rails-profiler 0.31.0 → 0.31.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1c74753b10258047c15aafb6de0c2b5900bc16f01f4b499405b5b72d0d6d3b9e
-  data.tar.gz: 55ad17c8d51cf4eb8e2ed9ec3fd7158a15e23becba666b204b11d7b7c81f0e47
+  metadata.gz: f57ca8fcbd7fef2ddd81f41ab6c1b7b254e814ec986692ed906533f0c9042d4b
+  data.tar.gz: 66e0072789af17ddb711b3911c60d5ebaa683d040117ee44f2dba7b30e126ce7
 SHA512:
-  metadata.gz: f1984f7c3ef795d9f318ddc33b64e964a8ed0171878fd913a927ad7c7d4479ba4523159598e75ddd3f52a8985bdaca9cb24bd49a8e0a0f6e1fbc025b904254ba
-  data.tar.gz: 855f08439f3cd174f3686150eed1f813b349e7591dd731b554941be172b9557ff835229268a3dce9605825e161b353a4456e444f1680ed239f40ebf1a6c37abc
+  metadata.gz: 9378049525fb7fa8127ddcbe51be0f02a2fe27915cae7aad5cdbce22ce80ba6a5c2ee69b67980366f51f32cb29306c6d14d41878b3773aadaff4a7c5df0fe661
+  data.tar.gz: 1b881dbe5033362810063c9d86946978c94e7dcb95cad19130a729e80f1e6bdbfff20e754feb6f8c9f37dcb3d7bc3dd2571e282463824cd918fa0ea201f1087e

data/CHANGELOG.md

@@ -19,6 +19,86 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.31.1] - 2026-10-05
+
+<!-- stamped -->
+
+### Fixed
+
+- **Storage:** Keep the file store's profiles in `tmp_path/profiles` by default, and take only the
+  files named after a profile token for profiles. Profiles shared `tmp_path` with
+  `env_overrides.json`, which the store listed as a profile with no token and deleted when the
+  profiles were cleared. An application that sets `storage_options[:path]` keeps its directory,
+  used as given (no subdirectory is added).
+- **MCP:** Keep the bodies saved by the MCP tools in `tmp_path/mcp-cache`, and let their hourly
+  cleanup remove only the token directories it wrote there. It removed every directory of
+  `tmp_path` older than an hour, the SQLite store's blobs included, at random (one save in
+  twenty), which lost the stored HTTP response bodies.
+- **Configuration:** `config.tmp_path` is always a `Pathname`: it was a `String` outside Rails, and
+  kept a `String` assigned to it, which made every env override operation fail with only a
+  warning. A failure to read or write the env overrides now reaches the Env tab (`500` with the
+  error, `ENV` left unchanged) and the MCP env tools (an error answer) instead of reporting a
+  success; at boot, before a Sidekiq job and before a console evaluation it is still a warning,
+  so an override never makes the application fail.
+- **Jobs:** A storage error while saving a profile no longer makes the application fail: a job,
+  a console command, a test, or an outbound HTTP call that ends after its profile was collected
+  now goes on, with its own result or its own exception, and the error is printed as a warning.
+  The save of a job, console or test profile ran with nothing to catch it, so a full disk, a
+  Redis that went away or, from this version, a symbolic link refused in place of the SQLite
+  database made the job fail, or replaced the job's own exception. The HTTP middleware already
+  kept requests going.
+- **Upgrading:** for the default `tmp_path`; adapt the paths if you set one.
+  - Profiles saved by the file store in `tmp/rails-profiler` itself are no longer listed, and are
+    not moved. To remove them, with the old MCP body cache, run from the application root:
+    ```sh
+    LC_ALL=C find tmp/rails-profiler -maxdepth 1 -type f -name '[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].json' -delete
+    LC_ALL=C find tmp/rails-profiler -mindepth 1 -maxdepth 1 -type d -name '[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]' -exec rm -rf {} +
+    ```
+    Both only match names made of 32 lower-case hexadecimal digits, a profile token (`LC_ALL=C`
+    keeps `[0-9a-f]` from matching upper-case letters in some locales): `env_overrides.json`, the
+    SQLite database, `blobs`, `profiles` and `mcp-cache` are left alone.
+  - To keep reading the old profiles instead, set
+    `config.storage_options = { path: Rails.root.join("tmp", "rails-profiler") }`, and then do
+    **not** run the first command: it would delete the current profiles.
+  - The directory `tmp/rails-profiler` created by an earlier version keeps its mode: run
+    `chmod 700 tmp/rails-profiler` to restrict it.
+  - If the web process and the workers reading the env overrides or a shared file or SQLite store
+    run as two different users, set `config.restrict_storage_permissions = false` to create new
+    files with the modes of the umask, as before. It does not reopen what was already created
+    `0700` and `0600`: run `chmod -R u=rwX,go=rX tmp/rails-profiler` for the modes earlier
+    versions created with the usual umask (`0755` and `0644`). A worker under another user that
+    also writes there (it opens `env_overrides.json.lock` for writing) needs the
+    files belonging to a group of both users (the same primary group for both, or
+    `chgrp -R <group> tmp/rails-profiler` then `find tmp/rails-profiler -type d -exec chmod g+s {} +`
+    so that new files inherit it), a umask of `002` for both processes, and
+    `chmod -R ug=rwX,o=rX tmp/rails-profiler`. The option also follows a symbolic link in place
+    of the SQLite database, its `-wal` or `-shm` file or the lock of the env overrides, and drops
+    the warning about a shared `tmp_path`, as before.
+
+### Security
+
+- **Storage:** Check every profile token against the format the profiler issues (32 hexadecimal
+  characters) in every storage backend (file, memory, Redis, SQLite and its blobs), before it
+  becomes a file name, a directory or a key. A token such as `../../config/important` reached the
+  file store as a path: `DELETE /_profiler/api/profiles/:id` deleted, and
+  `POST /_profiler/api/ajax/link` overwrote, a `.json` file outside the storage directory. A
+  malformed token is now not found (`404` from the API, `nil` from the storage, no exception),
+  whoever asks: the controllers, the cluster proxy, which no longer forwards it to a slave, or the
+  MCP tools. Saving under one raises an `ArgumentError`. `POST /_profiler/api/ajax/link` answers
+  `400` for a malformed `parent_token` instead of storing it. The MCP tools no longer save a body
+  (`save_bodies`) under a token sent by a slave that is not a profile token. There is no option to
+  accept other tokens: the profiler never issues them, and accepting them would reopen the path.
+- **Storage:** Create the profiler's directories `0700` and its files `0600`, whatever the umask:
+  the file store's profiles, the SQLite database and its `-wal` and `-shm` files, the blobs, the
+  env overrides with their lock and temporary files, and the MCP body cache. They were created
+  with the process defaults, usually `0755` and `0644`, readable by every local user although
+  profiles hold cookies, tokens and environment values. A file the profiler writes again (a
+  profile, the SQLite database at startup) is brought back to `0600`; a directory that already
+  exists keeps its mode. Writing a profile now goes through a temporary file renamed over it. A
+  symbolic link placed where the profiler keeps its SQLite database, its `-wal` or `-shm` file or
+  the lock of the env overrides is refused instead of followed, and an existing `tmp_path` that
+  belongs to another user or that group or others can write to is reported once with a warning.
+
 ## [0.31.0] - 2026-10-05
 
 <!-- stamped -->

data/app/controllers/profiler/api/ajax_controller.rb

@@ -12,6 +12,12 @@ module Profiler
           return render json: { error: "Missing parent_token or child_token" }, status: :bad_request
         end
 
+        # The parent token is written into the child profile: a value the gem never issues is
+        # refused rather than stored. A malformed child token is not found by the storage.
+        unless Profiler::Storage::Token.valid?(parent_token)
+          return render json: { error: "Invalid parent_token" }, status: :bad_request
+        end
+
         # Load child profile
         child_profile = Profiler.storage.load(child_token)
         unless child_profile

data/app/controllers/profiler/api/env_vars_controller.rb

@@ -3,6 +3,13 @@
 module Profiler
   module Api
     class EnvVarsController < ApplicationController
+      # The overrides file could not be read or written: nothing was changed, ENV included.
+      rescue_from Profiler::EnvOverrideStore::Error do |error|
+        key = params[:key].to_s.strip
+        message = key.empty? ? "#{error.message}; nothing was changed" : "#{error.message}; #{key} was left unchanged"
+        render json: { error: message }, status: :internal_server_error
+      end
+
       def show
         variables = Profiler::Redaction.env_snapshot
         overrides = Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)
@@ -72,8 +79,11 @@ module Profiler
         ENV[key].nil? ? nil : Profiler::Redaction.env_value(key, ENV[key])
       end
 
+      # Read back after a change that succeeded: a failure here must not answer that nothing changed.
       def redacted_override(key)
         Profiler::Redaction.env_overrides(Profiler.env_override_store.all_overrides)[key]
+      rescue Profiler::EnvOverrideStore::Error
+        nil
       end
     end
   end

data/lib/profiler/cluster/slave_proxy.rb

@@ -4,6 +4,7 @@ require "net/http"
 require "json"
 require "uri"
 require_relative "security"
+require_relative "../storage/token"
 
 module Profiler
   module Cluster
@@ -39,7 +40,10 @@ module Profiler
         Array(data["profiles"]).map { |h| profile_from_api(h) }
       end
 
+      # A token that is not one the gem issues is not found, without asking the slave.
       def load(token)
+        return nil unless Storage::Token.valid?(token)
+
         data = get_json("/_profiler/api/profiles/#{Security.escape_segment(token)}")
         return nil unless data["token"] || data["profile"]
 
@@ -48,6 +52,8 @@ module Profiler
       end
 
       def find_by_parent(parent_token)
+        return [] unless Storage::Token.valid?(parent_token)
+
         data = get_json("/_profiler/api/profiles", parent_token: parent_token, all_types: true)
         Array(data["profiles"]).map { |h| profile_from_api(h) }
       end

data/lib/profiler/collectors/http_collector.rb

@@ -125,7 +125,7 @@ module Profiler
           build_data(@requests)
         end
         store_data(data)
-        Profiler.storage.save(@profile.token, @profile)
+        Profiler.save_profile(@profile, from: "HttpCollector")
       end
 
       def group_by_host(requests)

data/lib/profiler/configuration.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "pathname"
 require_relative "local_request"
 
 module Profiler
@@ -39,7 +40,7 @@ module Profiler
                   :track_http, :slow_http_threshold, :http_skip_hosts, :http_backtrace_depth,
                   :track_jobs,
                   :track_console,
-                  :apply_env_overrides_when_disabled,
+                  :apply_env_overrides_when_disabled, :restrict_storage_permissions,
                   :test_runner_allow_undiscovered_files,
                   :track_mailers, :capture_mail_body, :sanitize_mailer_recipients, :mailer_skip_actions,
                   :compress_bodies, :compress_body_threshold,
@@ -49,8 +50,6 @@ module Profiler
                   :cluster_master, :cluster_secret, :cluster_require_secret,
                   :cluster_allow_insecure_http
 
-    attr_writer :tmp_path
-
     attr_reader :authorize_block, :enabled, :track_tests
 
     def initialize
@@ -100,6 +99,9 @@ module Profiler
       @filter_parameters = DEFAULT_FILTER_PARAMETERS.dup
       @env_allowlist = DEFAULT_ENV_ALLOWLIST.dup
       @tmp_path = nil
+      # The profiler's directories 0700 and files 0600 (Profiler::Storage::PrivateFiles). false
+      # leaves the modes to the umask, for a web process and workers running under two users.
+      @restrict_storage_permissions = true
       @name = nil
       @master_url = nil
       @self_url = nil
@@ -113,10 +115,15 @@ module Profiler
       @cluster_allow_insecure_http = false
     end
 
+    # Always a Pathname, whether set from a String or left to its default.
     def tmp_path
       @tmp_path || default_tmp_path
     end
 
+    def tmp_path=(value)
+      @tmp_path = value.nil? ? nil : Pathname.new(value)
+    end
+
     attr_reader :cluster_allowed_slave_urls
 
     # :any, or a list of slave URLs and anchored Regexp patterns (see Profiler::Cluster::Security).
@@ -226,7 +233,7 @@ module Profiler
       if defined?(Rails) && Rails.respond_to?(:root) && Rails.root
         Rails.root.join("tmp", "rails-profiler")
       else
-        File.expand_path("tmp/rails-profiler", Dir.pwd)
+        Pathname.new(File.expand_path("tmp/rails-profiler", Dir.pwd))
       end
     end
 

data/lib/profiler/console_profiler.rb

@@ -80,7 +80,7 @@ module Profiler
           end
         end
 
-        Profiler.storage.save(profile.token, profile)
+        Profiler.save_profile(profile, from: "ConsoleProfiler")
       end
     ensure
       # After collect, and also when collect or the storage failed.

data/lib/profiler/env_override_store.rb

@@ -2,9 +2,16 @@
 
 require "json"
 require "fileutils"
+require_relative "storage/private_files"
 
 module Profiler
   class EnvOverrideStore
+    # Raised by the methods a caller asked for (set, delete, reset, reset_all, clear and
+    # all_overrides) when the overrides file cannot be read or written. The caller then knows that
+    # nothing was changed. apply! and apply_at_boot! still only warn: they run at boot and before
+    # the application's jobs, where an override must never make the application fail.
+    class Error < Profiler::Error; end
+
     DELETED_SENTINEL = "__profiler_deleted__"
     RESTORE_SENTINEL = "__profiler_restore__"
 
@@ -30,53 +37,53 @@ module Profiler
     end
 
     def set(key, value)
-      remember_process_original(key)
-      update_overrides do |overrides|
-        overrides[key] = { "value" => value.to_s, "original" => original_for(overrides, key) }
+      surfacing("set #{key}") do
+        remember_process_original(key)
+        update_overrides do |overrides|
+          overrides[key] = { "value" => value.to_s, "original" => original_for(overrides, key) }
+        end
       end
-    rescue => e
-      warn "[Profiler] EnvOverrideStore: failed to set #{key}: #{e.message}"
     end
 
     def delete(key)
-      remember_process_original(key)
-      update_overrides do |overrides|
-        overrides[key] = { "value" => DELETED_SENTINEL, "original" => original_for(overrides, key) }
+      surfacing("delete #{key}") do
+        remember_process_original(key)
+        update_overrides do |overrides|
+          overrides[key] = { "value" => DELETED_SENTINEL, "original" => original_for(overrides, key) }
+        end
       end
-    rescue => e
-      warn "[Profiler] EnvOverrideStore: failed to delete #{key}: #{e.message}"
     end
 
     # Returns whether ENV was written in this process.
     def reset(key)
       entry = nil
-      update_overrides do |overrides|
-        entry = overrides[key]
-        # Keep a RESTORE entry so Sidekiq workers pick it up on next job
-        overrides[key] = { "value" => RESTORE_SENTINEL, "original" => entry["original"] } if entry
+      surfacing("reset #{key}") do
+        update_overrides do |overrides|
+          entry = overrides[key]
+          # Keep a RESTORE entry so Sidekiq workers pick it up on next job
+          overrides[key] = { "value" => RESTORE_SENTINEL, "original" => entry["original"] } if entry
+        end
       end
 
       # Apply immediately to the current (web) process
       restore_env(key, entry, blocked: blocked_reason)
-    rescue => e
-      warn "[Profiler] EnvOverrideStore: failed to reset #{key}: #{e.message}"
     end
 
     def reset_all
       originals = {}
-      update_overrides do |overrides|
-        overrides.each do |key, entry|
-          originals[key] = entry.is_a?(Hash) ? entry["original"] : nil
-          # Leave a RESTORE sentinel for Sidekiq workers to pick up
-          overrides[key] = { "value" => RESTORE_SENTINEL, "original" => originals[key] }
+      surfacing("reset the overrides") do
+        update_overrides do |overrides|
+          overrides.each do |key, entry|
+            originals[key] = entry.is_a?(Hash) ? entry["original"] : nil
+            # Leave a RESTORE sentinel for Sidekiq workers to pick up
+            overrides[key] = { "value" => RESTORE_SENTINEL, "original" => originals[key] }
+          end
         end
       end
 
       # Apply immediately to the current (web) process
       blocked = blocked_reason
       originals.each { |key, original| restore_env(key, { "original" => original }, blocked: blocked) }
-    rescue => e
-      warn "[Profiler] EnvOverrideStore: failed to reset all: #{e.message}"
     end
 
     # Why the persisted overrides must not reach ENV in this process, or nil when they may.
@@ -154,27 +161,36 @@ module Profiler
       warn "[Profiler] EnvOverrideStore: failed to apply overrides: #{e.message}"
     end
 
-    # Returns active overrides (excludes RESTORE entries — already being reverted)
+    # Returns active overrides (excludes RESTORE entries, already being reverted)
+    # A file that does not parse reads as no override; one that cannot be read raises Error.
     def all_overrides
-      load_overrides.reject do |_, entry|
-        value = entry.is_a?(Hash) ? entry["value"] : entry
-        value == RESTORE_SENTINEL
-      end.transform_values do |entry|
-        entry.is_a?(Hash) ? entry : { "value" => entry, "original" => nil }
+      surfacing("read the overrides") do
+        load_overrides.reject do |_, entry|
+          value = entry.is_a?(Hash) ? entry["value"] : entry
+          value == RESTORE_SENTINEL
+        end.transform_values do |entry|
+          entry.is_a?(Hash) ? entry : { "value" => entry, "original" => nil }
+        end
       end
-    rescue => e
-      warn "[Profiler] EnvOverrideStore: failed to load overrides: #{e.message}"
-      {}
     end
 
     def clear
-      with_lock { FileUtils.rm_f(override_file_path) }
-    rescue => e
-      warn "[Profiler] EnvOverrideStore: failed to clear: #{e.message}"
+      surfacing("clear the overrides") { with_lock { FileUtils.rm_f(override_file_path) } }
     end
 
     private
 
+    # The message names the file relative to tmp_path, and an Errno by its description only: it
+    # goes back to the Env tab, the MCP tools and the test runner output, without absolute paths.
+    def surfacing(action)
+      yield
+    rescue Error
+      raise
+    rescue StandardError => e
+      reason = e.is_a?(SystemCallError) ? e.class.new.message : e.class.name
+      raise Error, "could not #{action} in env_overrides.json under tmp_path: #{reason}"
+    end
+
     def remember_process_original(key)
       @process_originals_lock.synchronize do
         @process_originals[key] = ENV[key] unless @process_originals.key?(key)
@@ -227,8 +243,8 @@ module Profiler
     # An exclusive flock on a file next to the overrides file. Not reentrant: never nest it.
     def with_lock
       path = override_file_path
-      FileUtils.mkdir_p(path.dirname)
-      File.open("#{path}.lock", File::RDWR | File::CREAT, 0o644) do |lock|
+      Storage::PrivateFiles.tmp_dir
+      Storage::PrivateFiles.open("#{path}.lock") do |lock|
         lock.flock(File::LOCK_EX)
         yield
       end
@@ -237,12 +253,7 @@ module Profiler
     # Written to a temporary file then renamed over the old one, so that a reader never sees a
     # half-written file, which would parse as no override at all.
     def save_overrides(overrides)
-      path = override_file_path
-      tmp = "#{path}.#{Process.pid}.#{Thread.current.object_id}.tmp"
-      File.write(tmp, JSON.generate(overrides))
-      File.rename(tmp, path)
-    ensure
-      FileUtils.rm_f(tmp) if tmp
+      Storage::PrivateFiles.write(override_file_path, JSON.generate(overrides))
     end
   end
 end

data/lib/profiler/job_profiler.rb

@@ -107,7 +107,7 @@ module Profiler
           end
         end
 
-        Profiler.storage.save(profile.token, profile)
+        Profiler.save_profile(profile, from: "JobProfiler")
       end
     ensure
       # After collect, and also when collect or the storage failed.

data/lib/profiler/mcp/body_formatter.rb

@@ -9,10 +9,10 @@ module Profiler
       # Formats a body string for MCP output.
       #
       # params keys used:
-      #   "save_bodies"   (boolean) — save to ./tmp/rails-profiler/{token}/{name} and return path
-      #   "max_body_size" (number)  — truncate inline body at N chars
-      #   "json_path"     (string)  — JSONPath to extract from body when save_bodies is true
-      #   "xml_path"      (string)  — XPath to extract from body when save_bodies is true
+      #   "save_bodies"   (boolean): save to {tmp_path}/mcp-cache/{token}/{name} and return path
+      #   "max_body_size" (number):  truncate inline body at N chars
+      #   "json_path"     (string):  JSONPath to extract from body when save_bodies is true
+      #   "xml_path"      (string):  XPath to extract from body when save_bodies is true
       #
       # Returns a formatted string ready to embed in markdown, or nil if body is blank.
       def self.format_body(token, name, body, encoding, params)

data/lib/profiler/mcp/file_cache.rb

@@ -1,22 +1,31 @@
 # frozen_string_literal: true
 
 require "fileutils"
+require_relative "../storage/private_files"
+require_relative "../storage/token"
 
 module Profiler
   module MCP
+    # The bodies the MCP tools save on request (save_bodies), under tmp_path/mcp-cache/<token>/<name>.
+    # The token comes from a profile, which a slave may have sent: one that is not a token the gem
+    # issues, or a name that is not one the tools use, is refused. The cleanup only removes the
+    # token directories of this cache: tmp_path also holds the profiles, the SQLite blobs and the
+    # env overrides.
     class FileCache
+      DIR_NAME = "mcp-cache"
+      NAME_FORMAT = /\A[a-z0-9_]+\z/
+
       def self.base_dir
-        Profiler.configuration.tmp_path.to_s
+        Profiler.configuration.tmp_path.join(DIR_NAME).to_s
       end
 
       def self.save(token, name, content)
+        return nil unless Storage::Token.valid?(token) && name.is_a?(String) && NAME_FORMAT.match?(name)
+
         cleanup if rand < 0.05
 
-        dir = File.join(base_dir, token)
-        FileUtils.mkdir_p(dir)
-        path = File.join(dir, name)
-        File.write(path, content)
-        path
+        dir = Storage::PrivateFiles.tmp_dir(DIR_NAME, token)
+        Storage::PrivateFiles.write(dir.join(name), content)
       rescue Errno::EACCES, Errno::EROFS
         nil
       end
@@ -25,7 +34,10 @@ module Profiler
         bd = base_dir
         return unless Dir.exist?(bd)
 
-        Dir.glob(File.join(bd, "*")).each do |dir|
+        Dir.children(bd).each do |entry|
+          next unless Storage::Token.valid?(entry)
+
+          dir = File.join(bd, entry)
           FileUtils.rm_rf(dir) if File.directory?(dir) && (Time.now - File.mtime(dir)) > max_age
         end
       end

data/lib/profiler/mcp/tools/delete_env_var.rb

@@ -26,7 +26,9 @@ module Profiler
           Profiler.env_override_store.delete(key)
           ENV.delete(key)
 
-          [{ type: "text", text: "Deleted #{key}. Override persisted — will remain deleted across restarts until reset." }]
+          [{ type: "text", text: "Deleted #{key}. Override persisted: it will remain deleted across restarts until reset." }]
+        rescue Profiler::EnvOverrideStore::Error => e
+          ::MCP::Tool::Response.new([{ type: "text", text: "Error: #{e.message}; #{key} was left unchanged." }], error: true)
         end
       end
     end

data/lib/profiler/mcp/tools/list_env_vars.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 require_relative "../../env_override_store"
 require_relative "../../redaction"
@@ -61,6 +62,8 @@ module Profiler
           end
 
           [{ type: "text", text: text }]
+        rescue Profiler::EnvOverrideStore::Error => e
+          ::MCP::Tool::Response.new([{ type: "text", text: "Error: #{e.message}." }], error: true)
         end
 
         private

data/lib/profiler/mcp/tools/reset_all_env_vars.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 
 module Profiler
@@ -22,6 +23,8 @@ module Profiler
           Profiler.env_override_store.reset_all
 
           [{ type: "text", text: "Reset #{count} environment variable#{"s" if count != 1} to original values." }]
+        rescue Profiler::EnvOverrideStore::Error => e
+          ::MCP::Tool::Response.new([{ type: "text", text: "Error: #{e.message}; nothing was changed." }], error: true)
         end
       end
     end

data/lib/profiler/mcp/tools/reset_env_var.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require "mcp"
 require_relative "../slave_support"
 
 require "uri"
@@ -27,6 +28,8 @@ module Profiler
 
           done = restored ? "original value restored" : "ENV left unchanged"
           [{ type: "text", text: "Reset #{key}: override removed, #{done} in this process." }]
+        rescue Profiler::EnvOverrideStore::Error => e
+          ::MCP::Tool::Response.new([{ type: "text", text: "Error: #{e.message}; #{key} was left unchanged." }], error: true)
         end
       end
     end

data/lib/profiler/mcp/tools/set_env_var.rb

@@ -33,6 +33,8 @@ module Profiler
           ENV[key] = value
 
           [{ type: "text", text: "Set #{key}=#{value}" }]
+        rescue Profiler::EnvOverrideStore::Error => e
+          ::MCP::Tool::Response.new([{ type: "text", text: "Error: #{e.message}; #{key} was left unchanged." }], error: true)
         end
       end
     end

data/lib/profiler/storage/base_store.rb

@@ -1,12 +1,16 @@
 # frozen_string_literal: true
 
+require_relative "token"
+
 module Profiler
   module Storage
     class BaseStore
       # Public interface: persists the profile then records the save, for the pages showing it
       # to see it changed (Profiler::SSE).
-      # Subclasses implement #do_save, not #save.
+      # Subclasses implement #do_save, not #save. The token must be one the gem issued
+      # (Storage::Token); every other public method answers "not found" for any other token.
       def save(token, profile)
+        Token.validate!(token)
         result = do_save(token, profile)
         broadcast_event(token)
         result

data/lib/profiler/storage/blob_store.rb

@@ -2,22 +2,34 @@
 
 require "fileutils"
 require "json"
+require_relative "private_files"
+require_relative "token"
 
 module Profiler
   module Storage
+    # Large collector payloads of the SQLite store, one directory per profile token and one JSON
+    # file per collector. A token or a name that is not one the gem writes is never a path: reads
+    # find nothing and writes are refused.
     class BlobStore
+      NAME_FORMAT = /\A[a-z0-9_]+\z/
+
       def initialize(path)
-        @path = path
-        FileUtils.mkdir_p(@path)
+        @path = path.to_s
+        PrivateFiles.mkdir(@path)
       end
 
       def write(token, collector_name, data)
+        Token.validate!(token)
+        raise ArgumentError, "invalid blob name: #{collector_name.inspect[0, 80]}" unless valid_name?(collector_name)
+
         dir = token_dir(token)
-        FileUtils.mkdir_p(dir)
-        File.write(File.join(dir, "#{collector_name}.json"), JSON.generate(data))
+        PrivateFiles.mkdir(dir)
+        PrivateFiles.write(File.join(dir, "#{collector_name}.json"), JSON.generate(data))
       end
 
       def read(token, collector_name)
+        return nil unless valid?(token, collector_name)
+
         file = File.join(token_dir(token), "#{collector_name}.json")
         return nil unless File.exist?(file)
 
@@ -28,16 +40,28 @@ module Profiler
       end
 
       def delete(token)
+        return unless Token.valid?(token)
+
         dir = token_dir(token)
         FileUtils.rm_rf(dir) if File.directory?(dir)
       end
 
       def exists?(token, collector_name)
+        return false unless valid?(token, collector_name)
+
         File.exist?(File.join(token_dir(token), "#{collector_name}.json"))
       end
 
       private
 
+      def valid?(token, collector_name)
+        Token.valid?(token) && valid_name?(collector_name)
+      end
+
+      def valid_name?(collector_name)
+        collector_name.is_a?(String) && NAME_FORMAT.match?(collector_name)
+      end
+
       def token_dir(token)
         File.join(@path, token)
       end

data/lib/profiler/storage/file_store.rb

@@ -3,28 +3,38 @@
 require "fileutils"
 require "json"
 require_relative "base_store"
+require_relative "private_files"
+require_relative "token"
 require_relative "../models/profile"
 
 module Profiler
   module Storage
-    # File-based profile storage backend. Persists each profile as a JSON file
-    # under tmp_path and evicts the oldest files when total size exceeds max_size.
+    # File-based profile storage backend. Persists each profile as a JSON file named after its
+    # token, under tmp_path/profiles by default or the directory given as options[:path], and
+    # evicts the oldest files when total size exceeds max_size. Only the files named after a
+    # token are taken for profiles, so a path shared with other files (tmp_path itself, where the
+    # env overrides live) is safe.
     class FileStore < BaseStore
       def initialize(options = {})
         super()
-        @path = options[:path] || default_path
         @max_size = options[:max_size] || (100 * 1024 * 1024) # 100 MB
-        ensure_directory_exists
+        if options[:path]
+          @path = options[:path].to_s
+          PrivateFiles.mkdir(@path)
+        else
+          @path = PrivateFiles.tmp_dir("profiles").to_s
+        end
       end
 
       def do_save(token, profile)
-        file_path = profile_file_path(token)
-        File.write(file_path, profile.to_json)
+        PrivateFiles.write(profile_file_path(token), profile.to_json)
         cleanup_if_needed
         token
       end
 
       def load(token)
+        return nil unless Token.valid?(token)
+
         file_path = profile_file_path(token)
         return nil unless File.exist?(file_path)
 
@@ -55,6 +65,8 @@ module Profiler
       end
 
       def find_by_parent(parent_token)
+        return [] unless Token.valid?(parent_token)
+
         profile_files
           .map { |f| load(File.basename(f, ".json")) }
           .compact
@@ -63,6 +75,8 @@ module Profiler
       end
 
       def delete(token)
+        return unless Token.valid?(token)
+
         FileUtils.rm_f(profile_file_path(token))
       end
 
@@ -85,20 +99,12 @@ module Profiler
 
       private
 
-      def default_path
-        Profiler.configuration.tmp_path
-      end
-
-      def ensure_directory_exists
-        FileUtils.mkdir_p(@path) unless File.directory?(@path)
-      end
-
       def profile_file_path(token)
         File.join(@path, "#{token}.json")
       end
 
       def profile_files
-        Dir.glob(File.join(@path, "*.json"))
+        Dir.glob(File.join(@path, "*.json")).select { |f| Token.valid?(File.basename(f, ".json")) }
       end
 
       def cleanup_if_needed # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity

data/lib/profiler/storage/memory_store.rb

@@ -19,6 +19,8 @@ module Profiler
       end
 
       def load(token)
+        return nil unless Token.valid?(token)
+
         data = @profiles[token]
         return nil unless data
 
@@ -43,6 +45,8 @@ module Profiler
       end
 
       def find_by_parent(parent_token)
+        return [] unless Token.valid?(parent_token)
+
         @profiles.values
                 .map { |data| deserialize_profile(data) }
                 .select { |profile| profile.parent_token == parent_token }
@@ -50,6 +54,8 @@ module Profiler
       end
 
       def delete(token)
+        return unless Token.valid?(token)
+
         @profiles.delete(token)
       end
 

data/lib/profiler/storage/private_files.rb

@@ -0,0 +1,135 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "securerandom"
+
+module Profiler
+  module Storage
+    # Creates the profiler's directories and files readable by the process user only (0700 and
+    # 0600), whatever the umask: profiles hold cookies, tokens and environment values. A directory
+    # that already exists keeps its mode. config.restrict_storage_permissions = false leaves the
+    # modes to the umask, for a web process and workers running under two users.
+    module PrivateFiles
+      DIR_MODE = 0o700
+      FILE_MODE = 0o600
+      # Where the platform has it, and while the modes are restricted: a symbolic link placed where
+      # the profiler expects its own file is not followed (ELOOP) instead of being written through.
+      NOFOLLOW = defined?(File::NOFOLLOW) ? File::NOFOLLOW : 0
+
+      @warned = {}
+      @warn_mutex = Mutex.new
+
+      module_function
+
+      def restricted?
+        Profiler.configuration.restrict_storage_permissions ? true : false
+      end
+
+      # Creates the missing parents with the umask's mode, so that the application's own
+      # directories (tmp/ for instance) are left as they would be, and the directory itself 0700.
+      def mkdir(path)
+        path = path.to_s
+        return if File.directory?(path)
+        return FileUtils.mkdir_p(path) unless restricted?
+
+        FileUtils.mkdir_p(File.dirname(path))
+        begin
+          Dir.mkdir(path, DIR_MODE)
+          File.chmod(DIR_MODE, path)
+        rescue Errno::EEXIST
+          raise unless File.directory?(path)
+        end
+      end
+
+      # A directory under tmp_path, created with tmp_path itself as #mkdir creates a directory.
+      def tmp_dir(*parts)
+        dir = Profiler.configuration.tmp_path
+        mkdir(dir)
+        warn_if_shared(dir)
+        parts.each do |part|
+          dir = dir.join(part)
+          mkdir(dir)
+        end
+        dir
+      end
+
+      # Writes to a temporary file next to path then renames it over path: a reader never sees a
+      # half-written file, and the file has its mode from the start, even when it replaces an
+      # older one with a wider mode.
+      def write(path, data)
+        path = path.to_s
+        tmp = File.join(File.dirname(path), ".#{File.basename(path)}.#{Process.pid}.#{SecureRandom.hex(4)}.tmp")
+        File.open(tmp, File::WRONLY | File::CREAT | File::EXCL, new_file_mode) do |file|
+          file.chmod(FILE_MODE) if restricted?
+          file.write(data)
+        end
+        File.rename(tmp, path)
+        tmp = nil
+        path
+      ensure
+        FileUtils.rm_f(tmp) if tmp
+      end
+
+      # Opens path for reading and writing, creating it 0600 when missing.
+      def open(path, &block)
+        File.open(path.to_s, File::RDWR | File::CREAT | nofollow, new_file_mode, &block)
+      end
+
+      # Creates an empty file 0600 when missing, or brings an existing one back to 0600.
+      def touch(path)
+        path = path.to_s
+        refuse_link(path)
+        File.open(path, File::WRONLY | File::CREAT | nofollow, new_file_mode) { |file| file.chmod(FILE_MODE) if restricted? }
+      end
+
+      # Brings an existing file back to 0600; a missing one is left missing.
+      def restrict(path)
+        path = path.to_s
+        refuse_link(path)
+        File.chmod(FILE_MODE, path) if restricted? && File.exist?(path)
+      end
+
+      # A symbolic link where the profiler keeps a file of its own would make it change the mode of
+      # (and write to) whatever the link points at. Refused while the permissions are restricted.
+      def refuse_link(path)
+        return unless restricted? && File.symlink?(path)
+
+        raise Profiler::Error, "Refusing to use #{path}: it is a symbolic link, where the profiler expects " \
+                               "a file of its own. Remove it, or set config.restrict_storage_permissions = false, " \
+                               "which follows such links and creates the files with the modes of the umask."
+      end
+
+      # Says once per directory when an existing tmp_path belongs to another user or can be written
+      # to by others (tmp/rails-profiler under a shared /tmp, outside Rails): they could place files
+      # or links there before the profiler does.
+      def warn_if_shared(dir)
+        return unless restricted?
+
+        stat = File.stat(dir.to_s)
+        return if stat.uid == Process.euid && (stat.mode & 0o022).zero?
+
+        key = dir.to_s
+        first = @warn_mutex.synchronize { @warned[key] ? false : (@warned[key] = true) }
+        return unless first
+
+        warn "[Profiler] tmp_path #{key} belongs to another user or is writable by group or others " \
+             "(mode #{format("%o", stat.mode & 0o777)}): other local users could place files there. Set " \
+             "config.tmp_path to a directory of your own, or run chmod 700 on it."
+      rescue SystemCallError
+        nil
+      end
+
+      def reset_warnings!
+        @warn_mutex.synchronize { @warned = {} }
+      end
+
+      def nofollow
+        restricted? ? NOFOLLOW : 0
+      end
+
+      def new_file_mode
+        restricted? ? FILE_MODE : 0o666
+      end
+    end
+  end
+end

data/lib/profiler/storage/redis_store.rb

@@ -29,6 +29,8 @@ module Profiler
       end
 
       def load(token)
+        return nil unless Token.valid?(token)
+
         key = profile_key(token)
         json_data = @redis.get(key)
         return nil unless json_data
@@ -50,6 +52,8 @@ module Profiler
       end
 
       def find_by_parent(parent_token)
+        return [] unless Token.valid?(parent_token)
+
         # Get all tokens from the sorted set
         tokens = @redis.zrange(list_key, 0, -1)
 
@@ -61,6 +65,8 @@ module Profiler
       end
 
       def delete(token)
+        return unless Token.valid?(token)
+
         @redis.del(profile_key(token))
         @redis.zrem(list_key, token)
       end

data/lib/profiler/storage/sqlite_store.rb

@@ -4,6 +4,8 @@ require "json"
 require "fileutils"
 require_relative "base_store"
 require_relative "blob_store"
+require_relative "private_files"
+require_relative "token"
 require_relative "../models/profile"
 
 module Profiler
@@ -12,12 +14,12 @@ module Profiler
       def initialize(options = {})
         require "sqlite3"
 
-        db_path = options[:database] || default_db_path
-        blob_path = options[:blob_path] || default_blob_path
+        db_path = (options[:database] || default_db_path).to_s
+        blob_path = options[:blob_path] || PrivateFiles.tmp_dir("blobs")
 
-        FileUtils.mkdir_p(File.dirname(db_path))
+        prepare_database_file(db_path, default: options[:database].nil?)
 
-        @db = SQLite3::Database.new(db_path.to_s)
+        @db = SQLite3::Database.new(db_path)
         @db.results_as_hash = true
         @db.busy_timeout = 5000
         @db.execute("PRAGMA journal_mode=WAL")
@@ -83,6 +85,8 @@ module Profiler
       end
 
       def load(token)
+        return nil unless Token.valid?(token)
+
         row = @db.get_first_row(
           "SELECT * FROM profiler_profiles WHERE token = :token", token: token
         )
@@ -103,6 +107,8 @@ module Profiler
       end
 
       def find_by_parent(parent_token)
+        return [] unless Token.valid?(parent_token)
+
         rows = @db.execute(
           "SELECT * FROM profiler_profiles WHERE parent_token = :parent_token ORDER BY started_at ASC",
           parent_token: parent_token
@@ -111,6 +117,8 @@ module Profiler
       end
 
       def delete(token)
+        return unless Token.valid?(token)
+
         @db.execute("DELETE FROM profiler_profiles WHERE token = :token", token: token)
         @blob_store.delete(token)
       end
@@ -264,13 +272,23 @@ module Profiler
         default
       end
 
-      def default_db_path
-        File.join(Profiler.configuration.tmp_path.to_s, "profiler.db")
+      # SQLite gives the -wal and -shm files the mode of the database file: create it 0600 before
+      # SQLite does, and bring an older one, and its companions, back to 0600. An in-memory or URI
+      # database is left to SQLite.
+      def prepare_database_file(db_path, default:)
+        return if db_path == ":memory:" || db_path.start_with?("file:")
+
+        default ? PrivateFiles.tmp_dir : PrivateFiles.mkdir(File.dirname(db_path))
+        # A link in place of one of them is refused: SQLite would follow it.
+        %w[-wal -shm].each { |suffix| PrivateFiles.refuse_link("#{db_path}#{suffix}") }
+        PrivateFiles.touch(db_path)
+        %w[-wal -shm].each { |suffix| PrivateFiles.restrict("#{db_path}#{suffix}") }
       end
 
-      def default_blob_path
-        File.join(Profiler.configuration.tmp_path.to_s, "blobs")
+      def default_db_path
+        Profiler.configuration.tmp_path.join("profiler.db")
       end
+
     end
   end
 end

data/lib/profiler/storage/token.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Profiler
+  module Storage
+    # The format of a profile token, as Models::Profile issues it (SecureRandom.hex(16)) for every
+    # kind of profile. The backends check a token against it before they turn it into a file name,
+    # a directory or a key: a token is client input for the controllers, the cluster proxy and the
+    # MCP tools, which all call the storage directly.
+    module Token
+      FORMAT = /\A[0-9a-f]{32}\z/
+
+      def self.valid?(token)
+        token.is_a?(String) && FORMAT.match?(token)
+      end
+
+      # For the writers: the gem only writes under the tokens it issued, so another one is a bug.
+      def self.validate!(token)
+        raise ArgumentError, "invalid profile token: #{token.inspect[0, 80]}" unless valid?(token)
+
+        token
+      end
+    end
+  end
+end

data/lib/profiler/test_profiler.rb

@@ -118,7 +118,7 @@ module Profiler
           end
         end
 
-        Profiler.storage.save(profile.token, profile)
+        Profiler.save_profile(profile, from: "TestProfiler")
       end
     ensure
       # After collect, and also when collect or the storage failed.

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.31.0"
+  VERSION = "0.31.1"
 end

data/lib/profiler.rb

@@ -28,6 +28,15 @@ module Profiler
       @storage ||= configuration.storage_backend
     end
 
+    # Saves a profile from a path of the application (a job, a console command, a test, an
+    # outbound HTTP call): a storage error loses the profile, never the application's work.
+    def save_profile(profile, from:)
+      storage.save(profile.token, profile)
+    rescue StandardError => e
+      warn "[Profiler] #{from}: could not save profile #{profile.token}: #{e.class}: #{e.message}"
+      nil
+    end
+
     def env_override_store
       @env_override_store ||= EnvOverrideStore.new
     end
@@ -124,6 +133,8 @@ require_relative "profiler/collectors/i18n_collector"
 require_relative "profiler/collectors/env_collector"
 require_relative "profiler/collectors/mailer_collector"
 
+require_relative "profiler/storage/token"
+require_relative "profiler/storage/private_files"
 require_relative "profiler/env_override_store"
 require_relative "profiler/instrumentation/thread_context_propagation"
 require_relative "profiler/sse/event_bus"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.31.0
+  version: 0.31.1
 platform: ruby
 authors:
 - Sébastien Duplessy
@@ -222,8 +222,10 @@ files:
 - lib/profiler/storage/blob_store.rb
 - lib/profiler/storage/file_store.rb
 - lib/profiler/storage/memory_store.rb
+- lib/profiler/storage/private_files.rb
 - lib/profiler/storage/redis_store.rb
 - lib/profiler/storage/sqlite_store.rb
+- lib/profiler/storage/token.rb
 - lib/profiler/tasks/profiler.rake
 - lib/profiler/test_helpers/minitest_support.rb
 - lib/profiler/test_helpers/reporter.rb