rollbar 2.18.0 → 2.18.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: e357b034a0d0686c4ff7e2df37e4500b964ff1d8
-  data.tar.gz: 8af0947410c8afd1a1b8e7d6691cc57651f0906f
+  metadata.gz: cc9f32ab8c6d24f72b8c9da57f175524f7942f39
+  data.tar.gz: f46f2f866b7a0049ce8a0e2d2e5af6763bed93dc
 SHA512:
-  metadata.gz: 1d320a75cf677e32ab3bf635bdff22235b39b44e4dce406b74151a2bbd9e344fb0113a2130061e93c1cd473a1f27964c97ad2b68c8a8b20b69766b9dd951cdb8
-  data.tar.gz: 371056dcb28f6247fafbd6404e1a39f873660060758393119b588cd15e9c8b67f349407422ca31b5ce163dd48a1b356ad665fcbb8d42a31ebcf81b3701150961
+  metadata.gz: 6f7c1ac02748f5b3c669fe694ecb9989c6cc941ab6321cc4a3faa4f6ad9f28ebe9efedf1add9b1fad7ba328561921a0d456c8ed2bdfb3feb2e773baebbece73d
+  data.tar.gz: 111635866796fc71e1cb6e261661d6c7094a19afabbb591aec0690bf9927bd00cedca2470fdd8544fd62d9d3a1f35f23a63c6ef904e1a31f089d0f2d5a8fced6

data/Gemfile

@@ -12,7 +12,13 @@ gem 'rake'
 gem 'rspec-rails', '~> 3.4'
 gem 'sqlite3', :platform => [:ruby, :mswin, :mingw]
 
-gem 'oj', '~> 2.12.14' unless is_jruby
+unless is_jruby
+  if RUBY_VERSION >= '2.4.0'
+    gem 'oj', '~> 2.16.1'
+  else
+    gem 'oj', '~> 2.12.14'
+  end
+end
 
 if RUBY_VERSION > '1.8.7' && RUBY_VERSION < '2.2.2'
   gem 'sidekiq', '>= 2.13.0', '< 5.0'

data/lib/rollbar/configuration.rb

@@ -111,7 +111,7 @@ module Rollbar
       @scrub_user = true
       @scrub_password = true
       @randomize_scrub_length = true
-      @scrub_whitelist = false
+      @scrub_whitelist = []
       @uncaught_exception_level = 'error'
       @scrub_headers = ['Authorization']
       @sidekiq_threshold = 0

data/lib/rollbar/scrubbers/params.rb

@@ -6,7 +6,8 @@ module Rollbar
     # This class contains the logic to scrub the received parameters. It will
     # scrub the parameters matching Rollbar.configuration.scrub_fields Array.
     # Also, if that configuration option is set to :scrub_all, it will scrub all
-    # received parameters
+    # received parameters. It will not scrub anything that is in the scrub_whitelist
+    # configuration array even if :scrub_all is true.
     class Params
       SKIPPED_CLASSES = [::Tempfile]
       ATTACHMENT_CLASSES = %w(ActionDispatch::Http::UploadedFile Rack::Multipart::UploadedFile).freeze
@@ -22,7 +23,7 @@ module Rollbar
 
         config = options[:config]
         extra_fields = options[:extra_fields]
-        whitelist = options[:whitelist] | false
+        whitelist = options[:whitelist] || []
 
         scrub(params, build_scrub_options(config, extra_fields, whitelist))
       end
@@ -35,7 +36,7 @@ module Rollbar
         {
           :fields_regex => build_fields_regex(ary_config, extra_fields),
           :scrub_all => ary_config.include?(SCRUB_ALL),
-          :whitelist => whitelist
+          :whitelist => build_whitelist_regex(whitelist)
         }
       end
 
@@ -48,26 +49,33 @@ module Rollbar
         Regexp.new(fields.map { |val| Regexp.escape(val.to_s).to_s }.join('|'), true)
       end
 
+      def build_whitelist_regex(whitelist)
+        fields = whitelist.find_all { |f| f.is_a?(String) || f.is_a?(Symbol) }
+        return unless fields.any?
+        Regexp.new(fields.map { |val| /\A#{Regexp.escape(val.to_s)}\z/ }.join('|'))
+      end
+
       def scrub(params, options)
         fields_regex = options[:fields_regex]
         scrub_all = options[:scrub_all]
-        whitelist = options[:whitelist]
+        whitelist_regex = options[:whitelist]
 
         return scrub_array(params, options) if params.is_a?(Array)
 
         params.to_hash.inject({}) do |result, (key, value)|
-          if fields_regex === Rollbar::Encoding.encode(key).to_s
-            result[key] = whitelist ? rollbar_filtered_param_value(value) : scrub_value(value)
+          encoded_key = Rollbar::Encoding.encode(key).to_s
+          if (fields_regex === encoded_key) && !(whitelist_regex === encoded_key)
+            result[key] = scrub_value(value)
           elsif value.is_a?(Hash)
             result[key] = scrub(value, options)
+          elsif scrub_all && !(whitelist_regex === encoded_key)
+            result[key] = scrub_value(value)
           elsif value.is_a?(Array)
             result[key] = scrub_array(value, options)
           elsif skip_value?(value)
             result[key] = "Skipped value of class '#{value.class.name}'"
-          elsif scrub_all
-            result[key] = scrub_value(value)
           else
-            result[key] = whitelist ? scrub_value(value) : rollbar_filtered_param_value(value)
+            result[key] = rollbar_filtered_param_value(value)
           end
 
           result

data/lib/rollbar/scrubbers/url.rb

@@ -6,6 +6,8 @@ require 'rollbar/language_support'
 module Rollbar
   module Scrubbers
     class URL
+      SCRUB_ALL = :scrub_all
+
       def self.call(*args)
         new.call(*args)
       end
@@ -19,7 +21,8 @@ module Rollbar
                options[:scrub_user],
                options[:scrub_password],
                options.fetch(:randomize_scrub_length, true),
-               options[:whitelist])
+               options[:scrub_fields].include?(SCRUB_ALL),
+               build_whitelist_regex(options[:whitelist] || []))
       rescue => e
         Rollbar.logger.error("[Rollbar] There was an error scrubbing the url: #{e}, options: #{options.inspect}")
         url
@@ -27,12 +30,18 @@ module Rollbar
 
       private
 
-      def filter(url, regex, scrub_user, scrub_password, randomize_scrub_length, whitelist)
+      def build_whitelist_regex(whitelist)
+        fields = whitelist.find_all { |f| f.is_a?(String) || f.is_a?(Symbol) }
+        return unless fields.any?
+        Regexp.new(fields.map { |val| /\A#{Regexp.escape(val.to_s)}\z/ }.join('|'))
+      end
+
+      def filter(url, regex, scrub_user, scrub_password, randomize_scrub_length, scrub_all, whitelist)
         uri = URI.parse(url)
 
         uri.user = filter_user(uri.user, scrub_user, randomize_scrub_length)
         uri.password = filter_password(uri.password, scrub_password, randomize_scrub_length)
-        uri.query = filter_query(uri.query, regex, randomize_scrub_length, whitelist)
+        uri.query = filter_query(uri.query, regex, randomize_scrub_length, scrub_all, whitelist)
 
         uri.to_s
       end
@@ -53,12 +62,12 @@ module Rollbar
         scrub_password && password ? filtered_value(password, randomize_scrub_length) : password
       end
 
-      def filter_query(query, regex, randomize_scrub_length, whitelist)
+      def filter_query(query, regex, randomize_scrub_length, scrub_all, whitelist)
         return query unless query
 
         params = decode_www_form(query)
 
-        encoded_query = encode_www_form(filter_query_params(params, regex, randomize_scrub_length, whitelist))
+        encoded_query = encode_www_form(filter_query_params(params, regex, randomize_scrub_length, scrub_all, whitelist))
 
         # We want this to rebuild array params like foo[]=1&foo[]=2
         URI.escape(CGI.unescape(encoded_query))
@@ -72,18 +81,14 @@ module Rollbar
         URI.encode_www_form(params)
       end
 
-      def filter_query_params(params, regex, randomize_scrub_length, whitelist)
+      def filter_query_params(params, regex, randomize_scrub_length, scrub_all, whitelist)
         params.map do |key, value|
-          if whitelist
-            [key, filter_key?(key, regex) ? value : filtered_value(value, randomize_scrub_length)]
-          else
-            [key, filter_key?(key, regex) ? filtered_value(value, randomize_scrub_length) : value]
-          end
+          [key, filter_key?(key, regex, scrub_all, whitelist) ? filtered_value(value, randomize_scrub_length) : value]
         end
       end
 
-      def filter_key?(key, regex)
-        !!(key =~ regex)
+      def filter_key?(key, regex, scrub_all, whitelist)
+        !(whitelist === key) && (scrub_all || regex === key)
       end
 
       def filtered_value(value, randomize_scrub_length)

data/lib/rollbar/version.rb

@@ -1,3 +1,3 @@
 module Rollbar
-  VERSION = '2.18.0'
+  VERSION = '2.18.2'
 end

data/spec/rollbar/scrubbers/params_spec.rb

@@ -278,31 +278,140 @@ describe Rollbar::Scrubbers::Params do
     context 'with :scrub_all option' do
       let(:scrub_config) { :scrub_all }
       
-      let(:params) do
-        {
-          :foo => 'bar',
-          :password => 'the-password',
-          :bar => 'foo',
-          :extra => {
-            :foo => 'more-foo',
-            :bar => 'more-bar'
+      context 'with simple hash' do
+        let(:params) do
+          {
+            :foo => 'bar',
+            :password => 'the-password',
+            :bar => 'foo',
+            :extra => {
+              :foo => 'more-foo',
+              :bar => 'more-bar'
+            }
           }
-        }
+        end
+        let(:result) do
+          {
+            :foo => /\*+/,
+            :password => /\*+/,
+            :bar => /\*+/,
+            :extra => {
+              :foo => /\*+/,
+              :bar => /\*+/
+            }
+          }
+        end
+
+        it 'scrubs the required parameters' do
+          expect(subject.call(options)).to be_eql_hash_with_regexes(result)
+        end
       end
-      let(:result) do
-        {
-          :foo => /\*+/,
-          :password => /\*+/,
-          :bar => /\*+/,
-          :extra => {
+
+      context 'with nested arrays' do
+        let(:params) do
+          {
+            :foo => 'bar',
+            :password => 'the-password',
+            :bar => 'foo',
+            :extra => [
+              'hello world',
+              {
+                :foo => 'more-foo',
+                :bar => 'more-bar'
+              }
+            ]
+          }
+        end
+        let(:result) do
+          {
             :foo => /\*+/,
-            :bar => /\*+/
+            :password => /\*+/,
+            :bar => /\*+/,
+            :extra => /\*+/,
           }
-        }
+        end
+
+        it 'scrubs the required parameters' do
+          expect(subject.call(options)).to be_eql_hash_with_regexes(result)
+        end
       end
 
-      it 'scrubs the required parameters' do
-        expect(subject.call(options)).to be_eql_hash_with_regexes(result)
+      context 'and with :whitelist option' do
+        let (:whitelist) { [:foo, :buzz] }
+
+        context 'with simple hash' do
+          let(:params) do
+            {
+              :foo => 'bar',
+              :password => 'the-password',
+              :bar => 'foo',
+              :extra => {
+                :foo => 'more-foo',
+                :bar => 'more-bar'
+              }
+            }
+          end
+          let(:result) do
+            {
+              :foo => 'bar',
+              :password => /\*+/,
+              :bar => /\*+/,
+              :extra => {
+                :foo => 'more-foo',
+                :bar => /\*+/
+              }
+            }
+          end
+
+          it 'scrubs the required parameters' do
+            expect(subject.call(options)).to be_eql_hash_with_regexes(result)
+          end
+        end
+
+        context 'with nested arrays' do
+          let(:params) do
+            {
+              :foo => 'bar',
+              :password => 'the-password',
+              :bar => 'foo',
+              :extra => [
+                'hello world',
+                {
+                  :foo => 'more-foo',
+                  :bar => 'more-bar'
+                }
+              ],
+              :buzz => [
+                'fizzbuzz',
+                {
+                  :a => 42,
+                  :foo => 'another-foo',
+                  :b => 'this should be scrubbed'
+                }
+              ]
+            }
+          end
+          let(:result) do
+            {
+              :foo => 'bar',
+              :password => /\*+/,
+              :bar => /\*+/,
+              :extra => /\*+/,
+              :buzz => [
+                'fizzbuzz',
+                {
+                  :a => /\*+/,
+                  :foo => 'another-foo',
+                  :b => /\*+/
+                }
+              ]
+            }
+          end
+
+          it 'scrubs the required parameters' do
+            expect(subject.call(options)).to be_eql_hash_with_regexes(result)
+          end
+        end
       end
     end
     
@@ -311,7 +420,7 @@ describe Rollbar::Scrubbers::Params do
         [:secret, :password]
       end
       
-      let(:whitelist) { true }
+      let(:whitelist) { [:password] }
 
       context 'with Array object' do
         let(:params) do
@@ -327,10 +436,10 @@ describe Rollbar::Scrubbers::Params do
         let(:result) do
           [
             {
-              :foo => /\*+/,
-              :secret => 'the-secret',
+              :foo => 'bar',
+              :secret => /\*+/,
               :password => 'the-password',
-              :password_confirmation => 'the-password'
+              :password_confirmation => /\*+/
             }
           ]
         end
@@ -351,10 +460,10 @@ describe Rollbar::Scrubbers::Params do
         end
         let(:result) do
           {
-            :foo => /\*+/,
-            :secret => 'the-secret',
+            :foo => 'bar',
+            :secret => /\*+/,
             :password => 'the-password',
-            :password_confirmation => 'the-password'
+            :password_confirmation => /\*+/
           }
         end
 
@@ -384,15 +493,15 @@ describe Rollbar::Scrubbers::Params do
         end
         let(:result) do
           {
-            :foo => /\*+/,
+            :foo => 'bar',
             :extra => {
-              :secret => 'the-secret',
+              :secret => /\*+/,
               :password => 'the-password',
-              :password_confirmation => 'the-password'
+              :password_confirmation => /\*+/
             },
             :other => {
-              :param => 'filtered',
-              :to_scrub => /\*+/
+              :param => /\*+/,
+              :to_scrub => 'to_scrub'
             }
           }
         end
@@ -423,15 +532,15 @@ describe Rollbar::Scrubbers::Params do
         end
         let(:result) do
           {
-            :foo => /\*+/,
+            :foo => 'bar',
             :extra => [{
-              :secret => 'the-secret',
+              :secret => /\*+/,
               :password => 'the-password',
-              :password_confirmation => 'the-password'
+              :password_confirmation => /\*+/
             }],
             :other => [{
-              :param => 'filtered',
-              :to_scrub => /\*+/
+              :param => /\*+/,
+              :to_scrub => 'to_scrub'
             }]
           }
         end
@@ -456,11 +565,11 @@ describe Rollbar::Scrubbers::Params do
         end
         let(:result) do
           {
-            :foo => /\*+/,
+            :foo => 'bar',
             :extra => [{
-              :secret => 'the-secret',
+              :secret => /\*+/,
               :password => 'the-password',
-              :password_confirmation => 'the-password',
+              :password_confirmation => /\*+/,
               :skipped => "Skipped value of class 'Tempfile'"
             }]
           }

data/spec/rollbar/scrubbers/url_spec.rb

@@ -11,11 +11,11 @@ describe Rollbar::Scrubbers::URL do
       :scrub_password => false,
       :randomize_scrub_length => true
     }
-      
+
     if defined? whitelist
       options[:whitelist] = whitelist
     end
-    
+
     options
   end
 
@@ -138,25 +138,25 @@ describe Rollbar::Scrubbers::URL do
         end
       end
     end
-    
+
     context 'in whitelist mode' do
-      
-      let(:whitelist) { true }
-      
+
+      let(:whitelist) { [:user, :secret] }
+
       context 'with ruby different from 1.8' do
         next unless Rollbar::LanguageSupport.can_scrub_url?
-        
+
         context 'cannot scrub URLs' do
-    
+
           let(:url) { 'http://user:password@foo.com/some-interesting-path#fragment' }
-    
+
           it 'returns the URL without any change' do
             expect(subject.call(options)).to be_eql(url)
           end
         end
-          
+
         context 'scrubbing user and password' do
-          
+
           let(:options) do
             {
               :url => url,
@@ -166,41 +166,70 @@ describe Rollbar::Scrubbers::URL do
               :whitelist => whitelist
             }
           end
-  
+
           let(:url) { 'http://user:password@foo.com/some-interesting-path#fragment' }
-  
+
           it 'returns the URL without any change' do
             expected_url = /http:\/\/\*{3,8}:\*{3,8}@foo.com\/some-interesting\-path#fragment/
-  
+
             expect(subject.call(options)).to match(expected_url)
           end
         end
-        
+
+        context 'with scrub_all' do
+          let(:options) do
+            {
+              :url => url,
+              :scrub_fields => [:scrub_all],
+              :scrub_password => false,
+              :scrub_user => false,
+              :whitelist => whitelist
+            }
+          end
+          let(:url) { 'http://foo.com/some-interesting-path?foo=bar&password=mypassword&secret=somevalue&dont_scrub=foo#fragment' }
+
+          it 'returns the URL with some params filtered' do
+            expected_url = /http:\/\/foo.com\/some-interesting-path\?foo=\*{3,8}&password=\*{3,8}&secret=somevalue&dont_scrub=\*{3,8}#fragment/
+
+            expect(subject.call(options)).to match(expected_url)
+          end
+
+          context 'having array params' do
+            let(:url) { 'http://foo.com/some-interesting-path?foo=bar&password[]=mypassword&password[]=otherpassword&secret=somevalue&dont_scrub=foo#fragment' }
+
+            it 'returns the URL with some params filtered' do
+              expected_url = /http:\/\/foo.com\/some-interesting-path\?foo=\*{3,8}&password\[\]=\*{3,8}&password\[\]=\*{3,8}&secret=somevalue&dont_scrub=\*{3,8}#fragment/
+
+              expect(subject.call(options)).to match(expected_url)
+            end
+          end
+        end
+
         context 'with params to be filtered' do
           let(:options) do
             {
               :url => url,
-              :scrub_fields => [:dont_scrub],
+              :scrub_fields => [:dont_scrub, :secret, :password, :foo],
               :scrub_password => false,
               :scrub_user => false,
               :whitelist => whitelist
             }
           end
-          
+
           let(:url) { 'http://foo.com/some-interesting-path?foo=bar&password=mypassword&secret=somevalue&dont_scrub=foo#fragment' }
-  
+
           it 'returns the URL with some params filtered' do
-            expected_url = /http:\/\/foo.com\/some-interesting-path\?foo=\*{3,8}&password=\*{3,8}&secret=\*{3,8}&dont_scrub=foo#fragment/
-            
+            expected_url = /http:\/\/foo.com\/some-interesting-path\?foo=\*{3,8}&password=\*{3,8}&secret=somevalue&dont_scrub=\*{3,8}#fragment/
+
             expect(subject.call(options)).to match(expected_url)
           end
-  
+
           context 'having array params' do
             let(:url) { 'http://foo.com/some-interesting-path?foo=bar&password[]=mypassword&password[]=otherpassword&secret=somevalue&dont_scrub=foo#fragment' }
-  
+
             it 'returns the URL with some params filtered' do
-              expected_url = /http:\/\/foo.com\/some-interesting-path\?foo=\*{3,8}&password\[\]=\*{3,8}&password\[\]=\*{3,8}&secret=\*{3,8}&dont_scrub=foo#fragment/
-  
+              expected_url = /http:\/\/foo.com\/some-interesting-path\?foo=\*{3,8}&password\[\]=\*{3,8}&password\[\]=\*{3,8}&secret=somevalue&dont_scrub=\*{3,8}#fragment/
+
               expect(subject.call(options)).to match(expected_url)
             end
           end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rollbar
 version: !ruby/object:Gem::Version
-  version: 2.18.0
+  version: 2.18.2
 platform: ruby
 authors:
 - Rollbar, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-09-26 00:00:00.000000000 Z
+date: 2018-12-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: multi_json