rails_discord_notifier 0.3.1 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fbf5bc3adc89129d2ab69ef41705e363a214a53eb31dd1bd0dd2a4fb36253a8b
-  data.tar.gz: b35128c48b420cd7577a9a455f5d857ef952c08f0ef427136299a2e698e85101
+  metadata.gz: 78212ad50963b77ccf50a72b4d7c0d79efd23557465c73cd829dc6bcc3c88251
+  data.tar.gz: c394690be33b31b3ff588041ccbe8232079657a479b204f968c9e58b3f30b6d0
 SHA512:
-  metadata.gz: 8187d0173472e8d83c8f4ce848b9d7fa9feb218db585853bbed1e784cd820f81fe93086f34c23c4b35800a4cefbe3997022d67b40a062bcd093b28afb8e03056
-  data.tar.gz: 975248f04642541592a440169438e6356f53e951a380f440d175a38cc42a81c7f4bd168b9786e21b20ab06bf08e576cc143eefb3efb06e7321934623a76c5b32
+  metadata.gz: 6b2c309fd867f9b24963e37b04958c081a984fd4c3cadb1a969b08ed981d5776dfaeea0555b87ea89722dd22249600ed7ff792ffac426d7fa367d9c57a1aba31
+  data.tar.gz: 39e26aa259b490ddfd3227183350a4a8dd74123e6c93527f2a228519da99ab67d83703b50c21d3179918e8c70a67a0b21ae1ed668413b9536bb2b150edfaaeca

data/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.3.2] - 2026-10-28
+
+### Security
+
+- **The URL field no longer includes the query string.** Query values were
+  sent twice, filtered, in the URL and in Params, and the URL copy was still
+  sent with `config.include_params = false`. The query string is now sent only
+  as part of Params, so `include_params = false` leaves it out. An exception
+  message that quotes a value is still sent, with its best-effort scrub.
+
 ## [0.3.1] - 2026-10-28
 
 ### Changed

data/README.md

@@ -63,7 +63,7 @@ Exception in POST /orders
 ActiveRecord::RecordInvalid: Validation failed: Email can't be blank
 Caused by ArgumentError: missing email
 
-URL          https://shop.example.com/orders?utm_source=newsletter
+URL          https://shop.example.com/orders
 Controller   orders          Action   create
 Environment  production      Release  a1b2c3d
 Request ID   8f3c…           Host     web-01
@@ -140,9 +140,11 @@ Parameters and query strings are filtered recursively with
    `session`, `credential`).
 
 Because it is a union, enabling this gem can never redact less than your
-application already does. To send no parameters at all, set
-`config.include_params = false`. The same filter applies to extra fields from
-`config.context` and from `Rails.error` context.
+application already does. The URL field leaves out the query string, so the
+query string is sent only as part of the filtered params. To leave out params
+and the query string, set `config.include_params = false`. An exception message
+that quotes a parameter value is still sent (see below). The same filter
+applies to extra fields from `config.context` and from `Rails.error` context.
 
 Exception messages are free text rather than structured parameters, so they get
 a best-effort scrub instead: `token=abc`, `password="x"`, `Api_Key: abc`,

data/lib/rails_discord_notifier/payload.rb

@@ -112,7 +112,7 @@ module RailsDiscordNotifier
 
     def request_fields
       [
-        { name: "URL", value: filtered_url },
+        { name: "URL", value: request_url },
         { name: "Controller", value: rails_params["controller"], inline: true },
         { name: "Action", value: rails_params["action"], inline: true },
         { name: "Environment", value: config.environment, inline: true },
@@ -196,21 +196,10 @@ module RailsDiscordNotifier
       Array(exception.backtrace).first(config.backtrace_lines)
     end
 
-    def filtered_url
-      return nil unless request
-
-      base  = "#{request.base_url}#{request.path}"
-      query = filtered_query_string
-      query.empty? ? base : "#{base}?#{query}"
-    end
-
-    def filtered_query_string
-      raw = request.query_string.to_s
-      return "" if raw.empty?
-
-      Rack::Utils.build_nested_query(parameter_filter.filter(Rack::Utils.parse_nested_query(raw)))
-    rescue StandardError
-      ""
+    # Without the query string, which is sent only as part of the filtered
+    # Params field, so include_params = false leaves it out.
+    def request_url
+      request && "#{request.base_url}#{request.path}"
     end
 
     def request_params

data/lib/rails_discord_notifier/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RailsDiscordNotifier
-  VERSION = "0.3.1"
+  VERSION = "0.3.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_discord_notifier
 version: !ruby/object:Gem::Version
-  version: 0.3.1
+  version: 0.3.2
 platform: ruby
 authors:
 - GettinDrikkieWithIt