rollbar 2.8.3 → 3.6.0

data/lib/rollbar/middleware/js.rb

@@ -0,0 +1,297 @@
+require 'rack'
+require 'rack/response'
+
+require 'rollbar/request_data_extractor'
+require 'rollbar/util'
+
+module Rollbar
+  module Middleware
+    # Middleware to inject the rollbar.js snippet into a 200 html response
+    class Js
+      include Rollbar::RequestDataExtractor
+
+      attr_reader :app, :config
+
+      JS_IS_INJECTED_KEY = 'rollbar.js_is_injected'.freeze
+      SNIPPET = File.read(File.expand_path('../../../../data/rollbar.snippet.js',
+                                           __FILE__))
+
+      def initialize(app, config)
+        @app = app
+        @config = config
+      end
+
+      def call(env)
+        app_result = app.call(env)
+
+        begin
+          return app_result unless add_js?(env, app_result[1])
+
+          response_string = add_js(env, app_result[2])
+          build_response(env, app_result, response_string)
+        rescue StandardError => e
+          Rollbar.log_error(
+            "[Rollbar] Rollbar.js could not be added because #{e} exception"
+          )
+
+          app_result
+        end
+      end
+
+      private
+
+      def enabled?
+        !!config[:enabled]
+      end
+
+      def add_js?(env, headers)
+        enabled? && !env[JS_IS_INJECTED_KEY] &&
+          html?(headers) && !attachment?(headers) && !streaming?(env)
+      end
+
+      def html?(headers)
+        headers['Content-Type'] && headers['Content-Type'].include?('text/html')
+      end
+
+      def attachment?(headers)
+        headers['Content-Disposition'].to_s.include?('attachment')
+      end
+
+      def streaming?(env)
+        return false unless defined?(ActionController::Live)
+
+        env['action_controller.instance']
+          .class.included_modules.include?(ActionController::Live)
+      end
+
+      def add_js(env, response)
+        body = join_body(response)
+        close_old_response(response)
+
+        return nil unless body
+
+        insert_after_idx = find_insertion_point(body)
+        return nil unless insert_after_idx
+
+        build_body_with_js(env, body, insert_after_idx)
+      rescue StandardError => e
+        Rollbar.log_error(
+          "[Rollbar] Rollbar.js could not be added because #{e} exception"
+        )
+        nil
+      end
+
+      def build_response(env, app_result, response_string)
+        return app_result unless response_string
+
+        env[JS_IS_INJECTED_KEY] = true
+
+        status, headers, = app_result
+        if headers.key?('Content-Length')
+          headers['Content-Length'] =
+            response_string.bytesize.to_s
+        end
+
+        response = ::Rack::Response.new(response_string, status, headers)
+
+        finished = response.finish
+
+        # Rack < 2.x Response#finish returns self in array[2].
+        # Rack >= 2.x returns self.body.
+        # Always return with the response object here regardless of rack version.
+        finished[2] = response
+        finished
+      end
+
+      def build_body_with_js(env, body, head_open_end)
+        return body unless head_open_end
+
+        body[0..head_open_end] << config_js_tag(env) << snippet_js_tag(env) <<
+          body[head_open_end + 1..-1]
+      end
+
+      def find_insertion_point(body)
+        find_end_after_regex(body, /<meta\s*charset=/i) ||
+          find_end_after_regex(body, /<meta\s*http-equiv="Content-Type"/i) ||
+          find_end_after_regex(body, /<head\W/i)
+      end
+
+      def find_end_after_regex(body, regex)
+        open_idx = body.index(regex)
+        body.index('>', open_idx) if open_idx
+      end
+
+      def join_body(response)
+        response.to_enum.reduce('') do |acc, fragment|
+          acc << fragment.to_s
+          acc
+        end
+      end
+
+      def close_old_response(response)
+        response.close if response.respond_to?(:close)
+      end
+
+      def config_js_tag(env)
+        require 'json'
+        require 'rollbar/middleware/js/json_value'
+
+        js_config = Rollbar::Util.deep_copy(config[:options])
+
+        add_person_data(js_config, env)
+
+        # MUST use the Ruby JSON encoder (JSON#generate).
+        # See lib/rollbar/middleware/js/json_value
+        json = ::JSON.generate(js_config, Rollbar::JSON::JsOptionsState.new)
+
+        script_tag("var _rollbarConfig = #{json};", env)
+      end
+
+      def add_person_data(js_config, env)
