rails-profiler 0.9.1 → 0.10.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3979c04655c3ab2204af54f67c500176ad26fd5224656fe82cf815f13190bca8
-  data.tar.gz: e6de19b5d127577c9921559b682d1f5f49daeb7c2fb0dcbfe2a6877aad579dfb
+  metadata.gz: b6d4b62a0b2dafdfc36928cd302f7babff3dabe36c1bdfba68c5694acae2fed3
+  data.tar.gz: 0fc45e2e2f0e9bdbaa005b18b9d89f2dfc99462724351951e6ecdebc3043c496
 SHA512:
-  metadata.gz: 913739ef55cf291e47ea2dd1bd7fe764518d19a297c070e545dd212b647a9a90145427e1e215b6cea44688cb42f94307aedd74be47af434702c18a09dbd3ce82
-  data.tar.gz: 57b500b690441ce98c5b29f064c57882eeab685a79c1278857b4899c4fd498a03fde64a63bb421d3361ce8dc3bd3d6acd0aa0b6fa132225e9e77167c60d5e44b
+  metadata.gz: e027318a52c3ba6ef6803571b18f276174a7f86e6cd07726f0b687b42b1f759fc474a7db88bb0f689e02a6b02cecc5ebeee6a0b18966de56ab5507b78ca5a321
+  data.tar.gz: 48479831a40187a451f558cae42a2b73e6e89b286d0416713dda886ba64e90ea04ce464919c2df357f1fa6feef1d9972606e887cae3b0b9defa49949b44ef628

data/lib/profiler/configuration.rb

@@ -7,9 +7,11 @@ module Profiler
                   :track_memory, :memory_warning_threshold,
                   :mcp_enabled, :mcp_transport, :mcp_port,
                   :authorization_mode, :max_profiles, :extension_cors_enabled,
+                  :cors_allowed_origins,
                   :track_ajax, :ajax_skip_paths,
                   :track_http, :slow_http_threshold, :http_skip_hosts,
-                  :track_jobs
+                  :track_jobs,
+                  :compress_bodies, :compress_body_threshold
 
     attr_reader :authorize_block
 
@@ -30,12 +32,15 @@ module Profiler
       @authorize_block = nil
       @max_profiles = 100
       @extension_cors_enabled = true
+      @cors_allowed_origins = ["*"]
       @track_ajax = true
       @ajax_skip_paths = [/^\/_profiler/]
       @track_http = true
       @slow_http_threshold = 500 # milliseconds
       @http_skip_hosts = []
       @track_jobs = true
+      @compress_bodies = true
+      @compress_body_threshold = 10 * 1024 # 10 KB
     end
 
     def authorize_with(&block)

data/lib/profiler/middleware/cors_middleware.rb

@@ -14,7 +14,7 @@ module Profiler
           if env['REQUEST_METHOD'] == 'OPTIONS'
             return [
               200,
-              cors_headers,
+              cors_headers(env),
               ['']
             ]
           end
@@ -22,7 +22,7 @@ module Profiler
           status, headers, body = @app.call(env)
 
           # Add CORS headers
-          cors_headers.each do |key, value|
+          cors_headers(env).each do |key, value|
             headers[key] = value
           end
 
@@ -42,13 +42,28 @@ module Profiler
 
       private
 
-      def cors_headers
-        {
-          'Access-Control-Allow-Origin' => '*',
+      def cors_headers(env)
+        allowed_origins = Profiler.configuration.cors_allowed_origins
+        request_origin = env['HTTP_ORIGIN']
+
+        if allowed_origins.include?('*')
+          origin_header = '*'
+        elsif request_origin && allowed_origins.include?(request_origin)
+          origin_header = request_origin
+        end
+
+        headers = {
           'Access-Control-Allow-Methods' => 'GET, POST, OPTIONS',
           'Access-Control-Allow-Headers' => 'Content-Type, X-Requested-With, Accept',
           'Access-Control-Expose-Headers' => 'X-Profiler-Token'
         }
+
+        if origin_header
+          headers['Access-Control-Allow-Origin'] = origin_header
+          headers['Vary'] = 'Origin' unless origin_header == '*'
+        end
+
+        headers
       end
     end
   end

data/lib/profiler/middleware/profiler_middleware.rb

@@ -70,7 +70,8 @@ module Profiler
 
         # Inject toolbar if HTML response
         if html_response?(headers)
-          body = ToolbarInjector.new(body, profile.token).inject
+          nonce = env['action_dispatch.content_security_policy_nonce']
+          body = ToolbarInjector.new(body, profile.token, nonce).inject
         end
 
         [status, headers, body]

data/lib/profiler/middleware/toolbar_injector.rb

@@ -5,9 +5,10 @@ module Profiler
     class ToolbarInjector
       CLOSING_BODY_TAG = "</body>"
 
-      def initialize(body, token)
+      def initialize(body, token, nonce = nil)
         @body = body
         @token = token
+        @nonce = nonce
       end
 
       def inject
@@ -26,10 +27,10 @@ module Profiler
         return "" unless Profiler.configuration.track_ajax
 
         <<~HTML
-          <script>
+          <script#{nonce_attr}>
             window.__PROFILER_PARENT_TOKEN__ = '#{@token}';
           </script>
-          <script>
+          <script#{nonce_attr}>
             #{ajax_interceptor_code}
           </script>
         HTML
@@ -62,11 +63,15 @@ module Profiler
         <<~HTML
           #{ajax_interceptor_script}
           <div id="profiler-toolbar" data-token="#{@token}"></div>
-          <script src="/_profiler/assets/profiler-toolbar.js" defer></script>
+          <script src="/_profiler/assets/profiler-toolbar.js" defer#{nonce_attr}></script>
           <style>#{toolbar_styles}</style>
         HTML
       end
 
+      def nonce_attr
+        @nonce ? " nonce=\"#{@nonce}\"" : ""
+      end
+
       # Thermal design system — self-contained CSS for the injected toolbar.
       # Variables are defined on #profiler-toolbar to avoid polluting the host app.
       def toolbar_styles

data/lib/profiler/models/profile.rb

@@ -3,6 +3,7 @@
 require "base64"
 require "securerandom"
 require "json"
+require "zlib"
 
 module Profiler
   module Models
@@ -159,10 +160,19 @@ module Profiler
           { body: Base64.strict_encode64(truncated), encoding: "base64" }
         else
           text = raw.encode("UTF-8", invalid: :replace, undef: :replace)[0, TEXT_BODY_LIMIT]
-          { body: text, encoding: "text" }
+          if compress_body?(text)
+            { body: Base64.strict_encode64(Zlib::Deflate.deflate(text)), encoding: "gzip+base64" }
+          else
+            { body: text, encoding: "text" }
+          end
         end
       end
 
+      def compress_body?(text)
+        Profiler.configuration.compress_bodies &&
+          text.bytesize > Profiler.configuration.compress_body_threshold
+      end
+
       def binary_content_type?(ct)
         ct.to_s.match?(%r{image/(?!svg)|application/(?:pdf|octet-stream|zip)|audio/|video/})
       end

data/lib/profiler/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Profiler
-  VERSION = "0.9.1"
+  VERSION = "0.10.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails-profiler
 version: !ruby/object:Gem::Version
-  version: 0.9.1
+  version: 0.10.0
 platform: ruby
 authors:
 - Sébastien Duplessy