rails-profiler 0.30.9 → 0.30.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a3a3ebc22965fd603d63bafecef777474fc488912625ac2950e618566bce8f09
-  data.tar.gz: e82aa1ce06e0f24cfb65b86fe01a942557851735f596edb3172c3fd00d7941f3
+  metadata.gz: e7bb3bed351c863507d670d29552cb6751bb023300728a48e9baf9c718a53659
+  data.tar.gz: 8af241a6ca0278f3ada6a4d0d88599e93b952f67057ba6b826ea36935976ba67
 SHA512:
-  metadata.gz: 857313cb42832f5992a26897cbe6cef4d7dd66d6f59b5fccc63c8758db55da54cd6e3587e254e3d1410db561b668782ef8f3fcda73e4535235efba1e9a34c9be
-  data.tar.gz: 1bd504a236e7c548011ceed8dcc1488b21bc89400d824306c2f90d8b1817290768a10264265ee093f78d295f873b72a250a00a96fc5fe04f54f85cd2d63597db
+  metadata.gz: 04d1ce9d5e1c0a2527ddb60280aa82e89e04ccc32a202a4f79e09b4a5fa87319b8f6d6c95a93f212a61cb4bc7213b92d15bb914567669a2f079eec502c075822
+  data.tar.gz: 91db3673cbcd3debdcf9fc1e02690601c4a70aaf10f4a17a070eed4b7f9359ae6261b5a9256ab43b9a13108aec0fa61677dddc9b735f72bf8103261f7e8b24f5

data/CHANGELOG.md

@@ -19,6 +19,113 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.30.11] - 2026-10-04
+
+<!-- stamped -->
+
+### Fixed
+
+- **Cluster:** A profile page served by the master now finds profiles held by a slave even before
+  the slave proxy has been used once.
+
+### Security
+
+- **MCP:** The HTTP transport at `/_profiler/mcp` is routed only when `mcp_enabled` is true and
+  `mcp_transport` is `:http`; it answers `404` otherwise. It used to be routed in every application,
+  whatever these options said, and to answer anyone: after the MCP handshake, any client could list
+  the tools and call those that write `ENV`, clear profiles or run the test suite. The stdio
+  transport (`rake profiler:mcp`) is unchanged.
+- **MCP:** When it is routed, each request to `/_profiler/mcp` passes the profiler's own checks
+  before the MCP server sees it, and gets a `403` otherwise: the profiler must be enabled, the
+  request must pass `authorization_mode`, and a `POST` must carry `Content-Type: application/json`
+  with no foreign `Origin`, so that a page on another site cannot call the tools from your browser.
+- **Cluster:** The cluster endpoints (`register`, `heartbeat`, `slaves` and the slave proxy) are
+  routed only on a node with the new `cluster_master = true`; they answer `404` otherwise. Every
+  application used to accept slave registrations.
+- **Cluster:** The master and its slaves authenticate each other with the new shared
+  `cluster_secret`, sent in an `X-Profiler-Cluster-Secret` header and compared in constant time:
+  `register` and `heartbeat` refuse a missing or wrong secret, and everything while no secret is
+  configured. On a slave, the master's proxied calls are let in by the secret, so a master on
+  another machine no longer needs the slave to admit its address.
+- **Cluster:** The master registers, and sends requests to, only the slave URLs allowed by the new
+  `cluster_allowed_slave_urls` (scheme, host and port, compared after normalization, and a path
+  prefix); the default refuses all. HTTPS is required, except for loopback addresses, for slave URLs
+  and for `master_url` (new `cluster_allow_insecure_http` to lift it), and the master no longer
+  returns the body of a redirect. Anyone who could register used to make the master fetch any host
+  and port it could reach and read the answer (server-side request forgery).
+- **Cluster:** A path, profile token or MCP argument sent to a slave can no longer leave the slave's
+  `/_profiler/api/`: `?`, `#` and `%` are encoded into the path segment, and a `.`, `..` or `/`
+  segment is refused before any request, on the slave proxy, the profile pages and the MCP tools.
+  An encoded `..` or `?` used to reach other paths of the slave.
+- **Cluster:** A `cluster_secret` shorter than 32 characters, or blank, is ignored as if none were
+  configured, with a warning at boot and an explicit error on registration. The master stores slave
+  URLs in their normalized form.
+- **Cluster:** The `cluster_secret` is masked by value in everything a profile captures (params,
+  bodies, headers in and out, URLs, `ENV`, SQL binds, job and mailer arguments, and the free text of
+  every collector: log lines, exception messages, dumps, SQL text, console expressions), and in the
+  output of the test runner, whatever name it travels under and even with `redact_sensitive_data`
+  off, on top of the masking by name.
+- **Cluster:** The `cluster_secret` is masked before text is shortened (flame graph names, I18n
+  values, console expressions and results, mail bodies and assigns, job arguments), so no prefix of
+  it is left, and the output of the test runner is masked across the pieces it is read in, so the
+  secret no longer comes back whole once they are joined. Only a secret the cluster accepts (32
+  characters or more) is masked by value.
+- **Cluster:** The output of the test runner holds back an end that could start the secret until
+  the process has finished printing, a killed run included, and holds back nothing else, so
+  progress output is shown as it comes. Binary bodies stored in base64, incoming, response and
+  outbound, are masked on their raw bytes before they are encoded.
+- **Upgrading:** Nothing to do if you use neither the MCP HTTP endpoint nor the cluster. Otherwise,
+  in `config/initializers/profiler.rb`:
+  - MCP over HTTP: set `config.mcp_enabled = true` and `config.mcp_transport = :http`. An
+    installation that used `/_profiler/mcp` while `mcp_transport` stayed at its default, `:stdio`,
+    must now set `:http`. The checks have no MCP-specific switch: `config.authorization_mode =
+    :allow_all` lets anybody who can reach the application call every tool, and
+    `config.api_forgery_protection = false` lets any website you visit make your browser call them.
+  - Cluster master: set `config.cluster_master = true`, `config.cluster_secret` (at least 32
+    characters, the same value on every node, from the environment) and
+    `config.cluster_allowed_slave_urls`. Slaves: set the same `config.cluster_secret`, and use HTTPS
+    URLs unless master and slave share the machine.
+  - To go back to the previous behavior: `config.cluster_require_secret = false` (with no
+    `cluster_secret`) accepts registrations from any client `authorization_mode` lets in, as in
+    0.30.6; `config.cluster_allowed_slave_urls = :any` accepts any slave URL, which reopens the
+    server-side request forgery; `config.cluster_allow_insecure_http = true` sends the secret and the
+    profiles in clear to remote hosts.
+
+## [0.30.10] - 2026-10-04
+
+<!-- stamped -->
+
+### Security
+
+- **Test runner:** The test runner (the dashboard page and the MCP tool `run_tests`) only runs
+  the test files it discovers, `spec/**/*_spec.rb` and `test/**/*_test.rb` under the Rails root,
+  optionally with a line number (`spec/models/user_spec.rb:12`). Paths are compared after resolving
+  symbolic links. Any other path answers `422` over HTTP, or a tool error over MCP, and nothing is
+  started. The HTTP endpoint used to run any file under the Rails root, and `run_tests` any path at all.
+- **Test runner:** A selection sent with the wrong framework (a `test/**/*_test.rb` file for
+  `rspec`, or a spec for `minitest`) now answers `422` too, and so does a path holding a null byte,
+  which used to raise an error.
+- **Test runner:** The test process starts from the environment the shell gave Rails, copied when
+  the gem is loaded, plus the environment overrides set from the profiler, instead of the current
+  environment of the application. Overrides that make the test process, or the rbenv or asdf shim
+  that starts it, load or run other code are left out, with a warning naming them once: names
+  starting with `RUBY`, `GEM_`, `BUNDLE_`, `LD_`, `BASH_`, `RBENV_` and others, `NODE_OPTIONS`,
+  `PATH`, `SPEC_OPTS`, `PS4`, `SHELLOPTS`, any name holding a character other than a letter, a
+  digit or `_`, and the rest of the list in the README. Those keep their shell value, and so do
+  `DATABASE_URL` and `SECRET_KEY_BASE`, whose overrides were skipped but still reached the test
+  process, since an override is also written into the environment of the running application. A
+  variable deleted from the profiler is now unset in the test process, where it used to hold the
+  text `__profiler_deleted__`. Variables the application writes into `ENV` once loaded (`dotenv`
+  for instance) no longer reach the test process, which loads them itself when your test setup does.
+  The test process, which boots the same application, no longer replays the overrides on its own:
+  the runner marks it with `PROFILER_TEST_RUNNER_CHILD=1`, a name the env tools and the env vars
+  endpoint now refuse to set or delete (`422`, or a tool error over MCP).
+- **Test runner:** Test files are found when the path of the application holds `[` or `{`.
+- **Upgrading:** Nothing to do when you run the specs the profiler lists. To run any file under the
+  Rails root again, set `config.test_runner_allow_undiscovered_files = true`. The environment
+  overrides left out have no option, the list being a deny list that cannot be complete: set those
+  variables in the shell that starts Rails instead, the test process inherits them.
+
 ## [0.30.9] - 2026-10-04
 
 <!-- stamped -->

data/app/controllers/profiler/api/cluster_controller.rb

@@ -1,8 +1,12 @@
 # frozen_string_literal: true
 
+require_relative "../../../../lib/profiler/cluster/security"
+
 module Profiler
   module Api
     class ClusterController < Profiler::ApplicationController
+      SLAVE_ACTIONS = %w[register heartbeat].freeze
+
       def register
         name = params[:name].to_s
         url  = params[:url].to_s
@@ -11,7 +15,11 @@ module Profiler
           return render json: { error: "name and url are required" }, status: :unprocessable_entity
         end
 
-        Profiler.slave_registry.register(name: name, url: url)
+        if (reason = Cluster::Security.slave_url_denial(url))
+          return render json: { error: reason }, status: :unprocessable_entity
+        end
+
+        Profiler.slave_registry.register(name: name, url: Cluster::Security.normalized_url(url))
         render json: { ok: true, name: name }
       end
 
@@ -28,6 +36,34 @@ module Profiler
       def slaves
         render json: { slaves: Profiler.slave_registry.all }
       end
+
+      private
+
+      # A slave is a server, often on another host, not a browser: it proves itself with the
+      # shared secret instead of the access guard and the forgery header. Without
+      # cluster_require_secret, and with no secret configured, the guard of the other
+      # endpoints applies, as in 0.30.6.
+      def authorize_request
+        return super unless secret_authenticated_action?
+        return if Cluster::Security.request_secret_valid?(request)
+
+        if (problem = Cluster::Security.secret_problem)
+          deny("#{problem} on this master: cluster requests are refused")
+        else
+          deny("Missing or invalid #{Cluster::Security::SECRET_HEADER} header")
+        end
+      end
+
+      # The secret is a custom header, which a cross-site page cannot send without a preflight.
+      def verified_request?
+        return Cluster::Security.request_secret_valid?(request) if secret_authenticated_action?
+
+        super
+      end
+
+      def secret_authenticated_action?
+        SLAVE_ACTIONS.include?(action_name) && Cluster::Security.secret_required?
+      end
     end
   end
 end

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -17,6 +17,12 @@ module Profiler
           return
         end
 
+        if Profiler::EnvOverrideStore.reserved_key?(key)
+          render json: { error: "#{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged" },
+                 status: :unprocessable_entity
+          return
+        end
+
         value = params[:value]
 
         if Profiler::Redaction.mask?(value)

data/app/controllers/profiler/api/slave_proxy_controller.rb

@@ -7,8 +7,10 @@ module Profiler
     class SlaveProxyController < Profiler::ApplicationController
       def forward
         proxy = Cluster::SlaveProxy.new(params[:slave_name])
-        sub_path = params[:path].to_s
-        full_path = "/_profiler/api/#{sub_path}"
+        # Each segment is escaped: a decoded "?" or "#" stays in its segment, and a dot segment
+        # is refused, so the request stays under the slave's API.
+        segments = params[:path].to_s.split("/", -1).map { |segment| Cluster::Security.escape_segment(segment) }
+        full_path = "/_profiler/api/#{segments.join("/")}"
 
         result = case request.method
                  when "GET"

data/app/controllers/profiler/api/test_runner_controller.rb

@@ -27,17 +27,11 @@ module Profiler
           return render json: { error: "No files selected" }, status: :unprocessable_entity
         end
 
-        # Validate paths are within Rails root (prevent path traversal)
-        root = defined?(Rails) ? Rails.root.to_s : Dir.pwd
-        files.each do |f|
-          expanded = File.expand_path(File.join(root, f))
-          unless expanded.start_with?(root)
-            return render json: { error: "Invalid file path: #{f}" }, status: :unprocessable_entity
-          end
-        end
-
+        # Runner.start accepts only discovered test files
         run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
         render json: run.to_h, status: :created
+      rescue Profiler::TestRunner::InvalidFileError => e
+        render json: { error: e.message }, status: :unprocessable_entity
       end
 
       def show

data/app/controllers/profiler/application_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../../lib/profiler/cluster/security"
+
 module Profiler
   class ApplicationController < ActionController::Base
     layout "profiler/application"
@@ -18,6 +20,8 @@ module Profiler
     end
 
     def authorize_request
+      # Checked first, so that :allow_local does not log a refusal for the master's calls.
+      return if cluster_master_request?
       return if Profiler.configuration.authorized?(request)
 
       deny("Not authorized to access the profiler")
@@ -32,7 +36,14 @@ module Profiler
     # Rails' token, or the header every profiler client sends. A third-party page cannot add a
     # custom header without a CORS preflight, which is refused unless an origin was allowed.
     def verified_request?
-      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present?
+      super || request.headers[Profiler::FORGERY_PROTECTION_HEADER].present? || cluster_master_request?
+    end
+
+    # On a slave, the master's proxied calls carry the shared secret, which stands for both the
+    # access guard and the forgery header. Never true on a node without master_url, or without
+    # a configured secret.
+    def cluster_master_request?
+      Profiler.configuration.slave? && Cluster::Security.request_secret_valid?(request)
     end
 
     def handle_unverified_request

data/app/controllers/profiler/profiles_controller.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../../../lib/profiler/cluster/slave_proxy"
+
 module Profiler
   class ProfilesController < ApplicationController
     def index

data/config/routes.rb

@@ -3,7 +3,12 @@
 require "profiler/mcp/server"
 
 Profiler::Engine.routes.draw do
-  mount Profiler::MCP::Server.rack_app, at: "mcp"
+  # Read on each request rather than when the routes are drawn: the application's initializer
+  # may set these options after the engine routes are loaded. A route that does not match
+  # answers 404, as if it were not there.
+  constraints(->(_request) { Profiler.configuration.mcp_http_enabled? }) do
+    mount Profiler::MCP::Server.rack_app, at: "mcp"
+  end
 
   root to: "profiles#index"
 
@@ -52,14 +57,16 @@ Profiler::Engine.routes.draw do
     delete "test_runner/runs/:id",        to: "test_runner#destroy"
     get    "events/:token",               to: "events#subscribe",  as: :profile_events
 
-    # Cluster endpoints (master-side)
-    post "cluster/register",  to: "cluster#register"
-    post "cluster/heartbeat", to: "cluster#heartbeat"
-    get  "cluster/slaves",    to: "cluster#slaves"
+    # Cluster endpoints (master-side), routed only on a node with cluster_master set
+    constraints(->(_request) { Profiler.configuration.cluster_master? }) do
+      post "cluster/register",  to: "cluster#register"
+      post "cluster/heartbeat", to: "cluster#heartbeat"
+      get  "cluster/slaves",    to: "cluster#slaves"
 
-    # Slave proxy — must be last to avoid shadowing other api routes
-    scope "/slaves/:slave_name" do
-      match "*path", to: "slave_proxy#forward", via: :all
+      # Slave proxy: must be last to avoid shadowing other api routes
+      scope "/slaves/:slave_name" do
+        match "*path", to: "slave_proxy#forward", via: :all
+      end
     end
   end
 end

data/lib/profiler/boot_env.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Profiler
+  # ENV as the shell gave it to the process, captured when the gem is loaded, before
+  # EnvOverrideStore#apply! or any override set from the profiler writes into ENV. The test
+  # runner builds the environment of the processes it starts from this copy, not from ENV.
+  BOOT_ENV = ENV.to_h.freeze unless const_defined?(:BOOT_ENV)
+end

data/lib/profiler/cluster/master_client.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "json"
 require "uri"
+require_relative "security"
 
 module Profiler
   module Cluster
@@ -22,10 +23,9 @@ module Profiler
 
       def register!
         config = Profiler.configuration
-        uri = URI("#{config.master_url}/_profiler/api/cluster/register")
+        uri = master_uri("register")
         body = { name: config.resolved_name, url: config.self_url }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
-                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
+        resp = Net::HTTP.post(uri, body, request_headers)
         unless resp.code.to_i.between?(200, 299)
           raise "Master returned #{resp.code}: #{resp.body.to_s.slice(0, 200)}"
         end
@@ -35,13 +35,31 @@ module Profiler
 
       def heartbeat!
         config = Profiler.configuration
-        uri = URI("#{config.master_url}/_profiler/api/cluster/heartbeat")
+        uri = master_uri("heartbeat")
         body = { name: config.resolved_name }.to_json
-        resp = Net::HTTP.post(uri, body, "Content-Type" => "application/json",
-                                          Profiler::FORGERY_PROTECTION_HEADER => "1")
+        resp = Net::HTTP.post(uri, body, request_headers)
         raise "Heartbeat rejected #{resp.code}" unless resp.code.to_i.between?(200, 299)
       end
 
+      # Refused before any request when the secret would cross the network in clear, or when
+      # there is no secret for the master to accept.
+      def master_uri(action)
+        config = Profiler.configuration
+        if (reason = Security.master_url_denial(config.master_url))
+          raise reason
+        end
+        if Security.secret_required? && (problem = Security.secret_problem)
+          raise "#{problem}: the master refuses registration without a secret"
+        end
+
+        URI("#{config.master_url}/_profiler/api/cluster/#{action}")
+      end
+
+      def request_headers
+        { "Content-Type" => "application/json", Profiler::FORGERY_PROTECTION_HEADER => "1" }
+          .merge(Security.outgoing_headers)
+      end
+
       def start_heartbeat_thread
         Thread.new do
           interval = Profiler.configuration.cluster_heartbeat_interval

data/lib/profiler/cluster/security.rb

@@ -0,0 +1,179 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+require "uri"
+require "active_support/security_utils"
+
+module Profiler
+  module Cluster
+    # The rules a master and its slaves apply to each other: the shared secret they exchange,
+    # and the URLs a master agrees to send requests to.
+    module Security
+      SECRET_HEADER = "X-Profiler-Cluster-Secret"
+      SECRET_ENV_KEY = "HTTP_X_PROFILER_CLUSTER_SECRET"
+      # A shorter secret, or a blank one, is treated as if none were configured.
+      MIN_SECRET_LENGTH = 32
+      API_PREFIX = "/_profiler/api/"
+
+      class << self
+        # Whether a secret has to be presented. False only with cluster_require_secret = false
+        # and no cluster_secret, the behaviour of 0.30.6.
+        def secret_required?
+          config = Profiler.configuration
+          config.cluster_require_secret || configured_secret?
+        end
+
+        def configured_secret?
+          secret_problem.nil?
+        end
+
+        # Why the configured secret cannot be used, or nil when it can.
+        def secret_problem
+          secret = Profiler.configuration.cluster_secret.to_s
+          return "No config.cluster_secret is configured" if secret.strip.empty?
+          return nil if secret.strip.length >= MIN_SECRET_LENGTH
+
+          "config.cluster_secret is shorter than #{MIN_SECRET_LENGTH} characters, so it is ignored " \
+            "as if none were configured"
+        end
+
+        # Logged once at boot on a cluster node whose secret cannot be used, since every cluster
+        # request is then refused.
+        def warn_about_configuration(logger)
+          config = Profiler.configuration
+          return unless config.cluster_master? || config.slave?
+          return unless (problem = secret_problem) && secret_required?
+
+          logger.warn("[Profiler Cluster] #{problem}: registrations, heartbeats and proxied requests " \
+                      "are refused. Generate one with `ruby -rsecurerandom -e 'puts SecureRandom.hex(32)'` " \
+                      "and give the same value to every node.")
+        end
+
+        # Constant-time comparison of the secret a request carries with the configured one.
+        # Always false when no usable secret is configured.
+        def valid_secret?(presented)
+          return false unless configured_secret?
+
+          expected = Profiler.configuration.cluster_secret.to_s
+          return false if presented.to_s.empty?
+
+          ActiveSupport::SecurityUtils.secure_compare(presented.to_s, expected)
+        end
+
+        def request_secret_valid?(request)
+          valid_secret?(request.get_header(SECRET_ENV_KEY))
+        end
+
+        # The headers to send with a request to another node of the cluster.
+        def outgoing_headers
+          configured_secret? ? { SECRET_HEADER => Profiler.configuration.cluster_secret.to_s } : {}
+        end
+
+        # Returns nil when the master may send requests to this slave URL, otherwise the reason.
+        def slave_url_denial(url)
+          config = Profiler.configuration
+          target = normalize(url)
+          return "#{url.inspect} is not a valid http(s) URL" unless target
+
+          if target[:scheme] == "http" && !loopback_host?(target[:host]) && !config.cluster_allow_insecure_http
+            return "#{url} uses plain HTTP to a host that is not a loopback address: HTTPS is required " \
+                   "(or set config.cluster_allow_insecure_http = true)"
+          end
+
+          allowed = config.cluster_allowed_slave_urls
+          return nil if allowed == :any
+          return nil if Array(allowed).any? { |entry| covers?(normalize(entry), target) }
+
+          "#{url} is not allowed by config.cluster_allowed_slave_urls"
+        end
+
+        # Same transport rule for the master URL a slave sends its secret to.
+        def master_url_denial(url)
+          target = normalize(url)
+          return "master_url #{url.inspect} is not a valid http(s) URL" unless target
+          return nil if target[:scheme] == "https" || loopback_host?(target[:host])
+          return nil if Profiler.configuration.cluster_allow_insecure_http
+
+          "master_url #{url} uses plain HTTP to a host that is not a loopback address: HTTPS is required " \
+            "(or set config.cluster_allow_insecure_http = true)"
+        end
+
+        # The URL as the registry keeps it: lower-case scheme and host, no default port, IPv6
+        # between brackets, path segments re-encoded, no trailing slash. Nil when not acceptable.
+        def normalized_url(url)
+          parts = normalize(url)
+          return nil unless parts
+
+          host = parts[:host].include?(":") ? "[#{parts[:host]}]" : parts[:host]
+          default_port = parts[:scheme] == "https" ? 443 : 80
+          port = parts[:port] == default_port ? "" : ":#{parts[:port]}"
+          path = parts[:segments].map { |segment| escape_segment(segment) }.join("/")
+          "#{parts[:scheme]}://#{host}#{port}#{path.empty? ? "" : "/#{path}"}"
+        end
+
+        # One path segment of a request to a slave, from a value that may come from a client (a
+        # proxied path, a profile token). "?", "#" and "%" are encoded, so they stay in the
+        # segment; ".", ".." and anything holding a "/" are refused, so the request cannot leave
+        # the slave's API.
+        def escape_segment(value)
+          segment = value.to_s
+          if segment.empty? || segment == "." || segment == ".." || segment.match?(%r{[/\\]})
+            raise Profiler::Error, "Refusing to send #{segment.inspect} as a path segment to a slave profiler"
+          end
+
+          URI.encode_www_form_component(segment).gsub("+", "%20")
+        end
+
+        # The final check on a path sent to a slave: under /_profiler/api/, with no dot or empty
+        # segment once decoded.
+        def api_path_denial(path)
+          raw = path.to_s.split("?", 2).first
+          return "#{path.inspect} is not under #{API_PREFIX}" unless raw.start_with?(API_PREFIX)
+
+          segments = raw.delete_prefix("/").split("/", -1)
+          decoded = segments.map { |segment| URI.decode_www_form_component(segment) }
+          return nil if decoded.none? { |segment| segment.empty? || segment == "." || segment == ".." || segment.include?("/") }
+
+          "#{path.inspect} holds an empty, \".\", \"..\" or encoded \"/\" path segment"
+        rescue ArgumentError
+          "#{path.inspect} is not a valid path"
+        end
+
+        # Scheme, host and port compared after normalization (case, default port, IPv6 brackets),
+        # and a path prefix compared segment by segment.
+        def covers?(entry, target)
+          return false unless entry
+
+          entry[:scheme] == target[:scheme] && entry[:host] == target[:host] && entry[:port] == target[:port] &&
+            (entry[:segments].empty? || target[:segments].first(entry[:segments].size) == entry[:segments])
+        end
+
+        # Returns { scheme:, host:, port:, segments: }, or nil for anything that is not a plain
+        # http(s) URL: user info, a query, a fragment, or a "." or ".." path segment are refused
+        # rather than interpreted.
+        def normalize(url)
+          uri = URI.parse(url.to_s.strip)
+          return nil unless uri.is_a?(URI::HTTP) && uri.host && !uri.host.empty?
+          return nil if uri.userinfo || uri.query || uri.fragment
+
+          segments = uri.path.to_s.split("/").reject(&:empty?)
+          decoded = segments.map { |segment| URI.decode_www_form_component(segment) }
+          return nil if decoded.any? { |segment| segment == "." || segment == ".." || segment.include?("/") }
+
+          { scheme: uri.scheme.downcase, host: uri.hostname.downcase, port: uri.port, segments: decoded }
+        rescue URI::Error, ArgumentError
+          nil
+        end
+
+        def loopback_host?(host)
+          host = host.to_s.downcase
+          return true if host == "localhost"
+
+          IPAddr.new(host).loopback?
+        rescue IPAddr::Error
+          false
+        end
+      end
+    end
+  end
+end

data/lib/profiler/cluster/slave_proxy.rb

@@ -3,6 +3,7 @@
 require "net/http"
 require "json"
 require "uri"
+require_relative "security"
 
 module Profiler
   module Cluster
@@ -15,6 +16,15 @@ module Profiler
         entry = Profiler.slave_registry.find!(slave_name)
         raise Profiler::Error, "Slave profiler '#{slave_name}' is offline" if entry.status == "offline"
 
+        # Checked again on every use: the URL was registered earlier, under a configuration that
+        # may have changed since.
+        if (reason = Security.slave_url_denial(entry.url))
+          raise Profiler::Error, "Slave profiler '#{slave_name}' refused: #{reason}"
+        end
+        if Security.secret_required? && (problem = Security.secret_problem)
+          raise Profiler::Error, "#{problem}: requests to slave profilers are refused"
+        end
+
         @base_url = entry.url.to_s.chomp("/")
         @open_timeout = open_timeout || OPEN_TIMEOUT
         @read_timeout = read_timeout || READ_TIMEOUT
@@ -30,7 +40,7 @@ module Profiler
       end
 
       def load(token)
-        data = get_json("/_profiler/api/profiles/#{token}")
+        data = get_json("/_profiler/api/profiles/#{Security.escape_segment(token)}")
         return nil unless data["token"] || data["profile"]
 
         raw = data["profile"] || data
@@ -69,7 +79,14 @@ module Profiler
 
       private
 
+      # Every request carries the secret, so its path must stay under the slave's API: values
+      # from clients are escaped by Security.escape_segment where they are interpolated, and
+      # this refuses whatever still reaches here with a dot segment.
       def build_uri(path, params = {})
+        if (reason = Security.api_path_denial(path))
+          raise Profiler::Error, "Refusing to send a request to a slave profiler: #{reason}"
+        end
+
         uri = URI("#{@base_url}#{path}")
         unless params.empty?
           uri.query = URI.encode_www_form(params.compact.transform_values(&:to_s))
@@ -87,12 +104,18 @@ module Profiler
 
       def request(uri, req)
         req[Profiler::FORGERY_PROTECTION_HEADER] = "1"
+        Security.outgoing_headers.each { |name, value| req[name] = value }
+        # Net::HTTP never follows a redirect; a 3xx is reported, without its body, rather than
+        # handed back as if the slave had answered.
         resp = Net::HTTP.start(uri.hostname, uri.port,
                                open_timeout: @open_timeout, read_timeout: @read_timeout,
                                use_ssl: uri.scheme == "https") do |http|
           http.request(req)
         end
         return {} if resp.code == "204"
+        if resp.code.to_s.start_with?("3")
+          raise Profiler::Error, "Slave profiler answered #{resp.code} (redirect not followed)"
+        end
 
         parse_response(resp)
       end

data/lib/profiler/collectors/base_collector.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative "../redaction"
+
 module Profiler
   module Collectors
     class BaseCollector

data/lib/profiler/collectors/console_collector.rb

@@ -13,7 +13,7 @@ module Profiler
       end
 
       def set_return_value(value)
-        @return_value = value.inspect.slice(0, 10_000)
+        @return_value = Profiler::Redaction.truncate(value.inspect, 10_000, "")
         @return_value_captured = true
       rescue
         @return_value = "(uninspectable)"
@@ -50,7 +50,7 @@ module Profiler
       end
 
       def toolbar_summary
-        { text: @expression.to_s[0, 30], color: "blue" }
+        { text: Profiler::Redaction.truncate(@expression, 30, ""), color: "blue" }
       end
     end
   end