rails-profiler 0.31.6 → 0.32.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f8c9d9f31f3f32dc5ada20eb78eb6bc205c0985e084942edf18b283cfafe81be
-  data.tar.gz: 49fb9afa0dd2fa52033f151b077ec971db08fe45818fe64448559ba95f4face3
+  metadata.gz: 623e8531db783ddb27296b83dba2beae12f411e6b2c71630c3b14003b7e67f40
+  data.tar.gz: eebbf3cda8334b412ca1a4543cb81f7ef05e65c0f28672794fc9f0b7b57a250f
 SHA512:
-  metadata.gz: 79bd6095dd2deb184ee662c398183d5e63b9b9af30f5bda76b1806353adce5137627c2e33afc5c95aadc451dd540a9d243c1cc1df3eb72eccc2001331362581f
-  data.tar.gz: bd488d9da999d2f54be42b4002030f88bb51b069c956b78c85f0aadc4e87faa3f6ec3a2bb26c9921b73bea0fbaa84e16fd8e3f5967cfc8276ada75fa44a9b331
+  metadata.gz: 27241cbff0c9d09418f1d75a6757a55dba4b6474b822860f11e98b5149d2dda4b7fe7ad13a03e136bf9c1ca56dbd9fbdf4366dc394fa7127d3d9bba69cf23944
+  data.tar.gz: 25ad634237aecccf4a698f3ba7f221afbc53965a5b3a18845336c2ce8fef257f1d7fc8234b40545153fe0a9ba7b28fae92f52708994a50d4e81063d0a789116b

data/CHANGELOG.md

@@ -19,6 +19,25 @@ every commit of every tag interval is accounted for one way or the other.
 
 ## [Unreleased]
 
+## [0.32.0] - 2026-10-06
+
+<!-- stamped -->
+
+### Added
+
+- **MCP:** The HTTP endpoint at `/_profiler/mcp` accepts the `Host` headers of a reverse proxy
+  without a monkey-patch: besides the loopback names, it now accepts the hosts the application lists
+  in `config.hosts` (when that list is not empty), so an application behind Traefik usually has
+  nothing to set, and the entries of the new `config.mcp_allowed_hosts` (default `[]`): a host name
+  or `host:port`, or a `Regexp` anchored with `\A` and `\z`, matched against the whole host name,
+  for example `["api.myapp.test", %r{\Amyapp[a-z0-9-]*\z}]`. With mcp 1.x the
+  transport only accepted the loopback names and answered `Forbidden: Invalid Host header` behind
+  a proxy. The profiler now makes the check itself, before the transport, for every kind of entry,
+  and keeps the transport's `Origin` check (same origin or `cors_allowed_origins`), whatever
+  `api_forgery_protection` says; the transport's own check, which only knows exact names, is turned
+  off. A `Regexp` that is not anchored, or that cannot match a whole host name, and a String
+  holding `*` raise an `ArgumentError` when assigned. The defaults keep the previous behaviour.
+
 ## [0.31.6] - 2026-10-05
 
 <!-- stamped -->

data/lib/profiler/configuration.rb

@@ -132,6 +132,7 @@ module Profiler
       @cluster_secret = nil
       @cluster_require_secret = true
       @cluster_allowed_slave_urls = []
+      @mcp_allowed_hosts = []
       @cluster_allow_insecure_http = false
       # Where the profiler's own errors go (Profiler.log): Rails.logger when nil, or $stderr when
       # there is none.
@@ -147,7 +148,16 @@ module Profiler
       @tmp_path = value.nil? ? nil : Pathname.new(value)
     end
 
-    attr_reader :cluster_allowed_slave_urls
+    attr_reader :cluster_allowed_slave_urls, :mcp_allowed_hosts
+
+    # Host names the MCP HTTP endpoint accepts beyond the loopback ones and config.hosts: a String
+    # (a host name, any port, or a host:port) or a Regexp anchored with \A and \z, matched
+    # against the host name without its port. A wildcard String is refused.
+    def mcp_allowed_hosts=(value)
+      require_relative "cluster/security"
+      Array(value).each { |entry| validate_mcp_allowed_host(entry) }
+      @mcp_allowed_hosts = Array(value)
+    end
 