+        person_data = extract_person_data_from_controller(env)
+
+        return if person_data && person_data.empty?
+
+        js_config[:payload] ||= {}
+        js_config[:payload][:person] = person_data if person_data
+      end
+
+      def snippet_js_tag(env)
+        script_tag(js_snippet, env)
+      end
+
+      def js_snippet
+        SNIPPET
+      end
+
+      def script_tag(content, env)
+        nonce = rails5_nonce(env) || secure_headers_nonce(env)
+        script_tag_content = if nonce
+                               "\n<script nonce=\"#{nonce}\">#{content}</script>"
+                             else
+                               "\n<script>#{content}</script>"
+                             end
+
+        html_safe_if_needed(script_tag_content)
+      end
+
+      def html_safe_if_needed(string)
+        string = string.html_safe if string.respond_to?(:html_safe)
+        string
+      end
+
+      # Rails 5.2+ Secure Content Policy
+      def rails5_nonce(env)
+        req = ::ActionDispatch::Request.new(env)
+
+        # Rails will only return a nonce if the app has set a nonce generator.
+        # So if we get a valid nonce here, we know we should use it.
+        #
+        # Having both 'unsafe-inline' and a nonce is a valid and preferred
+        # browser compatibility configuration.
+        #
+        # If the script_src key is missing, Rails will not add the nonce to the headers,
+        # so we detect this and will not add it in this case.
+        req.respond_to?(:content_security_policy) &&
+          req.content_security_policy &&
+          req.content_security_policy.directives['script-src'] &&
+          req.content_security_policy_nonce
+      end
+
+      # Secure Headers gem
+      def secure_headers_nonce(env)
+        req = ::Rack::Request.new(env)
+
+        return unless secure_headers(req).append_nonce?
+
+        ::SecureHeaders.content_security_policy_script_nonce(req)
+      end
+
+      def secure_headers(req)
+        return SecureHeadersFalse.new unless defined?(::SecureHeaders::Configuration)
+
+        # If the nonce key has been set, the app is using nonces for this request.
+        # If it hasn't, we shouldn't cause one to be added to script_src, so return now.
+        return SecureHeadersFalse.new unless secure_headers_nonce_key(req)
+
+        config = ::SecureHeaders::Configuration
+
+        has_nonce = ::SecureHeaders.respond_to?(
+          :content_security_policy_script_nonce
+        )
+        secure_headers_cls = if !has_nonce
+                               SecureHeadersFalse
+                             elsif config.respond_to?(:get)
+                               SecureHeaders3To5
+                             elsif config.dup.respond_to?(:csp)
+                               SecureHeaders6
+                             else
+                               SecureHeadersFalse
+                             end
+
+        secure_headers_cls.new
+      end
+
+      def secure_headers_nonce_key(req)
+        defined?(::SecureHeaders::NONCE_KEY) &&
+          req.env[::SecureHeaders::NONCE_KEY]
+      end
+
+      class SecureHeadersResolver
+        def append_nonce?
+          csp_needs_nonce?(find_csp)
+        end
+
+        private
+
+        def find_csp
+          raise NotImplementedError
+        end
+
+        def csp_needs_nonce?(csp)
+          !opt_out?(csp)
+        end
+
+        def opt_out?(_csp)
+          raise NotImplementedError
+        end
+      end
+
+      class SecureHeadersFalse < SecureHeadersResolver
+        def append_nonce?
+          false
+        end
+      end
+
+      class SecureHeaders3To5 < SecureHeadersResolver
+        private
+
+        def find_csp
+          ::SecureHeaders::Configuration.get.csp
+        end
+
+        def opt_out?(csp)
+          if csp.respond_to?(:opt_out?) && csp.opt_out?
+            csp.opt_out?
+          # secure_headers csp 3.0.x-3.4.x doesn't respond to 'opt_out?'
+          elsif defined?(::SecureHeaders::OPT_OUT) &&
+                ::SecureHeaders::OPT_OUT.is_a?(Symbol)
+            csp == ::SecureHeaders::OPT_OUT
+          end
+        end
+      end
+
+      class SecureHeaders6 < SecureHeadersResolver
+        private
+
+        def find_csp
+          ::SecureHeaders::Configuration.dup.csp
+        end
+
+        def opt_out?(csp)
+          csp.opt_out?
+        end
+      end
+    end
+  end
+end

data/lib/rollbar/middleware/rack/builder.rb

@@ -3,7 +3,7 @@ require 'rollbar/request_data_extractor'
 
 module Rollbar
   module Middleware
-    module Rack
+    class Rack
       module Builder
         include ExceptionReporter
         include RequestDataExtractor
@@ -14,8 +14,8 @@ module Rollbar
           Rollbar.scoped(fetch_scope(env)) do
             begin
               call_without_rollbar(env)
-            rescue ::Exception => exception
-              report_exception_to_rollbar(env, exception)
+            rescue ::Exception => e # rubocop:disable Lint/RescueException
+              report_exception_to_rollbar(env, e)
               raise
             end
           end
@@ -26,7 +26,7 @@ module Rollbar
             :request => proc { extract_request_data_from_rack(env) },
             :person => person_data_proc(env)
           }
-        rescue Exception => e
+        rescue Exception => e # rubocop:disable Lint/RescueException
           report_exception_to_rollbar(env, e)
           raise
         end

data/lib/rollbar/middleware/rack/test_session.rb

@@ -1,14 +1,14 @@
 module Rollbar
   module Middleware
-    module Rack
+    class Rack
       module TestSession
         include ExceptionReporter
 
         def env_for_with_rollbar(path, env)
           env_for_without_rollbar(path, env)
-        rescue Exception => exception
-          report_exception_to_rollbar(env, exception)
-          raise exception
+        rescue Exception => e # rubocop:disable Lint/RescueException
+          report_exception_to_rollbar(env, e)
+          raise e
         end
 
         def self.included(base)

data/lib/rollbar/middleware/rack.rb

@@ -0,0 +1,52 @@
+require 'rollbar'
+require 'rollbar/exception_reporter'
+require 'rollbar/request_data_extractor'
+
+module Rollbar
+  module Middleware
+    class Rack
+      include ::Rollbar::ExceptionReporter
+      include RequestDataExtractor
+
+      def initialize(app)
+        @app = app
+      end
+
+      def call(env)
+        Rollbar.reset_notifier!
+
+        Rollbar.scoped(fetch_scope(env)) do
+          begin
+            Rollbar.notifier.enable_locals
+            response = @app.call(env)
+            report_exception_to_rollbar(env, framework_error(env)) if framework_error(env)
+            response
+          rescue Exception => e # rubocop:disable Lint/RescueException
+            report_exception_to_rollbar(env, e)
+            raise
+          ensure
+            Rollbar.notifier.disable_locals
+          end
+        end
+      end
+
+      def fetch_scope(env)
+        {
+          :request => proc { extract_request_data_from_rack(env) },
+          :person => person_data_proc(env)
+        }
+      rescue Exception => e # rubocop:disable Lint/RescueException
+        report_exception_to_rollbar(env, e)
+        raise
+      end
+
+      def person_data_proc(env)
+        proc { extract_person_data_from_controller(env) }
+      end
+
+      def framework_error(env)
+        env['rack.exception']
+      end
+    end
+  end
+end

data/lib/rollbar/middleware/rails/rollbar.rb

@@ -21,6 +21,7 @@ module Rollbar
 
           Rollbar.scoped(scope) do
             begin
+              Rollbar.notifier.enable_locals
               response = @app.call(env)
 
               if (framework_exception = env['action_dispatch.exception'])
@@ -28,9 +29,11 @@ module Rollbar
               end
 
               response
-            rescue Exception => exception
-              report_exception_to_rollbar(env, exception)
+            rescue Exception => e # rubocop:disable Lint/RescueException
+              report_exception_to_rollbar(env, e)
               raise
+            ensure
+              Rollbar.notifier.disable_locals
             end
           end
         end
@@ -60,17 +63,26 @@ module Rollbar
 
         def person_data_proc(env)
           block = proc { extract_person_data_from_controller(env) }
-          return block unless(defined?(ActiveRecord::Base) && ActiveRecord::Base.connected?)
+          unless defined?(ActiveRecord::Base) && ActiveRecord::Base.connected?
+            return block
+          end
 
-          proc { ActiveRecord::Base.connection_pool.with_connection(&block) }
+          proc do
+            begin
+              ActiveRecord::Base.connection_pool.with_connection(&block)
+            rescue ActiveRecord::ConnectionTimeoutError
+              {}
+            end
+          end
         end
 
         def context(request_data)
-          return unless request_data[:route]
+          route_params = request_data[:params]
 
-          route = request_data[:route]
           # make sure route is a hash built by RequestDataExtractor
-          return "#{route[:controller]}" + '#' + "#{route[:action]}" if route.is_a?(Hash) && !route.empty?
+          return unless route_params.is_a?(Hash) && !route_params.empty?
+
+          "#{route_params[:controller]}##{route_params[:action]}"
         end
       end
     end

data/lib/rollbar/middleware/rails/show_exceptions.rb

@@ -4,10 +4,10 @@ module Rollbar
       module ShowExceptions
         include ExceptionReporter
 
-        def render_exception_with_rollbar(env, exception)
+        def render_exception_with_rollbar(env, exception, wrapper = nil)
           key = 'action_dispatch.show_detailed_exceptions'
 
-          if exception.is_a?(ActionController::RoutingError) && env[key]
+          if exception.is_a?(ActionController::RoutingError) && env.params[key.to_s]
             scope = extract_scope_from(env)
 
             Rollbar.scoped(scope) do
@@ -15,32 +15,44 @@ module Rollbar
             end
           end
 
-          render_exception_without_rollbar(env, exception)
+          # Rails 7.1 changes the method signature for render_exception.
+          if self.class.instance_method(:render_exception_without_rollbar).arity == 2
+            render_exception_without_rollbar(env, exception)
+          else
+            render_exception_without_rollbar(env, exception, wrapper)
+          end
         end
 
         def call_with_rollbar(env)
           call_without_rollbar(env)
-        rescue ActionController::RoutingError => exception
+        rescue ActionController::RoutingError => e
           # won't reach here if show_detailed_exceptions is true
           scope = extract_scope_from(env)
 
           Rollbar.scoped(scope) do
-            report_exception_to_rollbar(env, exception)
+            report_exception_to_rollbar(env, e)
           end
 
-          raise exception
+          raise e
         end
 
         def extract_scope_from(env)
           scope = env['rollbar.scope']
-          Rollbar.log_warn('[Rollbar] rollbar.scope key has been removed from Rack env.') unless scope
+          unless scope
+            Rollbar.log_warn(
+              '[Rollbar] rollbar.scope key has been removed from Rack env.'
+            )
+          end
 
           scope || {}
         end
 
         def self.included(base)
-          base.send(:alias_method_chain, :call, :rollbar)
-          base.send(:alias_method_chain, :render_exception, :rollbar)
+          base.send(:alias_method, :call_without_rollbar, :call)
+          base.send(:alias_method, :call, :call_with_rollbar)
+
+          base.send(:alias_method, :render_exception_without_rollbar, :render_exception)
+          base.send(:alias_method, :render_exception, :render_exception_with_rollbar)
         end
       end
     end

data/lib/rollbar/middleware/sinatra.rb

@@ -1,46 +1,8 @@
-require 'rollbar'
-require 'rollbar/exception_reporter'
-require 'rollbar/request_data_extractor'
+require 'rollbar/middleware/rack'
 
 module Rollbar
   module Middleware
-    class Sinatra
-      include ::Rollbar::ExceptionReporter
-      include RequestDataExtractor
-
-      def initialize(app)
-        @app = app
-      end
-
-      def call(env)
-        Rollbar.reset_notifier!
-
-        Rollbar.scoped(fetch_scope(env)) do
-          begin
-            response = @app.call(env)
-            report_exception_to_rollbar(env, framework_error(env)) if framework_error(env)
-            response
-          rescue Exception => e
-            report_exception_to_rollbar(env, e)
-            raise
-          end
-        end
-      end
-
-      def fetch_scope(env)
-        {
-          :request => proc { extract_request_data_from_rack(env) },
-          :person => person_data_proc(env)
-        }
-      rescue Exception => e
-        report_exception_to_rollbar(env, e)
-        raise
-      end
-
-      def person_data_proc(env)
-        proc { extract_person_data_from_controller(env) }
-      end
-
+    class Sinatra < Rollbar::Middleware::Rack
       def framework_error(env)
         env['sinatra.error']
       end

data/lib/rollbar/notifier/trace_with_bindings.rb

@@ -0,0 +1,75 @@
+module Rollbar
+  class Notifier
+    class TraceWithBindings # :nodoc:
+      attr_reader :frames, :exception_frames
+
+      def initialize
+        reset
+      end
+
+      def reset
+        @frames = []
+        @exception_frames = []
+        @exception_signature = nil
+      end
+
+      def enable
+        reset
+        trace_point.enable if defined?(TracePoint)
+      end
+
+      def disable
+        trace_point.disable if defined?(TracePoint)
+      end
+
+      private
+
+      def exception_signature(trace)
+        # use the exception backtrace to detect reraised exception.
+        trace.raised_exception.backtrace.first
+      end
+
+      def detect_reraise(trace)
+        @exception_signature == exception_signature(trace)
+      end
+
+      def trace_point
+        return unless defined?(TracePoint)
+
+        @trace_point ||= TracePoint.new(:call, :return, :b_call, :b_return, :c_call,
+                                        :c_return, :raise) do |tp|
+          case tp.event
+          when :call, :b_call, :c_call, :class
+            frames.push frame(tp)
+          when :return, :b_return, :c_return, :end
+            frames.pop
+          when :raise
+            unless detect_reraise(tp) # ignore reraised exceptions
+              # may be possible to optimize better than #dup
+              @exception_frames = @frames.dup
+              @exception_signature = exception_signature(tp)
+            end
+          end
+        end
+      end
+
+      def frame(trace)
+        {
+          :binding => binding(trace),
+          :defined_class => trace.defined_class,
+          :method_id => trace.method_id,
+          :path => trace.path,
+          :lineno => trace.lineno
+        }
+      end
+
+      def binding(trace)
+        trace.binding
+      rescue StandardError
+        # Ruby internals will raise if we're on a Fiber,
+        # since bindings aren't valid on Fibers.
+        nil
+      end
+    end
+  end
+end