rollbar 2.16.2 → 2.22.1

data/lib/rollbar/request_data_extractor.rb

@@ -10,15 +10,19 @@ require 'rollbar/json'
 
 module Rollbar
   module RequestDataExtractor
-    ALLOWED_HEADERS_REGEX = /^HTTP_|^CONTENT_TYPE$|^CONTENT_LENGTH$/
-    ALLOWED_BODY_PARSEABLE_METHODS = %w(POST PUT PATCH DELETE).freeze
+    ALLOWED_HEADERS_REGEX = /^HTTP_|^CONTENT_TYPE$|^CONTENT_LENGTH$/.freeze
+    ALLOWED_BODY_PARSEABLE_METHODS = %w[POST PUT PATCH DELETE].freeze
 
     def extract_person_data_from_controller(env)
-      if env.has_key?('rollbar.person_data')
+      if env.key?('rollbar.person_data')
         person_data = env['rollbar.person_data'] || {}
       else
         controller = env['action_controller.instance']
-        person_data = controller.rollbar_person_data rescue {}
+        person_data = begin
+                        controller.rollbar_person_data
+                      rescue StandardError
+                        {}
+                      end
       end
 
       person_data
@@ -50,9 +54,7 @@ module Rollbar
         :method => rollbar_request_method(env)
       }
 
-      if env['action_dispatch.request_id']
-        data[:request_id] = env['action_dispatch.request_id']
-      end
+      data[:request_id] = env['action_dispatch.request_id'] if env['action_dispatch.request_id']
 
       data
     end
@@ -63,7 +65,8 @@ module Rollbar
         :scrub_fields => Array(Rollbar.configuration.scrub_fields) + sensitive_params,
         :scrub_user => Rollbar.configuration.scrub_user,
         :scrub_password => Rollbar.configuration.scrub_password,
-        :randomize_scrub_length => Rollbar.configuration.randomize_scrub_length
+        :randomize_scrub_length => Rollbar.configuration.randomize_scrub_length,
+        :whitelist => Rollbar.configuration.scrub_whitelist
       }
 
       Rollbar::Scrubbers::URL.call(options)
@@ -73,7 +76,8 @@ module Rollbar
       options = {
         :params => params,
         :config => Rollbar.configuration.scrub_fields,
-        :extra_fields => sensitive_params
+        :extra_fields => sensitive_params,
+        :whitelist => Rollbar.configuration.scrub_whitelist
       }
       Rollbar::Scrubbers::Params.call(options)
     end
@@ -105,6 +109,14 @@ module Rollbar
           { name => Rollbar::Scrubbers.scrub_value(env[header]) }
         elsif name == 'X-Forwarded-For' && !Rollbar.configuration.collect_user_ip
           {}
+        elsif name == 'X-Forwarded-For' && Rollbar.configuration.collect_user_ip && Rollbar.configuration.anonymize_user_ip
+          ips = env[header].sub(' ', '').split(',')
+          ips = ips.map { |ip| Rollbar::Util::IPAnonymizer.anonymize_ip(ip) }
+          { name => ips.join(', ') }
+        elsif name == 'X-Real-Ip' && !Rollbar.configuration.collect_user_ip
+          {}
+        elsif name == 'X-Real-Ip' && Rollbar.configuration.collect_user_ip && Rollbar.configuration.anonymize_user_ip
+          { name => Rollbar::Util::IPAnonymizer.anonymize_ip(env[header]) }
         else
           { name => env[header] }
         end
@@ -124,8 +136,8 @@ module Rollbar
       end
 
       port = env['HTTP_X_FORWARDED_PORT']
-      if port && !(!scheme.nil? && scheme.downcase == 'http' && port.to_i == 80) && \
-         !(!scheme.nil? && scheme.downcase == 'https' && port.to_i == 443) && \
+      if port && !(!scheme.nil? && scheme.casecmp('http').zero? && port.to_i == 80) && \
+         !(!scheme.nil? && scheme.casecmp('https').zero? && port.to_i == 443) && \
          !(host.include? ':')
         host = host + ':' + port
       end
@@ -135,12 +147,13 @@ module Rollbar
 
     def rollbar_user_ip(env)
       return nil unless Rollbar.configuration.collect_user_ip
+
       user_ip_string = (env['action_dispatch.remote_ip'] || env['HTTP_X_REAL_IP'] || x_forwarded_for_client(env['HTTP_X_FORWARDED_FOR']) || env['REMOTE_ADDR']).to_s
 
       user_ip_string = Rollbar::Util::IPAnonymizer.anonymize_ip(user_ip_string)
 
       Rollbar::Util::IPObfuscator.obfuscate_ip(user_ip_string)
-    rescue
+    rescue StandardError
       nil
     end
 
@@ -166,13 +179,13 @@ module Rollbar
 
     def rollbar_get_params(rack_req)
       rack_req.GET
-    rescue
+    rescue StandardError
       {}
     end
 
     def rollbar_post_params(rack_req)
       rack_req.POST
-    rescue
+    rescue StandardError
       {}
     end
 
@@ -185,18 +198,19 @@ module Rollbar
       raw_body = rack_req.body.read
       begin
         Rollbar::JSON.load(raw_body)
-      rescue
+      rescue StandardError
         raw_body
       end
-    rescue
+    rescue StandardError
       {}
     ensure
       rack_req.body.rewind
     end
 
     def json_request?(rack_req)
-      !!(rack_req.env['CONTENT_TYPE'] =~ %r{application/json} ||
-         rack_req.env['ACCEPT'] =~ /\bjson\b/)
+      json_regex = /\bjson\b/
+
+      !!(rack_req.env['CONTENT_TYPE'] =~ json_regex)
     end
 
     def rollbar_route_params(env)
@@ -209,7 +223,7 @@ module Rollbar
         # route params (if any)and format (if defined)
         ::Rails.application.routes.recognize_path(env['PATH_INFO'],
                                                   environment)
-      rescue
+      rescue StandardError
         {}
       end
     end
@@ -218,13 +232,13 @@ module Rollbar
       session = env.fetch('rack.session', {})
 
       session.to_hash
-    rescue
+    rescue StandardError
       {}
     end
 
     def rollbar_request_cookies(rack_req)
       rack_req.cookies
-    rescue
+    rescue StandardError
       {}
     end
 

data/lib/rollbar/rollbar_test.rb

@@ -0,0 +1,147 @@
+require 'rollbar'
+begin
+  require 'rack/mock'
+rescue LoadError
+  puts 'Cannot load rack/mock'
+end
+require 'logger'
+
+# Module to inject into the Rails controllers or rack apps
+module RollbarTest # :nodoc:
+  def test_rollbar
+    puts 'Raising RollbarTestingException to simulate app failure.'
+
+    raise RollbarTestingException.new, ::RollbarTest.success_message
+  end
+
+  def self.run
+    return unless confirmed_token?
+
+    configure_rails if defined?(Rails)
+
+    puts 'Testing manual report...'
+    Rollbar.error('Test error from rollbar:test')
+
+    return unless defined?(Rack::MockRequest)
+
+    protocol, app = setup_app
+
+    puts 'Processing...'
+    env = Rack::MockRequest.env_for("#{protocol}://www.example.com/verify", 'REMOTE_ADDR' => '127.0.0.1')
+    status, = app.call(env)
+
+    puts error_message unless status.to_i == 500
+  end
+
+  def self.configure_rails
+    Rails.logger = if defined?(ActiveSupport::TaggedLogging)
+                     ActiveSupport::TaggedLogging.new(Logger.new(STDOUT))
+                   else
+                     Logger.new(STDOUT)
+                   end
+
+    Rails.logger.level = Logger::DEBUG
+    Rollbar.preconfigure do |config|
+      config.logger = Rails.logger
+    end
+  end
+
+  def self.confirmed_token?
+    return true if Rollbar.configuration.access_token
+
+    puts token_error_message
+
+    false
+  end
+
+  def self.authlogic_config
+    # from http://stackoverflow.com/questions/5270835/authlogic-activation-problems
+    return unless defined?(Authlogic)
+
+    Authlogic::Session::Base.controller = Authlogic::ControllerAdapters::RailsAdapter.new(self)
+  end
+
+  def self.setup_app
+    puts 'Setting up the test app.'
+
+    if defined?(Rails)
+      app = rails_app
+
+      draw_rails_route(app)
+
+      authlogic_config
+
+      [rails_protocol(app), app]
+    else
+      ['http', rack_app]
+    end
+  end
+
+  def self.rails_app
+    # The setup below is needed for Rails 5.x, but not for Rails 4.x and below.
+    # (And fails on Rails 4.x in various ways depending on the exact version.)
+    return Rails.application if Rails.version < '5.0.0'
+
+    # Spring now runs by default in development on all new Rails installs. This causes
+    # the new `/verify` route to not get picked up if `config.cache_classes == false`
+    # which is also a default in development env.
+    #
+    # `config.cache_classes` needs to be set, but the only possible time is at app load,
+    # so here we clone the default app with an updated config.
+    #
+    config = Rails.application.config
+    config.cache_classes = true
+
+    # Make a copy of the app, so the config can be updated.
+    Rails.application.class.name.constantize.new(:config => config)
+  end
+
+  def self.draw_rails_route(app)
+    app.routes_reloader.execute_if_updated
+    app.routes.draw do
+      get 'verify' => 'rollbar_test#verify', :as => 'verify'
+    end
+  end
+
+  def self.rails_protocol(app)
+    defined?(app.config.force_ssl && app.config.force_ssl) ? 'https' : 'http'
+  end
+
+  def self.rack_app
+    Class.new do
+      include RollbarTest
+
+      def self.call(_env)
+        new.test_rollbar
+      end
+    end
+  end
+
+  def self.token_error_message
+    'Rollbar needs an access token configured. Check the README for instructions.'
+  end
+
+  def self.error_message
+    'Test failed! You may have a configuration issue, or you could be using a gem that\'s blocking the test. Contact support@rollbar.com if you need help troubleshooting.'
+  end
+
+  def self.success_message
+    'Testing rollbar with "rake rollbar:test". If you can see this, it works.'
+  end
+end
+
+class RollbarTestingException < RuntimeError; end
+
+if defined?(Rails)
+  class RollbarTestController < ActionController::Base # :nodoc:
+    include RollbarTest
+
+    def verify
+      test_rollbar
+    end
+
+    def logger
+      nil
+    end
+  end
+end

data/lib/rollbar/scrubbers.rb

@@ -1,17 +1,21 @@
 module Rollbar
   module Scrubbers
-    extend self
+    module_function
 
     def scrub_value(value)
       if Rollbar.configuration.randomize_scrub_length
         random_filtered_value
       else
-        '*' * (value.length rescue 8)
+        '*' * (begin
+                 value.length
+               rescue StandardError
+                 8
+               end)
       end
     end
 
     def random_filtered_value
-      '*' * (rand(5) + 3)
+      '*' * rand(3..7)
     end
   end
 end

data/lib/rollbar/scrubbers/params.rb

@@ -6,10 +6,11 @@ module Rollbar
     # This class contains the logic to scrub the received parameters. It will
     # scrub the parameters matching Rollbar.configuration.scrub_fields Array.
     # Also, if that configuration option is set to :scrub_all, it will scrub all
-    # received parameters
+    # received parameters. It will not scrub anything that is in the scrub_whitelist
+    # configuration array even if :scrub_all is true.
     class Params
-      SKIPPED_CLASSES = [::Tempfile]
-      ATTACHMENT_CLASSES = %w(ActionDispatch::Http::UploadedFile Rack::Multipart::UploadedFile).freeze
+      SKIPPED_CLASSES = [::Tempfile].freeze
+      ATTACHMENT_CLASSES = %w[ActionDispatch::Http::UploadedFile Rack::Multipart::UploadedFile].freeze
       SCRUB_ALL = :scrub_all
 
       def self.call(*args)
@@ -20,20 +21,24 @@ module Rollbar
         params = options[:params]
         return {} unless params
 
+        @scrubbed_object_ids = {}
+
         config = options[:config]
         extra_fields = options[:extra_fields]
+        whitelist = options[:whitelist] || []
 
-        scrub(params, build_scrub_options(config, extra_fields))
+        scrub(params, build_scrub_options(config, extra_fields, whitelist))
       end
 
       private
 
-      def build_scrub_options(config, extra_fields)
+      def build_scrub_options(config, extra_fields, whitelist)
         ary_config = Array(config)
 
         {
           :fields_regex => build_fields_regex(ary_config, extra_fields),
-          :scrub_all => ary_config.include?(SCRUB_ALL)
+          :scrub_all => ary_config.include?(SCRUB_ALL),
+          :whitelist => build_whitelist_regex(whitelist)
         }
       end
 
@@ -46,26 +51,39 @@ module Rollbar
         Regexp.new(fields.map { |val| Regexp.escape(val.to_s).to_s }.join('|'), true)
       end
 
+      def build_whitelist_regex(whitelist)
+        fields = whitelist.find_all { |f| f.is_a?(String) || f.is_a?(Symbol) || f.is_a?(Regexp) }
+        return unless fields.any?
+
+        Regexp.new(fields.map { |val| val.is_a?(Regexp) ? val : /\A#{Regexp.escape(val.to_s)}\z/ }.join('|'))
+      end
+
       def scrub(params, options)
+        return params if @scrubbed_object_ids[params.object_id]
+
+        @scrubbed_object_ids[params.object_id] = true
+
         fields_regex = options[:fields_regex]
         scrub_all = options[:scrub_all]
+        whitelist_regex = options[:whitelist]
 
         return scrub_array(params, options) if params.is_a?(Array)
 
         params.to_hash.inject({}) do |result, (key, value)|
-          if fields_regex === Rollbar::Encoding.encode(key).to_s
-            result[key] = scrub_value(value)
-          elsif value.is_a?(Hash)
-            result[key] = scrub(value, options)
-          elsif value.is_a?(Array)
-            result[key] = scrub_array(value, options)
-          elsif skip_value?(value)
-            result[key] = "Skipped value of class '#{value.class.name}'"
-          elsif scrub_all
-            result[key] = scrub_value(value)
-          else
-            result[key] = rollbar_filtered_param_value(value)
-          end
+          encoded_key = Rollbar::Encoding.encode(key).to_s
+          result[key] = if (fields_regex === encoded_key) && !(whitelist_regex === encoded_key)
+                          scrub_value(value)
+                        elsif value.is_a?(Hash)
+                          scrub(value, options)
+                        elsif scrub_all && !(whitelist_regex === encoded_key)
+                          scrub_value(value)
+                        elsif value.is_a?(Array)
+                          scrub_array(value, options)
+                        elsif skip_value?(value)
+                          "Skipped value of class '#{value.class.name}'"
+                        else
+                          rollbar_filtered_param_value(value)
+                        end
 
           result
         end
@@ -85,7 +103,7 @@ module Rollbar
         if ATTACHMENT_CLASSES.include?(value.class.name)
           begin
             attachment_value(value)
-          rescue
+          rescue StandardError
             'Uploaded file'
           end
         else

data/lib/rollbar/scrubbers/url.rb

@@ -6,32 +6,42 @@ require 'rollbar/language_support'
 module Rollbar
   module Scrubbers
     class URL
+      SCRUB_ALL = :scrub_all
+
       def self.call(*args)
         new.call(*args)
       end
 
       def call(options = {})
         url = options[:url]
-        return url unless Rollbar::LanguageSupport.can_scrub_url?
 
         filter(url,
                build_regex(options[:scrub_fields]),
                options[:scrub_user],
                options[:scrub_password],
-               options.fetch(:randomize_scrub_length, true))
-      rescue => e
+               options.fetch(:randomize_scrub_length, true),
+               options[:scrub_fields].include?(SCRUB_ALL),
+               build_whitelist_regex(options[:whitelist] || []))
+      rescue StandardError => e
         Rollbar.logger.error("[Rollbar] There was an error scrubbing the url: #{e}, options: #{options.inspect}")
         url
       end
 
       private
 
-      def filter(url, regex, scrub_user, scrub_password, randomize_scrub_length)
+      def build_whitelist_regex(whitelist)
+        fields = whitelist.find_all { |f| f.is_a?(String) || f.is_a?(Symbol) }
+        return unless fields.any?
+
+        Regexp.new(fields.map { |val| /\A#{Regexp.escape(val.to_s)}\z/ }.join('|'))
+      end
+
+      def filter(url, regex, scrub_user, scrub_password, randomize_scrub_length, scrub_all, whitelist)
         uri = URI.parse(url)
 
         uri.user = filter_user(uri.user, scrub_user, randomize_scrub_length)
         uri.password = filter_password(uri.password, scrub_password, randomize_scrub_length)
-        uri.query = filter_query(uri.query, regex, randomize_scrub_length)
+        uri.query = filter_query(uri.query, regex, randomize_scrub_length, scrub_all, whitelist)
 
         uri.to_s
       end
@@ -52,12 +62,12 @@ module Rollbar
         scrub_password && password ? filtered_value(password, randomize_scrub_length) : password
       end
 
-      def filter_query(query, regex, randomize_scrub_length)
+      def filter_query(query, regex, randomize_scrub_length, scrub_all, whitelist)
         return query unless query
 
         params = decode_www_form(query)
 
-        encoded_query = encode_www_form(filter_query_params(params, regex, randomize_scrub_length))
+        encoded_query = encode_www_form(filter_query_params(params, regex, randomize_scrub_length, scrub_all, whitelist))
 
         # We want this to rebuild array params like foo[]=1&foo[]=2
         URI.escape(CGI.unescape(encoded_query))
@@ -71,26 +81,30 @@ module Rollbar
         URI.encode_www_form(params)
       end
 
-      def filter_query_params(params, regex, randomize_scrub_length)
+      def filter_query_params(params, regex, randomize_scrub_length, scrub_all, whitelist)
         params.map do |key, value|
-          [key, filter_key?(key, regex) ? filtered_value(value, randomize_scrub_length) : value]
+          [key, filter_key?(key, regex, scrub_all, whitelist) ? filtered_value(value, randomize_scrub_length) : value]
         end
       end
 
-      def filter_key?(key, regex)
-        !!(key =~ regex)
+      def filter_key?(key, regex, scrub_all, whitelist)
+        !(whitelist === key) && (scrub_all || regex === key)
       end
 
       def filtered_value(value, randomize_scrub_length)
         if randomize_scrub_length
           random_filtered_value
         else
-          '*' * (value.length rescue 8)
+          '*' * (begin
+                   value.length
+                 rescue StandardError
+                   8
+                 end)
         end
       end
 
       def random_filtered_value
-        '*' * (rand(5) + 3)
+        '*' * rand(3..7)
       end
     end
   end