     # Deprecated: the figure it was meant for was never a byte count (see AllocationCounter).
     # Read and written as allocated_objects_warning_threshold times the bytes per object the
@@ -300,5 +310,28 @@ module Profiler
         raise Error, "Unknown storage backend: #{@storage}"
       end
     end
+
+    def validate_mcp_allowed_host(entry)
+      case entry
+      when String
+        return unless entry.strip.empty? || entry.include?("*")
+
+        raise ArgumentError, "config.mcp_allowed_hosts: #{entry.inspect} is not a host name; list each host, " \
+                             "or use an anchored Regexp"
+      when Regexp then validate_mcp_allowed_host_pattern(entry)
+      else raise ArgumentError, "config.mcp_allowed_hosts: #{entry.inspect} must be a String or a Regexp"
+      end
+    end
+
+    def validate_mcp_allowed_host_pattern(pattern)
+      unless Profiler::Cluster::Security.anchored_pattern?(pattern)
+        raise ArgumentError, "config.mcp_allowed_hosts: #{pattern.inspect} must start with \\A and end with \\z, " \
+                             "so that it matches the whole host name"
+      end
+      Profiler::Cluster::Security.whole_url_pattern(pattern)
+    rescue RegexpError => e
+      raise ArgumentError, "config.mcp_allowed_hosts: #{pattern.inspect} cannot be matched against the whole " \
+                           "host name (#{e.message})"
+    end
   end
 end

data/lib/profiler/local_request.rb

@@ -85,6 +85,18 @@ module Profiler
         false
       end
 
+      # When the application restricts config.hosts, ActionDispatch::HostAuthorization has
+      # already refused every other host; a host it lists is one the developer trusts.
+      def permitted_by_rails_hosts?(host)
+        return false unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+        return false unless defined?(ActionDispatch::HostAuthorization::Permissions)
+
+        hosts = Rails.application.config.hosts
+        return false if hosts.nil? || hosts.empty?
+
+        ActionDispatch::HostAuthorization::Permissions.new(hosts).allows?(host)
+      end
+
       private
 
       def host_denial_reason(request)
@@ -143,17 +155,6 @@ module Profiler
         permitted_by_rails_hosts?(host)
       end
 
-      # When the application restricts config.hosts, ActionDispatch::HostAuthorization has
-      # already refused every other host; a host it lists is one the developer trusts.
-      def permitted_by_rails_hosts?(host)
-        return false unless defined?(Rails) && Rails.respond_to?(:application) && Rails.application
-        return false unless defined?(ActionDispatch::HostAuthorization::Permissions)
-
-        hosts = Rails.application.config.hosts
-        return false if hosts.nil? || hosts.empty?
-
-        ActionDispatch::HostAuthorization::Permissions.new(hosts).allows?(host)
-      end
     end
   end
 end

data/lib/profiler/mcp/http_guard.rb

@@ -2,6 +2,8 @@
 
 require "json"
 require "uri"
+require_relative "../cluster/security"
+require_relative "../local_request"
 
 module Profiler
   module MCP
@@ -25,20 +27,86 @@ module Profiler
           return deny("Profiler is disabled") unless config.enabled
 
           request = ActionDispatch::Request.new(env)
+          if (host_denial = host_denial(request, config))
+            return deny(host_denial)
+          end
           return deny("Not authorized to access the profiler") unless config.authorized?(request)
+          if (origin_denial = origin_denial(request, config))
+            return deny(origin_denial)
+          end
           return nil unless config.api_forgery_protection
 
           forgery_denial(request, config)
         end
 
+        # The DNS rebinding check of the MCP transport, done here so that one rule covers every
+        # host: the transport itself only knows exact names, and is created without its own check
+        # (see Profiler::MCP::Server#http_transport). A Host header is accepted when it names a
+        # loopback address, a host the application lists in config.hosts (when that list is not
+        # empty, Rails' HostAuthorization already refuses every other host), or an entry of
+        # config.mcp_allowed_hosts. A request without a Host header (HTTP/1.0) is let through, as
+        # the transport did: the rebinding vector always carries one.
+        def allowed_host?(raw_host, config = Profiler.configuration)
+          return true if raw_host.nil?
+
+          full = raw_host.to_s.strip.downcase
+          name = host_name(full)
+          return false if name.empty?
+          return true if LOOPBACK_HOSTS.include?(name)
+          return true if Array(config.mcp_allowed_hosts).any? { |entry| host_entry_allows?(entry, name, full) }
+
+          # Rails matches config.hosts against the whole Host header (an entry may carry a port);
+          # the bare name covers entries written without one.
+          Profiler::LocalRequest.permitted_by_rails_hosts?(full) ||
+            Profiler::LocalRequest.permitted_by_rails_hosts?(name)
+        end
+
         private
 
-        def forgery_denial(request, config)
-          origin = request.get_header("HTTP_ORIGIN")
-          if origin && !origin.empty? && !allowed_origin?(origin, request, config)
-            return deny("Cross-origin request refused: Origin #{origin} is not allowed")
+        LOOPBACK_HOSTS = %w[localhost 127.0.0.1 ::1].freeze
+
+        def host_denial(request, config)
+          raw = request.get_header("HTTP_HOST")
+          return nil if allowed_host?(raw, config)
+
+          "Host #{raw} is not allowed for the MCP endpoint: list it in config.hosts or " \
+            "config.mcp_allowed_hosts"
+        end
+
+        # A String matches the host name (any port) or the whole host:port, case-insensitively; a
+        # Regexp must match the whole host name, without the port.
+        def host_entry_allows?(entry, name, full)
+          case entry
+          when Regexp
+            Profiler::Cluster::Security.anchored_pattern?(entry) &&
+              Profiler::Cluster::Security.whole_url_pattern(entry).match?(name)
+          when String
+            allowed = entry.strip.downcase
+            allowed == name || allowed == full
+          else
+            false
           end
+        rescue RegexpError
+          false
+        end
+
+        # "[::1]:3000" gives "::1", "app.local:3000" gives "app.local". Anything else (two hosts, a
+        # port that is not a number, text after the brackets) gives "", which is refused.
+        def host_name(host)
+          match = host.match(/\A\[([^\]]+)\](?::\d+)?\z/) || host.match(/\A([^:\s,]+)(?::\d+)?\z/)
+          match ? match[1] : ""
+        end
 
+        # The Origin check of the transport, kept whatever api_forgery_protection says: a
+        # browser's Origin must be the profiler's own or one of cors_allowed_origins.
+        def origin_denial(request, config)
+          origin = request.get_header("HTTP_ORIGIN")
+          return nil if origin.nil? || origin.empty? || allowed_origin?(origin, request, config)
+
+          "Cross-origin request refused: Origin #{origin} is not allowed"
+        end
+
+        def forgery_denial(request, _config)
           if request.post? && media_type(request) != JSON_MEDIA_TYPE
             return deny("A POST to the MCP endpoint needs Content-Type: #{JSON_MEDIA_TYPE}")
           end
@@ -53,13 +121,20 @@ module Profiler
         def allowed_origin?(origin, request, config)
           return true if Array(config.cors_allowed_origins).include?(origin)
 
-          same_origin?(origin, request.base_url)
+          same_origin?(origin, request)
         end
 
-        def same_origin?(origin, base_url)
-          a = URI.parse(origin)
-          b = URI.parse(base_url)
-          a.scheme.to_s.casecmp?(b.scheme.to_s) && a.host.to_s.casecmp?(b.host.to_s) && a.port == b.port
+        # The Origin's host and port against the Host header, as the transport compares them: the
+        # scheme is left out, since behind a proxy that ends TLS the request says http while the
+        # browser's Origin says https, and the default port of the Origin's scheme is dropped.
+        def same_origin?(origin, request)
+          uri = URI.parse(origin)
+          host = request.get_header("HTTP_HOST").to_s.downcase
+          return false if uri.host.nil? || host.empty?
+
+          authority = uri.port == uri.default_port ? uri.host.downcase : "#{uri.host.downcase}:#{uri.port}"
+          host = host.delete_suffix(":#{uri.default_port}")
+          authority == host
         rescue URI::InvalidURIError
           false
         end

data/lib/profiler/mcp/server.rb

@@ -46,12 +46,21 @@ module Profiler
 
       def http_transport
         @http_transport ||= begin
-          t = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server)
+          t = ::MCP::Server::Transports::StreamableHTTPTransport.new(@server, **http_transport_options)
           @server.transport = t
           t
         end
       end
 
+      # HttpGuard checks the Host and Origin headers of every request before the transport sees
+      # it, with config.hosts, config.mcp_allowed_hosts and Regexp entries, which the transport's
+      # own check (exact names only) cannot express. Older mcp versions have no such check, nor
+      # the option.
+      def http_transport_options
+        params = ::MCP::Server::Transports::StreamableHTTPTransport.instance_method(:initialize).parameters
+        params.any? { |_type, name| name == :dns_rebinding_protection } ? { dns_rebinding_protection: false } : {}
+      end
+
       def start(transport: :stdio)
         case transport
         when :stdio

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.31.6"
+  VERSION = "0.32.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.31.6
+  version: 0.32.0
 platform: ruby
 authors:
 - Sébastien Duplessy
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-05 00:00:00.000000000 Z
+date: 2026-10-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails