rails_error_dashboard 0.14.1 → 0.14.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b8dc068309c56704b429f7798ce4c3c83b628853179ebc2695c50fa684d2fae9
-  data.tar.gz: 64e3a06e8b60ce8f4c3fe649ca750f228a16e64405b7e239b8440f53e74e536d
+  metadata.gz: 93c0e9e0f21298eb85db1d661793709d60158c5f2c6f85b164da36b4593525ee
+  data.tar.gz: 37bae1ddaca2d502e434e0b4e6e95f6c755619598dec20f08495ce13fd0c286a
 SHA512:
-  metadata.gz: b8605107393952d4e308ebb23f5c1a58ac88dafc9a9664c2429ddb83777a450cb148c1890b25495166a51238d954320bdfcba4b2ef265fe63e8ffea960fb91df
-  data.tar.gz: 4ab62e966ce41257abefdb37e6e3f14a6ae732754cac9ef6c4a4ed37af14982f825e90dac17e8681274959d11ec74bf403458a96ee3069af5919def63b7d77e5
+  metadata.gz: 9c6be20b1be293c069516ed0f5f6fc19e46203224bb9aaad6be1c645f45ebb3455e03e6b3fef8d8738e4cc658dc928cd56c9f2d403d270ec6caaaa74411074b7
+  data.tar.gz: 7c1c344be4398b47faf98de6a9be675f41a86878b49404d76b73d1a5be91f046ded677c70ebb9c1f4118e8736873ea491edcfed07b6520465049b9ecb3e1066b

data/app/controllers/rails_error_dashboard/application_controller.rb

@@ -314,6 +314,15 @@ module RailsErrorDashboard
         expected_password = RailsErrorDashboard.configuration.dashboard_password
         next false if expected_username.nil? || expected_password.nil?
 
+        # A blank credential must deny everyone too: "" would equal an empty login.
+        next false if RailsErrorDashboard::Configuration.blank_credential?(expected_username) ||
+                      RailsErrorDashboard::Configuration.blank_credential?(expected_password)
+
+        # The boot check refuses the published credentials outside development
+        # and test, but it is skipped while SECRET_KEY_BASE_DUMMY is set. Refuse
+        # them here as well, so that variable left set at runtime reopens nothing.
+        next false if RailsErrorDashboard.configuration.refuse_default_credentials?
+
         # Non-short-circuit & on purpose: both comparisons always run, so the
         # response time does not reveal which half was wrong.
         ActiveSupport::SecurityUtils.secure_compare(username.to_s, expected_username.to_s) &

data/config/locales/ja.yml

@@ -23,7 +23,7 @@ ja:
         '30': 30日間
         '90': 90日間
       frame_category:
-        app: 自分のコード
+        app: アプリケーションコード
         gem: Gem
         framework: Rails フレームワーク
         ruby_core: Ruby コア
@@ -520,7 +520,7 @@ ja:
         user_agent: 'User Agent:'
         ip_address: 'IP アドレス:'
         replay: 'リクエストの再現:'
-        raw_user_agent: User Agent の生データ
+        raw_user_agent: User Agent 文字列
         duration_seconds: "%{value}秒"
         duration_ms: "%{value}ミリ秒"
         copy_curl: curl としてコピー
@@ -530,7 +530,7 @@ ja:
         snapshot: 'スナップショット:'
         snapshot_captured_html: '%{time} に取得'
         snapshot_stale: より前の発生から取得 — それ以降の発生はコンテキストを伴いませんでした
-        snapshot_fidelity_lite: 縮小された取得 (storm 保護によりコンテキストの payload が破棄されました)
+        snapshot_fidelity_lite: 限定的な情報取得（storm 保護によりコンテキストの payload を省略）
         snapshot_fidelity_minimal: storm 中にカウントされました — コンテキストは取得されていません
         snapshot_fidelity_partial: 混在したスナップショット — 一部のフィールドは以前の発生時のものです
         snapshot_unknown: RED がスナップショットの出所を記録する前に取得されました
@@ -667,10 +667,10 @@ ja:
           backtrace: Backtrace
         backtrace:
           label: 'Backtrace:'
-          frame_counts: "(自分のコード%{app}件、フレームワーク/gem %{framework}件)"
+          frame_counts: "(アプリケーションコード%{app}件、フレームワーク/gem %{framework}件)"
           copy_full: Backtrace 全体をコピー
           copy_full_title: Backtrace 全体をコピー
-          your_code: 自分のコード
+          your_code: アプリケーションコード
           framework_code: フレームワーク・gem のコード
           frames:
             other: "%{count}フレーム"

