_relative "discovery"
 
 module Profiler
   module TestRunner
+    # Raised by Runner.start when the selection holds a file that is not a discovered test.
+    class InvalidFileError < ArgumentError; end
+
     class Runner
+      # "spec/models/user_spec.rb:12" or ":12:30": the line selection rspec and minitest accept.
+      LINE_SUFFIX = /\A(.+?)((?::\d+)+)\z/
+
+      @warn_mutex = Mutex.new
+      @warned = {}
+
+      # Every caller (the HTTP controller, the MCP run_tests tool) goes through here, so the
+      # selection is checked once, before any run is recorded or any process is started.
       def self.start(files:, framework:)
+        validate_files!(files, framework)
         run = Profiler::TestRunner.run_store.create(files: files, framework: framework)
         spawn_async(run)
         run
@@ -26,6 +41,77 @@ module Profiler
         end
       end
 
+      # Accepts only files listed by Discovery.files for the framework, compared by their
+      # canonical path (File.realpath, symbolic links resolved), so that a test run cannot be
+      # used to execute any other Ruby file of the application.
+      def self.validate_files!(files, framework)
+        files = Array(files)
+        raise InvalidFileError, "No files selected" if files.empty?
+
+        root = project_root
+        allowed = if Profiler.configuration.test_runner_allow_undiscovered_files
+                    warn_once(:undiscovered,
+                              "[Profiler] config.test_runner_allow_undiscovered_files is enabled: the test runner " \
+                              "runs any file under the Rails root, not only the discovered tests.")
+                    nil
+                  else
+                    discovered_real_paths(root, framework)
+                  end
+
+        refused = files.reject do |entry|
+          next false unless entry.is_a?(String) && !entry.empty? && !entry.include?("\0")
+
+          path = entry[LINE_SUFFIX, 1] || entry
+          allowed ? allowed.include?(real_path(File.join(root, path))) : under_root?(root, File.join(root, path))
+        end
+        return if refused.empty?
+
+        message = allowed ? "Not a discovered test file" : "Not a file under the Rails root"
+        raise InvalidFileError, "#{message}: #{refused.map(&:to_s).join(", ")}"
+      end
+
+      def self.discovered_real_paths(root, framework)
+        real_root = real_path(root)
+        Discovery.files(framework: framework).flat_map { |dir| dir[:files] }.filter_map do |file|
+          path = real_path(File.join(root, file[:path]))
+          # A discovered symbolic link whose target leaves the project is not a project test.
+          path if path && real_root && path.start_with?("#{real_root}/")
+        end.to_set
+      end
+
+      def self.real_path(path)
+        File.realpath(path)
+      rescue SystemCallError, ArgumentError
+        nil
+      end
+
+      def self.under_root?(root, path)
+        expanded = File.expand_path(path)
+        expanded == root || expanded.start_with?("#{root}/")
+      end
+
+      def self.project_root
+        defined?(Rails) ? Rails.root.to_s : Dir.pwd
+      end
+
+      def self.warn_once(key, message)
+        @warn_mutex.synchronize do
+          return if @warned[key]
+
+          @warned[key] = true
+        end
+
+        if defined?(Rails) && Rails.respond_to?(:logger) && Rails.logger
+          Rails.logger.warn(message)
+        else
+          warn(message)
+        end
+      end
+
+      def self.reset_warnings!
+        @warn_mutex.synchronize { @warned = {} }
+      end
+
       private
 
       def self.spawn_async(run)
@@ -47,7 +133,8 @@ module Profiler
 
         Profiler::TestRunner.run_store.update(run.id, status: "running", started_at: Time.now)
 
-        IO.popen([env, *cmd, err: [:child, :out]], "r") do |io|
+        # unsetenv_others: the child gets exactly env, not the ENV of this process
+        IO.popen([env, *cmd, unsetenv_others: true, err: [:child, :out]], "r") do |io|
           Profiler::TestRunner.run_store.update(run.id, pid: io.pid)
 
           while (chunk = io.read(256))
@@ -69,7 +156,7 @@ module Profiler
       end
 
       def self.build_command(files, framework)
-        root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
+        root = project_root
         absolute_files = files.map { |f| File.join(root, f) }
 
         case framework.to_sym
@@ -82,22 +169,63 @@ module Profiler
         end
       end
 
-      BLOCKED_ENV_KEYS = %w[RAILS_ENV RACK_ENV DATABASE_URL SECRET_KEY_BASE].freeze
+      BLOCKED_ENV_KEYS = %w[RAILS_ENV RACK_ENV DATABASE_URL SECRET_KEY_BASE PROFILER_TEST_RUNNER_CHILD].freeze
+
+      # Overrides of these variables make the test process, or the shell shims (rbenv, asdf) that
+      # start it, load or run code other than the selected tests. It is a deny list, so it cannot
+      # be complete; a variable needed by the tests can be set in the shell that starts Rails.
+      CODE_LOADING_ENV_KEYS = %w[
+        SPEC_OPTS TESTOPTS TEST PATH HOME XDG_CONFIG_HOME GEMRC NODE_OPTIONS NODE_PATH
+        SHELLOPTS BASHOPTS PS4 ENV CDPATH IFS
+      ].freeze
+      CODE_LOADING_ENV_PREFIXES = %w[
+        RUBY GEM_ BUNDLE_ BUNDLER_ LD_ DYLD_ BASH_ RBENV_ ASDF_ RVM_ CHRUBY GIT_ BOOTSNAP_
+        PYTHON PERL5
+      ].freeze
+      ENV_NAME = /\A[A-Z_][A-Z0-9_]*\z/i
+
+      def self.code_loading_env_key?(key)
+        name = key.to_s.upcase
+        return true unless ENV_NAME.match?(name)
+
+        CODE_LOADING_ENV_KEYS.include?(name) || CODE_LOADING_ENV_PREFIXES.any? { |prefix| name.start_with?(prefix) }
+      end
 
+      # Starts from the copy of ENV taken when the gem was loaded, not from ENV: the overrides are
+      # also written into ENV (by the env vars endpoint, the MCP tools and EnvOverrideStore#apply!),
+      # and one whose entry the store lost would pass unnoticed. Only the overrides read from the
+      # store and admitted are applied on top; a left-out or blocked key keeps its shell value.
       def self.build_env
-        base = ENV.to_h
+        base = Profiler::BOOT_ENV.dup
+        left_out = []
 
-        # Inject env var overrides configured in the profiler — skip blocked keys
         overrides = Profiler.env_override_store.all_overrides
         overrides.each do |key, entry|
-          next if BLOCKED_ENV_KEYS.include?(key.upcase)
+          blocked = BLOCKED_ENV_KEYS.include?(key.upcase)
+          if blocked || code_loading_env_key?(key)
+            left_out << key unless blocked
+            next
+          end
           value = entry.is_a?(Hash) ? entry["value"] : entry
-          base[key] = value
+          if value == EnvOverrideStore::DELETED_SENTINEL
+            base.delete(key)
+          else
+            base[key] = value
+          end
+        end
+
+        unless left_out.empty?
+          warn_once([:env, left_out.sort],
+                    "[Profiler] Environment overrides not passed to the test runner, because they make it " \
+                    "load other code: #{left_out.sort.join(", ")}.")
         end
 
         # Ensure test environment regardless of overrides
         base["RAILS_ENV"] = "test"
         base["RACK_ENV"]  = "test"
+        # The test process boots the same application: its EnvOverrideStore#apply! must not
+        # replay the overrides left out above
+        base[EnvOverrideStore::TEST_RUNNER_CHILD_ENV] = "1"
 
         base
       end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.30.9"
+  VERSION = "0.30.10"
 end

data/lib/profiler.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+# First, so that the copy of ENV is taken before anything writes into it
+require_relative "profiler/boot_env"
 require_relative "profiler/version"
 require_relative "profiler/configuration"
 require_relative "profiler/redaction"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.30.9
+  version: 0.30.10
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -58,14 +58,14 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.3'
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -133,6 +133,7 @@ files:
 - config/routes.rb
 - exe/profiler-mcp
 - lib/profiler.rb
+- lib/profiler/boot_env.rb
 - lib/profiler/cluster/master_client.rb
 - lib/profiler/cluster/slave_proxy.rb
 - lib/profiler/cluster/slave_registry.rb