rails-profiler 0.30.9 → 0.30.11

data/lib/profiler/collectors/flamegraph_collector.rb

@@ -86,7 +86,7 @@ module Profiler
 
           sql = payload[:sql].to_s
           add_event Models::TimelineEvent.new(
-            name: sql.length > 80 ? "#{sql[0, 80]}..." : sql,
+            name: Profiler::Redaction.truncate(sql, 80),
             started_at: started,
             finished_at: finished,
             category: "sql",
@@ -100,7 +100,7 @@ module Profiler
             op = name.split(".").first.sub("cache_", "")
             key = payload[:key].to_s
             add_event Models::TimelineEvent.new(
-              name: "cache_#{op}: #{key.length > 60 ? "#{key[0, 60]}..." : key}",
+              name: "cache_#{op}: #{Profiler::Redaction.truncate(key, 60)}",
               started_at: started,
               finished_at: finished,
               category: "cache",

data/lib/profiler/collectors/i18n_collector.rb

@@ -93,7 +93,7 @@ module Profiler
       private
 
       def truncate(str, max = 100)
-        str.length > max ? "#{str[0, max]}…" : str
+        Profiler::Redaction.truncate(str, max, "…")
       end
     end
   end

data/lib/profiler/collectors/mailer_collector.rb

@@ -224,12 +224,12 @@ module Profiler
         if mail.multipart?
           html_part = mail.parts.find { |p| p.content_type.to_s.start_with?("text/html") }
           text_part = mail.parts.find { |p| p.content_type.to_s.start_with?("text/plain") }
-          html = html_part&.body&.decoded&.then { |b| b[0, MAX_BODY_SIZE] }
-          text = text_part&.body&.decoded&.then { |b| b[0, MAX_BODY_SIZE] }
+          html = html_part&.body&.decoded&.then { |b| Profiler::Redaction.truncate(b, MAX_BODY_SIZE, "") }
+          text = text_part&.body&.decoded&.then { |b| Profiler::Redaction.truncate(b, MAX_BODY_SIZE, "") }
         elsif mail.content_type.to_s.start_with?("text/html")
-          html = mail.body.decoded[0, MAX_BODY_SIZE]
+          html = Profiler::Redaction.truncate(mail.body.decoded, MAX_BODY_SIZE, "")
         else
-          text = mail.body.decoded[0, MAX_BODY_SIZE]
+          text = Profiler::Redaction.truncate(mail.body.decoded, MAX_BODY_SIZE, "")
         end
         [html.nil? || html.empty? ? nil : html, text.nil? || text.empty? ? nil : text]
       rescue StandardError
@@ -240,7 +240,7 @@ module Profiler
         return "nil" if value.nil?
 
         inspected = value.inspect
-        inspected.length > 300 ? "#{inspected[0, 300]}…" : inspected
+        Profiler::Redaction.truncate(inspected, 300, "…")
       rescue StandardError
         value.to_s
       end

data/lib/profiler/configuration.rb

@@ -36,12 +36,14 @@ module Profiler
                   :track_jobs,
                   :track_console,
                   :apply_env_overrides_when_disabled,
-                  :track_tests,
+                  :track_tests, :test_runner_allow_undiscovered_files,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold,
                   :redact_sensitive_data, :filter_parameters, :env_allowlist,
                   :name, :master_url, :self_url,
-                  :cluster_heartbeat_interval, :cluster_offline_threshold
+                  :cluster_heartbeat_interval, :cluster_offline_threshold,
+                  :cluster_master, :cluster_secret, :cluster_require_secret,
+                  :cluster_allowed_slave_urls, :cluster_allow_insecure_http
 
     attr_writer :tmp_path
 
@@ -80,6 +82,9 @@ module Profiler
       @track_console = true
       @apply_env_overrides_when_disabled = false
       @track_tests = false
+      # The test runner only runs the files listed by its discovery. true restores the
+      # previous behavior: any file under the Rails root.
+      @test_runner_allow_undiscovered_files = false
       @track_mailers = true
       @capture_mail_body = false
       @sanitize_mailer_recipients = false
@@ -95,6 +100,12 @@ module Profiler
       @self_url = nil
       @cluster_heartbeat_interval = 15
       @cluster_offline_threshold = 60
+      # Cluster security: see Profiler::Cluster::Security and the Cluster section of the README.
+      @cluster_master = false
+      @cluster_secret = nil
+      @cluster_require_secret = true
+      @cluster_allowed_slave_urls = []
+      @cluster_allow_insecure_http = false
     end
 
     def tmp_path
@@ -109,6 +120,18 @@ module Profiler
       !slave?
     end
 
+    # Whether this node serves the master-side cluster routes (register, heartbeat, slaves and
+    # the slave proxy). Read on each request by the route constraints.
+    def cluster_master?
+      cluster_master ? true : false
+    end
+
+    # Whether /_profiler/mcp is routed. The stdio transport (rake profiler:mcp) does not depend
+    # on it.
+    def mcp_http_enabled?
+      mcp_enabled && mcp_transport.to_s == "http" ? true : false
+    end
+
     def resolved_name
       @name || (defined?(Rails) ? Rails.application.class.module_parent_name.underscore : "profiler")
     end

data/lib/profiler/console_profiler.rb

@@ -39,7 +39,7 @@ module Profiler
       profile = Models::Profile.new
       profile.profile_type = "console"
       profile.gem_version = Profiler::VERSION
-      profile.path = @expression.length > 200 ? "#{@expression[0, 200]}..." : @expression
+      profile.path = Redaction.truncate(@expression, 200)
       profile.method = "CONSOLE"
 
       console_collector = Collectors::ConsoleCollector.new(profile, expression: @expression)

data/lib/profiler/env_override_store.rb

@@ -107,7 +107,18 @@ module Profiler
       warn "[Profiler] EnvOverrideStore: failed to check overrides at boot: #{e.message}"
     end
 
+    # Set by the test runner in the environment of the test process, to which it already gave
+    # the admitted overrides only (TestRunner::Runner.build_env).
+    TEST_RUNNER_CHILD_ENV = "PROFILER_TEST_RUNNER_CHILD"
+    RESERVED_KEY_ERROR = "#{TEST_RUNNER_CHILD_ENV} is reserved for the test runner"
+
+    # The env tools may not set or delete the test runner marker, whatever its case.
+    def self.reserved_key?(key)
+      key.to_s.upcase == TEST_RUNNER_CHILD_ENV
+    end
+
     def apply!
+      return if ENV[TEST_RUNNER_CHILD_ENV] == "1"
       return if blocked_reason
 
       overrides = load_overrides

data/lib/profiler/instrumentation/net_http_instrumentation.rb

@@ -150,7 +150,8 @@ module Profiler
         mime = content_type.split(";").first.to_s.strip
 
         if mime.match?(BINARY_CONTENT_TYPES)
-          { body: Base64.strict_encode64(body.b), encoding: "base64" }
+          # Masked on the raw bytes, before the encoding hides them from any later search.
+          { body: Base64.strict_encode64(Redaction.hide_credentials(body.b)), encoding: "base64" }
         else
           text = Redaction.filter_body(body, content_type)
                           .encode("UTF-8", invalid: :replace, undef: :replace, replace: "?")

data/lib/profiler/job_profiler.rb

@@ -118,11 +118,11 @@ module Profiler
 
       Redaction.filter_value(args).map do |arg|
         case arg
-        when String then arg.length > 200 ? "#{arg[0, 200]}..." : arg
+        when String then Redaction.truncate(arg, 200)
         when Numeric, TrueClass, FalseClass, NilClass then arg
         else
           inspected = arg.inspect
-          inspected.length > 200 ? "#{inspected[0, 200]}..." : inspected
+          Redaction.truncate(inspected, 200)
         end
       rescue
         arg.to_s

data/lib/profiler/mcp/http_guard.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+
+module Profiler
+  module MCP
+    # Checks a request to the MCP HTTP transport before the MCP server sees it, with the same
+    # rules as the profiler's controllers: the profiler must be enabled, the request authorized,
+    # and a POST must not be one that another site could forge from a browser.
+    #
+    # Forgery protection does not use the X-Profiler-Request header, which MCP clients do not
+    # send. A POST must carry Content-Type: application/json instead: a cross-site form or
+    # "simple" fetch can only send text/plain, form-urlencoded or multipart, and JSON needs a
+    # CORS preflight that the profiler grants to configured origins only. A browser also sends
+    # its Origin, which has to be the profiler's own or one of cors_allowed_origins. GET (the
+    # SSE stream) changes nothing, and DELETE always needs a preflight.
+    module HttpGuard
+      JSON_MEDIA_TYPE = "application/json"
+
+      class << self
+        # Returns nil when the request may proceed, otherwise a Rack response.
+        def call(env)
+          config = Profiler.configuration
+          return deny("Profiler is disabled") unless config.enabled
+
+          request = ActionDispatch::Request.new(env)
+          return deny("Not authorized to access the profiler") unless config.authorized?(request)
+          return nil unless config.api_forgery_protection
+
+          forgery_denial(request, config)
+        end
+
+        private
+
+        def forgery_denial(request, config)
+          origin = request.get_header("HTTP_ORIGIN")
+          if origin && !origin.empty? && !allowed_origin?(origin, request, config)
+            return deny("Cross-origin request refused: Origin #{origin} is not allowed")
+          end
+
+          if request.post? && media_type(request) != JSON_MEDIA_TYPE
+            return deny("A POST to the MCP endpoint needs Content-Type: #{JSON_MEDIA_TYPE}")
+          end
+
+          nil
+        end
+
+        def media_type(request)
+          request.get_header("CONTENT_TYPE").to_s.split(";").first.to_s.strip.downcase
+        end
+
+        def allowed_origin?(origin, request, config)
+          return true if Array(config.cors_allowed_origins).include?(origin)
+
+          same_origin?(origin, request.base_url)
+        end
+
+        def same_origin?(origin, base_url)
+          a = URI.parse(origin)
+          b = URI.parse(base_url)
+          a.scheme.to_s.casecmp?(b.scheme.to_s) && a.host.to_s.casecmp?(b.host.to_s) && a.port == b.port
+        rescue URI::InvalidURIError
+          false
+        end
+
+        def deny(message)
+          [403, { "content-type" => "application/json" }, [{ error: message }.to_json]]
+        end
+      end
+    end
+  end
+end

data/lib/profiler/mcp/server.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "mcp"
+require_relative "http_guard"
 
 module Profiler
   module MCP
@@ -12,7 +13,9 @@ module Profiler
 
         def rack_app
           # Memoized at class level — survives route reloads in development
-          @rack_app ||= ->(env) { instance.http_transport.handle_request(Rack::Request.new(env)) }
+          @rack_app ||= lambda do |env|
+            HttpGuard.call(env) || instance.http_transport.handle_request(Rack::Request.new(env))
+          end
         end
       end
 
@@ -389,7 +392,7 @@ module Profiler
       def define_tool(name:, description:, input_schema:, handler:)
         ::MCP::Tool.define(name: name, description: description, input_schema: input_schema) do |server_context: nil, **args|
           result = handler.call(args.transform_keys(&:to_s))
-          ::MCP::Tool::Response.new(result)
+          result.is_a?(::MCP::Tool::Response) ? result : ::MCP::Tool::Response.new(result)
         end
       end
 

data/lib/profiler/mcp/tools/delete_env_var.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 
 module Profiler
@@ -10,6 +11,12 @@ module Profiler
           key = params["key"].to_s.strip
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::EnvOverrideStore.reserved_key?(key)
+            return ::MCP::Tool::Response.new(
+              [{ type: "text", text: "Error: #{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged." }],
+              error: true
+            )
+          end
 
           if (proxy = MCP::SlaveSupport.with_slave_proxy(params))
             proxy.patch_json("/_profiler/api/env_vars", { key: key, value: "" })

data/lib/profiler/mcp/tools/run_tests.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require "mcp"
+
 require_relative "../slave_support"
 
 require_relative "../../test_runner/discovery"
@@ -41,7 +43,11 @@ module Profiler
           end
 
           run_started_at = Time.now
-          run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
+          begin
+            run = Profiler::TestRunner::Runner.start(files: files, framework: framework)
+          rescue Profiler::TestRunner::InvalidFileError => e
+            return ::MCP::Tool::Response.new([{ type: "text", text: e.message }], error: true)
+          end
 
           output_pos = 0
           deadline   = Time.now + timeout_secs

data/lib/profiler/mcp/tools/set_env_var.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 require_relative "../../redaction"
 
@@ -12,6 +13,12 @@ module Profiler
           value = params["value"].to_s
 
           return [{ type: "text", text: "Error: key cannot be blank." }] if key.empty?
+          if Profiler::EnvOverrideStore.reserved_key?(key)
+            return ::MCP::Tool::Response.new(
+              [{ type: "text", text: "Error: #{Profiler::EnvOverrideStore::RESERVED_KEY_ERROR}; #{key} was left unchanged." }],
+              error: true
+            )
+          end
           if Profiler::Redaction.mask?(value)
             return [{ type: "text", text: "Error: #{Profiler::Redaction::MASK} is the mask the profiler shows " \
                                           "in place of a hidden value, not a value; #{key} was left unchanged." }]

data/lib/profiler/models/profile.rb

@@ -9,7 +9,8 @@ require_relative "../redaction"
 module Profiler
   module Models
     class Profile
-      attr_accessor :token, :path, :method, :status, :duration, :memory,
+      attr_reader :path
+      attr_accessor :token, :method, :status, :duration, :memory,
                     :started_at, :finished_at, :params, :headers,
                     :response_headers, :collectors_data, :collectors_metadata,
                     :parent_token, :is_ajax, :profile_type,
@@ -50,8 +51,15 @@ module Profiler
         @response_headers = Redaction.filter_headers(response_headers)
       end
 
+      # Every collector stores its data here: logs, exception messages, dumps and SQL text are free
+      # text with no name to filter on, so the profiler's own credentials are masked by value.
       def add_collector_data(name, data)
-        @collectors_data[name.to_s] = data
+        @collectors_data[name.to_s] = Redaction.hide_credentials(data)
+      end
+
+      # The path is free text for a console profile: the expression typed.
+      def path=(value)
+        @path = Redaction.hide_credentials(value)
       end
 
       def collector_data(name)
@@ -160,7 +168,9 @@ module Profiler
         return { body: nil, encoding: "text" } if raw.nil? || raw.empty?
 
         if binary_content_type?(content_type)
-          { body: Base64.strict_encode64(raw.b), encoding: "base64" }
+          # Masked on the raw bytes, before the encoding hides them from any later search. A
+          # compressed format (zip, png, gzip...) does not hold the secret as it is.
+          { body: Base64.strict_encode64(Redaction.hide_credentials(raw.b)), encoding: "base64" }
         else
           text = Redaction.filter_body(raw, content_type).encode("UTF-8", invalid: :replace, undef: :replace)
           if compress_body?(text)
@@ -195,7 +205,7 @@ module Profiler
       def sanitize_params(params)
         return {} unless params
 
-        return params.to_h.except(*LEGACY_FILTERED_PARAMS) unless Redaction.enabled?
+        return Redaction.hide_credentials(params.to_h.except(*LEGACY_FILTERED_PARAMS)) unless Redaction.enabled?
 
         Redaction.filter_hash(params.to_h)
       end

data/lib/profiler/railtie.rb

@@ -92,7 +92,11 @@ module Profiler
       # Check slave? inside on_load — the app's own initializers (config/initializers/profiler.rb)
       # set master_url AFTER railtie initializers run, so the check must happen after_initialize.
       ActiveSupport.on_load(:after_initialize) do
-        next unless Profiler.configuration.enabled && Profiler.configuration.slave?
+        next unless Profiler.configuration.enabled
+
+        require_relative "cluster/security"
+        Profiler::Cluster::Security.warn_about_configuration(Rails.logger)
+        next unless Profiler.configuration.slave?
 
         require_relative "cluster/master_client"
         Profiler::Cluster::MasterClient.new.start

data/lib/profiler/redaction.rb

@@ -4,6 +4,7 @@ require "json"
 require "set"
 require "rack/utils"
 require "active_support/parameter_filter"
+require_relative "cluster/security"
 
 module Profiler
   # The single filter applied to everything the profiler captures: request
@@ -44,6 +45,18 @@ module Profiler
     # fail on the same key inside the text.
     CONTEXT_SENSITIVE_REGEXP = /\\[AzZbBG]|[\^$]|\(\?<?[=!]/
 
+    # The profiler's own credentials are masked wherever they appear, by value,
+    # whatever name they travel under, and even with redact_sensitive_data
+    # off: the cluster secret opens every slave from the network, and a
+    # profile can be read on any node. Wraps every public filter, so that each
+    # capture point gets it.
+    module CredentialMasking
+      %i[filter_hash filter_value filter_named filter_headers filter_body filter_query filter_url
+         env_snapshot env_value env_overrides].each do |name|
+        define_method(name) { |*args| hide_credentials(super(*args)) }
+      end
+    end
+
     # Bound on the memo of names already tested against the filter.
     KEY_CACHE_LIMIT = 10_000
 
@@ -52,6 +65,41 @@ module Profiler
     PROBE = "x"
 
     class << self
+      prepend CredentialMasking
+
+      # Masks every occurrence of the profiler's own credentials in a value:
+      # a string equal to one becomes MASK, a string holding one has it
+      # replaced, hashes and arrays are walked. Only what changes is copied:
+      # a value holding no credential is returned as it is.
+      def hide_credentials(value)
+        credentials = credential_values
+        credentials.empty? ? value : hide_in(value, credentials)
+      rescue StandardError => e
+        report(e, "masking a profiler credential")
+        MASK
+      end
+
+      # Text cut to +max+ characters, with +ellipsis+ when cut, once the
+      # credentials are masked: cutting first would leave a prefix of one, or
+      # all of it once the pieces are put back together. Every capture point
+      # that shortens text goes through here.
+      def truncate(text, max, ellipsis = "...")
+        text = hide_credentials(text.to_s)
+        text.length > max ? "#{text[0, max]}#{ellipsis}" : text
+      end
+
+      # How many trailing bytes of +text+, a stream read in pieces, could be
+      # the start of a credential and have to wait for the next piece: the
+      # longest end of the text that is also the beginning of a credential,
+      # 0 when there is none, so that other output is shown as it comes.
+      def held_back_bytes(text)
+        bytes = text.to_s.b
+        credential_values.map do |credential|
+          start = credential.b
+          [start.bytesize - 1, bytes.bytesize].min.downto(1).find { |k| bytes.end_with?(start.byteslice(0, k)) } || 0
+        end.max || 0
+      end
+
       def enabled?
         Profiler.configuration.redact_sensitive_data != false
       end
@@ -231,6 +279,56 @@ module Profiler
 
       private
 
+      # Only a secret the cluster would use (Cluster::Security.secret_problem
+      # nil: 32 characters or more): a shorter one is ignored by the cluster,
+      # and masking "true" or "/" everywhere would hide the very data profiled.
+      def credential_values
+        return [] unless Cluster::Security.configured_secret?
+
+        [Profiler.configuration.cluster_secret.to_s.strip]
+      end
+
+      def hide_in(value, credentials)
+        case value
+        when String then hide_in_string(value, credentials)
+        when Hash
+          changes = nil
+          value.each do |key, v|
+            masked = hide_in(v, credentials)
+            (changes ||= {})[key] = masked unless masked.equal?(v)
+          end
+          changes ? value.merge(changes) : value
+        when Array
+          copy = nil
+          value.each_with_index do |v, i|
+            masked = hide_in(v, credentials)
+            next if masked.equal?(v)
+
+            (copy ||= value.dup)[i] = masked
+          end
+          copy || value
+        else value
+        end
+      end
+
+      # The string itself when it holds no credential, which is the common
+      # case and costs one search; otherwise a copy, compared as bytes so that
+      # a binary body never meets an incompatible encoding.
+      def hide_in_string(string, credentials)
+        credentials.reduce(string) do |text, credential|
+          next text unless contains?(text, credential)
+          next MASK if text.b.strip == credential.b
+
+          text.b.gsub(credential.b, MASK).force_encoding(text.encoding)
+        end
+      end
+
+      def contains?(text, credential)
+        text.include?(credential)
+      rescue Encoding::CompatibilityError, ArgumentError
+        text.b.include?(credential.b)
+      end
+
       def compiled
         filters = current_filters
         state = @compiled

data/lib/profiler/test_runner/discovery.rb

@@ -24,8 +24,8 @@ module Profiler
                 end
 
         globs.each do |glob|
-          Dir.glob(File.join(root, glob)).each do |path|
-            relative = path.sub("#{root}/", "")
+          # base: keeps glob metacharacters of the root ([, {, *) out of the pattern
+          Dir.glob(glob, base: root).each do |relative|
             parts = relative.split("/")
             dir   = parts[0..-2].join("/")
             result[dir] ||= []

data/lib/profiler/test_runner/run_store.rb

@@ -2,6 +2,7 @@
 
 require "concurrent"
 require "securerandom"
+require_relative "../redaction"
 
 module Profiler
   module TestRunner
@@ -24,6 +25,9 @@ module Profiler
       def initialize
         @runs  = Concurrent::Hash.new
         @locks = Concurrent::Hash.new
+        @held  = Concurrent::Hash.new
+        @output_finished = Concurrent::Hash.new
+        @held_lock = Mutex.new
       end
 
       def create(files:, framework:)
@@ -58,11 +62,38 @@ module Profiler
         run
       end
 
+      # Output is free text read back by the API, the SSE stream and run_tests, in the pieces it
+      # arrives in: the profiler's own credentials are masked by value, as in a profile. They
+      # are masked on the text joined with what was held back from the previous piece, and the
+      # last bytes that could start a credential wait for the next piece, so that none is ever
+      # shown cut in two. What is held back is released by finish_output, once the process has
+      # nothing more to print: a killed run still prints its summary after its status changed.
       def append_output(id, chunk)
         run = @runs[id]
         return unless run
 
-        run.output_lines.push(chunk)
+        @held_lock.synchronize do
+          text = Profiler::Redaction.hide_credentials(@held.fetch(id, "".b) + chunk.to_s.b)
+          holdback = @output_finished[id] ? 0 : Profiler::Redaction.held_back_bytes(text)
+          cut = text.bytesize - holdback
+          @held[id] = text.byteslice(cut, text.bytesize - cut)
+          shown = text.byteslice(0, cut).force_encoding(chunk.to_s.encoding)
+          run.output_lines.push(shown) unless shown.empty?
+        end
+        signal(id)
+      end
+
+      # The end of the output, told by the reader of the process once it read everything: the
+      # bytes held back are shown, and anything appended later is shown as it comes.
+      def finish_output(id)
+        run = @runs[id]
+        return unless run
+
+        @held_lock.synchronize do
+          @output_finished[id] = true
+          rest = @held.delete(id)
+          run.output_lines.push(rest) if rest && !rest.empty?
+        end
         signal(id)
       end
 
@@ -97,6 +128,12 @@ module Profiler
         lock[:mutex].synchronize { lock[:cond].broadcast }
       end
 
+      def forget_output(id)
+        @held.delete(id)
+        @output_finished.delete(id)
+        true
+      end
+
       def snapshot(run, position)
         lines = run.output_lines.dup
         {
@@ -109,7 +146,7 @@ module Profiler
 
       def cleanup_old_runs
         cutoff = Time.now - TTL
-        @runs.delete_if { |id, r| r.finished_at && r.finished_at < cutoff && @locks.delete(id) }
+        @runs.delete_if { |id, r| r.finished_at && r.finished_at < cutoff && @locks.delete(id) && forget_output(id) }
       end
     end