data/lib/rails_error_dashboard/configuration.rb

@@ -2,6 +2,12 @@
 
 module RailsErrorDashboard
   class Configuration
+    # The built-in Basic auth credentials. They are published (README, demo,
+    # gemspec), so outside development and test they are refused unless
+    # ERROR_DASHBOARD_PASSWORD explicitly supplies the password.
+    DEFAULT_DASHBOARD_USERNAME = "gandalf"
+    DEFAULT_DASHBOARD_PASSWORD = "youshallnotpass"
+
     # Dashboard authentication (always required)
     attr_accessor :dashboard_username
     attr_accessor :dashboard_password
@@ -269,8 +275,8 @@ module RailsErrorDashboard
 
     def initialize
       # Default values - Authentication is ALWAYS required
-      @dashboard_username = ENV.fetch("ERROR_DASHBOARD_USER", "gandalf")
-      @dashboard_password = ENV.fetch("ERROR_DASHBOARD_PASSWORD", "youshallnotpass")
+      @dashboard_username = ENV.fetch("ERROR_DASHBOARD_USER", DEFAULT_DASHBOARD_USERNAME)
+      @dashboard_password = ENV.fetch("ERROR_DASHBOARD_PASSWORD", DEFAULT_DASHBOARD_PASSWORD)
       @authenticate_with = nil
 
       @user_model = nil  # Auto-detect if not set
@@ -536,12 +542,16 @@ module RailsErrorDashboard
       # (GHSA-qhgm-3pxf-mvc6). Every future environment name a team invents is
       # now refused by default and has to be added here on purpose.
       #
-      # Skip during asset precompilation (SECRET_KEY_BASE_DUMMY=1) — ENV vars aren't available at build time
-      if default_credentials? &&
-         defined?(Rails) && Rails.respond_to?(:env) &&
-         !Rails.env.development? && !Rails.env.test? &&
-         ENV["SECRET_KEY_BASE_DUMMY"].blank?
-        errors << "Default or blank credentials cannot be used in #{Rails.env}. Only development and test may run on the built-in credentials. Set ERROR_DASHBOARD_USER and ERROR_DASHBOARD_PASSWORD environment variables, or use authenticate_with for custom auth."
+      # Skip during asset precompilation (SECRET_KEY_BASE_DUMMY=1) — ENV vars aren't available at build time.
+      # The login refuses the same credentials on its own, so SECRET_KEY_BASE_DUMMY
+      # left set at runtime does not reopen them.
+      if refuse_default_credentials? && ENV["SECRET_KEY_BASE_DUMMY"].blank?
+        reason = if credentials_problem == :blank
+          "the dashboard username or password is blank"
+        else
+          "the dashboard password is the published default and was not set by ERROR_DASHBOARD_PASSWORD"
+        end
+        errors << "Default or blank credentials cannot be used in #{Rails.env}: #{reason}. Only development and test may run on the built-in credentials. Set ERROR_DASHBOARD_USER and ERROR_DASHBOARD_PASSWORD environment variables and make sure the initializer does not overwrite them, or use authenticate_with for custom auth."
       end
 
       # Validate sampling_rate (must be between 0.0 and 1.0)
@@ -925,23 +935,65 @@ module RailsErrorDashboard
       list.empty? ? nil : list
     end
 
-    # Check if using default or blank demo credentials with basic auth
+    # Why the Basic auth credentials cannot be trusted outside development and
+    # test, or nil when they can.
     #
-    # Returns false if the user explicitly set ENV vars (even to the same default values),
-    # because that's a deliberate choice. Only blocks when credentials are untouched defaults
-    # or blank.
+    # - :blank - the username or password is empty or whitespace. An explicitly
+    #   empty variable is not a choice: a compose file passing an unset variable
+    #   through produces exactly that, and "" would match an empty login.
+    # - :published_password - the password is the published default and did not
+    #   come from ERROR_DASHBOARD_PASSWORD. Setting that variable, even to the
+    #   default, is a deliberate choice (the live demo runs that way). It has to
+    #   be THAT variable: setting only ERROR_DASHBOARD_USER used to leave the
+    #   password on the published default, and an initializer can hardcode it.
     #
-    # @return [Boolean] true if basic auth is active with untouched default or blank credentials
-    def default_credentials?
-      return false unless authenticate_with.nil?
+    # Both compare values the way the login does, with to_s: a Symbol holding the
+    # published password logs in just the same.
+    #
+    # @return [Symbol, nil]
+    def credentials_problem
+      return :blank if self.class.blank_credential?(dashboard_username) ||
+                       self.class.blank_credential?(dashboard_password)
+
+      if dashboard_password.to_s == DEFAULT_DASHBOARD_PASSWORD &&
+         ENV["ERROR_DASHBOARD_PASSWORD"] != DEFAULT_DASHBOARD_PASSWORD
+        return :published_password
+      end
 
-      # If user explicitly set ENV vars, respect their choice
-      return false if ENV.key?("ERROR_DASHBOARD_USER") || ENV.key?("ERROR_DASHBOARD_PASSWORD")
+      nil
+    end
 
-      default = dashboard_username == "gandalf" && dashboard_password == "youshallnotpass"
-      blank = dashboard_username.to_s.strip.empty? || dashboard_password.to_s.strip.empty?
+    # True for a credential that cannot be a secret: nil, empty, or only
+    # whitespace, including Unicode whitespace such as a no-break space, which
+    # String#strip leaves in place. The boot check and the login both use it.
+    #
+    # @return [Boolean]
+    def self.blank_credential?(value)
+      value.to_s.blank?
+    end
+
+    # Check if basic auth is active with blank credentials or the published
+    # default password (see #credentials_problem)
+    #
+    # Basic auth is active whenever authenticate_with is falsy, not only nil:
+    # the login falls back to it for `false` too, which is what
+    # `Rails.env.production? && -> { ... }` evaluates to in staging.
+    #
+    # @return [Boolean]
+    def default_credentials?
+      !authenticate_with && !credentials_problem.nil?
+    end
+
+    # True where default_credentials? has to stop the dashboard: anywhere that is
+    # not local development or test. The boot check and the login both use it,
+    # so the login still refuses when the boot check was skipped.
+    #
+    # @return [Boolean]
+    def refuse_default_credentials?
+      return false unless default_credentials?
+      return false unless defined?(Rails) && Rails.respond_to?(:env)
 
-      default || blank
+      !Rails.env.development? && !Rails.env.test?
     end
 
     # Resolve the effective issue tracker provider (auto-detect from git_repository_url).

data/lib/rails_error_dashboard/version.rb

@@ -1,3 +1,3 @@
 module RailsErrorDashboard
-  VERSION = "0.14.1"
+  VERSION = "0.14.2"
 end

data/lib/tasks/error_dashboard.rake

@@ -171,14 +171,19 @@ namespace :error_dashboard do
     if config.authenticate_with
       puts "OK (custom authentication)"
       checks_passed += 1
-    elsif config.dashboard_username == "gandalf" && config.dashboard_password == "youshallnotpass"
-      if Rails.env.production?
-        puts "WARNING - using default credentials in production!"
+    elsif (problem = config.credentials_problem)
+      # Same rule and environment allowlist as the boot check in validate!
+      label = problem == :blank ? "blank credentials" : "default credentials"
+      if config.refuse_default_credentials?
+        puts "WARNING - #{label} outside development and test!"
         checks_failed += 1
       else
-        puts "OK (default credentials - change before production)"
+        puts "OK (#{label} - change before production)"
         warnings += 1
       end
+    elsif config.dashboard_password == RailsErrorDashboard::Configuration::DEFAULT_DASHBOARD_PASSWORD
+      puts "OK (the published default password, set explicitly by ERROR_DASHBOARD_PASSWORD)"
+      warnings += 1
     else
       puts "OK (custom credentials)"
       checks_passed += 1

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_error_dashboard
 version: !ruby/object:Gem::Version
-  version: 0.14.1
+  version: 0.14.2
 platform: ruby
 authors:
 - Anjan Jagirdar
@@ -599,7 +599,7 @@ metadata:
   funding_uri: https://github.com/sponsors/AnjanJ
 post_install_message: |
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-    RED (Rails Error Dashboard) v0.14.1
+    RED (Rails Error Dashboard) v0.14.2
   ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
 
   First install: