semantic_logger 5.0.0 → 5.2.0

data/lib/semantic_logger/formatters/syslog.rb

@@ -1,14 +1,62 @@
-begin
-  require "syslog_protocol"
-rescue LoadError
-  raise LoadError,
-        'Gem syslog_protocol is required for remote logging using the Syslog protocol. Please add the gem "syslog_protocol" to your Gemfile.'
-end
-
 module SemanticLogger
   module Formatters
     class Syslog < Default
-      attr_accessor :level_map, :facility, :max_size
+      attr_accessor :max_size
+      attr_reader :facility, :level_map
+
+      # Syslog severities and facilities, with the same values as the matching `::Syslog` constants.
+      # The `syslog` gem is only needed to log to a local syslog daemon, and since Ruby 3.4 it is a
+      # bundled gem, so remote syslog must not depend on it for these values.
+      LOG_CRIT    = 2
+      LOG_ERR     = 3
+      LOG_WARNING = 4
+      LOG_NOTICE  = 5
+      LOG_INFO    = 6
+      LOG_DEBUG   = 7
+
+      # Syslog facilities, as syslog(3) defines them: the facility number shifted left by 3 bits.
+      LOG_KERN     = 0 << 3
+      LOG_USER     = 1 << 3
+      LOG_MAIL     = 2 << 3
+      LOG_DAEMON   = 3 << 3
+      LOG_AUTH     = 4 << 3
+      LOG_SYSLOG   = 5 << 3
+      LOG_LPR      = 6 << 3
+      LOG_NEWS     = 7 << 3
+      LOG_UUCP     = 8 << 3
+      LOG_CRON     = 9 << 3
+      LOG_AUTHPRIV = 10 << 3
+      LOG_FTP      = 11 << 3
+      LOG_LOCAL0   = 16 << 3
+      LOG_LOCAL1   = 17 << 3
+      LOG_LOCAL2   = 18 << 3
+      LOG_LOCAL3   = 19 << 3
+      LOG_LOCAL4   = 20 << 3
+      LOG_LOCAL5   = 21 << 3
+      LOG_LOCAL6   = 22 << 3
+      LOG_LOCAL7   = 23 << 3
+
+      # Default maximum size of a syslog packet, in bytes, as for the syslog appender.
+      DEFAULT_MAX_SIZE = 1024
+
+      # The highest facility the syslog protocol can encode.
+      MAX_FACILITY = LOG_LOCAL7
+
+      # Returns [Integer] the facility number (0 to 23) that the syslog protocol sends, for a facility
+      # given as documented: one of the `::Syslog::LOG_*` facility constants, such as
+      # `::Syslog::LOG_LOCAL0`. syslog(3) defines each of those as the facility number shifted left
+      # by 3 bits, so `::Syslog::LOG_USER` is 8 and its facility number is 1.
+      #
+      # Raises ArgumentError for any other value, including a bare facility number.
+      def self.facility_number(facility)
+        unless facility.is_a?(Integer) && (facility % 8).zero? && facility.between?(0, MAX_FACILITY)
+          raise(ArgumentError,
+                "Invalid syslog facility: #{facility.inspect}. Must be one of the ::Syslog::LOG_* facility " \
+                "constants, for example ::Syslog::LOG_USER or ::Syslog::LOG_LOCAL0.")
+        end
+
+        facility >> 3
+      end
 
       # Default level map for every log level
       #
@@ -25,8 +73,14 @@ module SemanticLogger
       class LevelMap
         attr_accessor :trace, :debug, :info, :warn, :error, :fatal
 
-        def initialize(trace: ::Syslog::LOG_DEBUG, debug: ::Syslog::LOG_INFO, info: ::Syslog::LOG_NOTICE,
-                       warn: ::Syslog::LOG_WARNING, error: ::Syslog::LOG_ERR, fatal: ::Syslog::LOG_CRIT)
+        # Returns [LevelMap] the supplied level map, or a new one with a Hash of overrides applied,
+        # for example `{warn: LOG_NOTICE}`.
+        def self.build(level_map)
+          level_map.is_a?(LevelMap) ? level_map : new(**level_map)
+        end
+
+        def initialize(trace: LOG_DEBUG, debug: LOG_INFO, info: LOG_NOTICE,
+                       warn: LOG_WARNING, error: LOG_ERR, fatal: LOG_CRIT)
           @trace = trace
           @debug = debug
           @info  = info
@@ -40,11 +94,23 @@ module SemanticLogger
         end
       end
 
+      # Load the syslog_protocol gem, which builds the packets for remote syslog.
+      # Called when a syslog formatter is created, so the gem is only needed by applications
+      # that log to a remote syslog server.
+      def self.require_syslog_protocol
+        require "syslog_protocol"
+      rescue LoadError
+        raise LoadError,
+              "Gem syslog_protocol is required for remote logging using the Syslog protocol. " \
+              'Please add the gem "syslog_protocol" to your Gemfile.'
+      end
+
       # Create a Syslog Log Formatter
       #
       # Parameters:
       #   facility: [Integer]
-      #     Default: ::Syslog::LOG_USER
+      #     One of the ::Syslog::LOG_* facility constants, for example ::Syslog::LOG_LOCAL0.
+      #     Default: LOG_USER
       #
       #   level_map: [Hash | SemanticLogger::Formatters::Syslog::LevelMap]
       #     Supply a custom map of SemanticLogger levels to syslog levels.
@@ -56,27 +122,49 @@ module SemanticLogger
       #     Default: true (unlike other formatters, since syslog frames records
       #     with a separator)
       #
+      #   max_size: [Integer]
+      #     Maximum size of each syslog packet, in bytes.
+      #     Default: DEFAULT_MAX_SIZE (1024)
+      #
       #   Example:
       #     # Change the warn level to LOG_NOTICE level instead of a the default of LOG_WARNING.
       #     SemanticLogger.add_appender(appender: :syslog, level_map: {warn: ::Syslog::LOG_NOTICE})
-      def initialize(facility: ::Syslog::LOG_USER, level_map: LevelMap.new, max_size: Integer,
+      def initialize(facility: LOG_USER, level_map: LevelMap.new, max_size: DEFAULT_MAX_SIZE,
                      escape_control_chars: true, **args)
-        @facility  = facility
-        @level_map = level_map.is_a?(LevelMap) ? level_map : LevelMap.new(**level_map)
-        @max_size = max_size
+        self.class.require_syslog_protocol
+
+        self.facility  = facility
+        self.level_map = level_map
+        @max_size      = max_size
         # Syslog frames records with a separator, so embedded newlines or other
         # control characters in untrusted log data can forge or split records.
         # Default to escaping them, overridable for backwards compatibility.
         super(escape_control_chars: escape_control_chars, **args)
       end
 
+      # Set the facility to one of the ::Syslog::LOG_* facility constants.
+      # Raises ArgumentError for any other value, so that a mistake surfaces here rather than on
+      # every log entry.
+      def facility=(facility)
+        @facility_number = Syslog.facility_number(facility)
+        @facility        = facility
+      end
+
+      # Set the map of log levels to syslog severities, as a LevelMap or a Hash of overrides.
+      def level_map=(level_map)
+        @level_map = LevelMap.build(level_map)
+      end
+
       # Time is part of the syslog packet and is not included in the formatted message.
       def time
         nil
       end
 
       def call(log, logger)
-        message = super
+        # The individual fields are already escaped. Also escape the newlines that the
+        # exception and its backtrace are laid out with, so that a record never spans more
+        # than one line, which a receiver framing records by newline would split.
+        message = escape_control_characters(super)
         create_syslog_packet(message)
       end
 
@@ -86,13 +174,18 @@ module SemanticLogger
       def create_syslog_packet(message)
         packet          = SyslogProtocol::Packet.new
         packet.hostname = logger.host
-        packet.facility = facility
+        packet.facility = @facility_number
         packet.tag      = logger.application.delete(" ")
         packet.content  = message
         packet.time     = log.time
         packet.severity = level_map[log.level]
         packet.assemble(@max_size)
       end
+
+      # Off by default, so that existing syslog records do not change.
+      def default_log_exception_details
+        false
+      end
     end
   end
 end

data/lib/semantic_logger/formatters/syslog_cee.rb

@@ -1,14 +1,8 @@
-begin
-  require "syslog_protocol"
-rescue LoadError
-  raise LoadError,
-        'Gem syslog_protocol is required for remote logging using the Syslog protocol. Please add the gem "syslog_protocol" to your Gemfile.'
-end
-
 module SemanticLogger
   module Formatters
     class SyslogCee < Raw
-      attr_accessor :level_map, :facility, :max_size
+      attr_accessor :max_size
+      attr_reader :facility, :level_map
 
       # CEE JSON Syslog format
       #   Untested prototype code. Based on documentation only.
@@ -16,22 +10,42 @@ module SemanticLogger
       #
       # Parameters:
       #   facility: [Integer]
-      #     Default: ::Syslog::LOG_USER
+      #     One of the ::Syslog::LOG_* facility constants, for example ::Syslog::LOG_LOCAL0.
+      #     Default: SemanticLogger::Formatters::Syslog::LOG_USER
       #
       #   level_map: [Hash | SemanticLogger::Formatters::Syslog::LevelMap]
       #     Supply a custom map of SemanticLogger levels to syslog levels.
       #
+      #   max_size: [Integer]
+      #     Maximum size of each syslog packet, in bytes.
+      #     Default: SemanticLogger::Formatters::Syslog::DEFAULT_MAX_SIZE (1024)
+      #
       # Example:
       #   # Log via udp to a remote syslog server on host: `server1` and port `8514`, using the CEE format.
       #   SemanticLogger.add_appender(appender: :syslog, formatter: :syslog_cee, url: 'udp://server1:8514')
-      def initialize(facility: ::Syslog::LOG_USER, level_map: SemanticLogger::Formatters::Syslog::LevelMap.new,
-                     max_size: Integer)
-        @facility  = facility
-        @level_map = level_map.is_a?(SemanticLogger::Formatters::Syslog::LevelMap) ? level_map : SemanticLogger::Formatters::Syslog::LevelMap.new(level_map)
-        @max_size = max_size
+      def initialize(facility: SemanticLogger::Formatters::Syslog::LOG_USER, level_map: SemanticLogger::Formatters::Syslog::LevelMap.new,
+                     max_size: SemanticLogger::Formatters::Syslog::DEFAULT_MAX_SIZE)
+        SemanticLogger::Formatters::Syslog.require_syslog_protocol
+
+        self.facility  = facility
+        self.level_map = level_map
+        @max_size      = max_size
         super()
       end
 
+      # Set the facility to one of the ::Syslog::LOG_* facility constants.
+      # Raises ArgumentError for any other value, so that a mistake surfaces here rather than on
+      # every log entry.
+      def facility=(facility)
+        @facility_number = SemanticLogger::Formatters::Syslog.facility_number(facility)
+        @facility        = facility
+      end
+
+      # Set the map of log levels to syslog severities, as a LevelMap or a Hash of overrides.
+      def level_map=(level_map)
+        @level_map = SemanticLogger::Formatters::Syslog::LevelMap.build(level_map)
+      end
+
       # Time is part of the syslog packet and is not included in the formatted message.
       def time
       end
@@ -47,7 +61,7 @@ module SemanticLogger
       def create_syslog_packet(message)
         packet          = SyslogProtocol::Packet.new
         packet.hostname = logger.host
-        packet.facility = facility
+        packet.facility = @facility_number
         packet.tag      = logger.application.delete(" ")
         packet.content  = message
         packet.time     = log.time

data/lib/semantic_logger/levels.rb

@@ -23,11 +23,20 @@ module SemanticLogger
       when String
         LEVELS.index(level.downcase.to_sym)
       when Integer
-        MAPPED_LEVELS[level]
+        # Bounded first, since Array#[] raises RangeError for an Integer too large for a C long.
+        MAPPED_LEVELS[level] if level.abs <= MAPPED_LEVELS.size
       end ||
         raise(ArgumentError, "Invalid level:#{level.inspect} being requested. Must be one of #{LEVELS.inspect}")
     end
 
+    # Returns [true|false] whether the supplied value is a level that #index accepts.
+    # Never raises, so it can be used to check values that come from untrusted data.
+    def self.valid?(level)
+      !index(level).nil?
+    rescue ArgumentError
+      false
+    end
+
     # Returns the symbolic level for the supplied level index
     def self.level(level_index)
       LEVELS[level_index]

data/lib/semantic_logger/log.rb

@@ -8,7 +8,8 @@ module SemanticLogger
   #   :trace, :debug, :info, :warn, :error, :fatal
   #
   # thread_name
-  #   Name of the thread in which the logging call was called
+  #   Name of the thread in which the logging call was called,
+  #   or its object id when the thread has no name
   #
   # name
   #   Class name supplied to the logging instance
@@ -53,6 +54,40 @@ module SemanticLogger
                           log_exception on_exception_level
                           metric metric_amount dimensions].freeze
 
+    # Values accepted for the :log_exception argument.
+    LOG_EXCEPTION_OPTIONS = %i[full partial none].freeze
+    private_constant :LOG_EXCEPTION_OPTIONS
+
+    # A finite real number, which #assign can compare with another one.
+    REAL_NUMBER = ->(value) { value.is_a?(Numeric) && value.real? && value.finite? }
+    private_constant :REAL_NUMBER
+
+    # Checks that a value is valid for its argument, for the arguments that do not accept any value.
+    # Any other value would make #assign, or the formatters, raise.
+    ARGUMENT_VALIDATORS = {
+      backtrace:          ->(value) { value.is_a?(Array) && value.all?(String) },
+      duration:           REAL_NUMBER,
+      min_duration:       REAL_NUMBER,
+      metric_amount:      REAL_NUMBER,
+      dimensions:         ->(value) { value.is_a?(Hash) },
+      log_exception:      ->(value) { LOG_EXCEPTION_OPTIONS.include?(value) },
+      on_exception_level: ->(value) { Levels.valid?(value) }
+    }.freeze
+    private_constant :ARGUMENT_VALIDATORS
+
+    # Hash#key?, which unlike HashWithIndifferentAccess#key? only matches the exact Symbol key.
+    HASH_KEY = Hash.instance_method(:key?)
+    private_constant :HASH_KEY
+
+    # Whether the value is accepted for the :log_exception argument of #assign.
+    def self.log_exception_option?(value)
+      value.nil? || LOG_EXCEPTION_OPTIONS.include?(value)
+    end
+
+    # Returns [String] the name that identifies the thread in a log entry: the thread's own name,
+    # or its object id when it has none, which Ruby never reuses within a process.
+    def self.thread_name_for(thread) = thread.name || thread.object_id.to_s
+
     attr_accessor :level, :level_index, :name, :message, :time, :duration,
                   :payload, :exception, :thread_name, :backtrace,
                   :tags, :named_tags, :context,
@@ -60,7 +95,7 @@ module SemanticLogger
 
     def initialize(name, level, index = nil)
       @level       = level
-      @thread_name = Thread.current.name
+      @thread_name = Log.thread_name_for(Thread.current)
       @name        = name
       @time        = Time.now
       @tags        = SemanticLogger.tags
@@ -94,7 +129,7 @@ module SemanticLogger
 
       if exception
         unless exception.is_a?(Exception)
-          exception = ArgumentError.new("Invalid value for logger exception: #{exception.inspect}")
+          exception = ArgumentError.new("Invalid value for logger exception: #{Utils.safe_inspect(exception)}")
           exception.set_backtrace(Utils.extract_backtrace(caller))
         end
 
@@ -111,8 +146,10 @@ module SemanticLogger
         end
         # On exception change the log level
         if on_exception_level
-          self.level       = on_exception_level
-          self.level_index = Levels.index(level)
+          # Normalized through the index, so that a level supplied as a String or an Integer is
+          # still stored as its Symbol.
+          self.level_index = Levels.index(on_exception_level)
+          self.level       = Levels.level(level_index)
         end
       end
 
@@ -129,47 +166,74 @@ module SemanticLogger
       true
     end
 
-    # Keys that #assign_hash may assign directly to a log attribute. Every other
-    # key is folded into the payload, preventing a supplied hash from overwriting
-    # sensitive fields such as :level, :name, or :time, and keeping this path
-    # consistent with #extract_arguments.
-    ASSIGNABLE_KEYS = (NON_PAYLOAD_KEYS + %i[payload]).freeze
+    # Log attributes that a Hash returned by a logging block can set (see #assign_hash). Its other
+    # keys go to the payload, so that it cannot set fields such as :level, :name, or :time.
+    ASSIGNABLE_KEYS = %i[message exception backtrace duration metric metric_amount dimensions].freeze
 
-    # Assign known keys to self, all other keys to the payload.
+    # Assign the Hash returned by a logging block, after #assign has applied the log call.
+    #
+    # A block can return untrusted data, such as a parsed request body, so its keys are classified
+    # by #extract_arguments, as for a Hash passed after the message. A log argument is only assigned
+    # when this entry does not have it yet (an exception must also be an Exception), and otherwise
+    # goes to the payload like any other key. Whatever the key order, the log call's values win,
+    # then the block's top-level keys, then those of its :payload. No supplied Hash is modified.
     def assign_hash(hash)
-      self.payload ||= {}
-      hash.each_pair do |key, value|
-        if ASSIGNABLE_KEYS.include?(key) && respond_to?(:"#{key}=")
-          public_send(:"#{key}=", value)
-        else
-          payload[key] = value
-        end
-      end
-      self.payload = nil if payload.empty?
+      args           = extract_arguments(hash)
+      added          = args.delete(:payload)
+      assigned, kept = args.partition { |key, value| block_attribute?(key, value) }
+      assigned.each { |key, value| public_send(:"#{key}=", value) }
+      # An argument this entry already has wins over the block's :payload, like the block's other keys.
+      added        = merge_payload(kept.to_h, added) unless kept.empty?
+      self.payload = merge_payload(payload, added)
       self
     end
 
+    # Returns [true|false] whether the value can be used as the log argument named by the key.
+    #
+    # Never raises, so it can check values from untrusted data before they are passed to #assign.
+    # A nil value is never an argument, since it means the argument was not supplied. Arguments
+    # without a validator in ARGUMENT_VALIDATORS (such as :message, :metric, or :exception, which
+    # #assign logs as an ArgumentError when it is not an Exception) accept any other value.
+    def self.argument?(key, value)
+      return false if value.nil? || !NON_PAYLOAD_KEYS.include?(key)
+
+      validator = ARGUMENT_VALIDATORS[key]
+      validator.nil? || validator.call(value)
+    end
+
     # Extract the arguments from a Hash Payload
+    #
+    # The hash can hold untrusted data, so this never fails because of its content: keys that are
+    # not log attributes, or that hold a value that is not valid for it (see .argument?), are kept
+    # in the payload. A log attribute key with a nil value counts as not supplied, so #assign uses
+    # its default. When the hash supplies an explicit :payload, any other keys are merged into it,
+    # and win over its values of the same name, since the explicit payload is where untrusted data
+    # goes (see docs/security.md).
     def extract_arguments(payload, message = nil)
       raise(ArgumentError, "payload must be a Hash") unless payload.is_a?(Hash)
 
-      message = nil if message == ""
-      if payload.key?(:payload)
-        return message ? payload.merge(message: message) : payload
-      end
-
+      message     = nil if message == ""
+      explicit    = HASH_KEY.bind_call(payload, :payload)
       new_payload = {}
       args        = {}
       payload.each_pair do |key, value|
-        # Supplied message takes precedence
-        if (key == :message) && !message.nil?
-          new_payload[key] = value
+        if explicit && key == :payload
+          args[:payload] = value
+        elsif key == :message && !message.nil?
+          # Supplied message takes precedence
+          new_payload[key] = value unless explicit
+        elsif Log.argument?(key, value)
+          args[key] = value
+        elsif value.nil? && NON_PAYLOAD_KEYS.include?(key)
+          # Not supplied, so #assign uses its default
           next
+        else
+          new_payload[key] = value
         end
-
-        NON_PAYLOAD_KEYS.include?(key) ? args[key] = value : new_payload[key] = value
       end
-      args[:payload] = new_payload unless new_payload.empty?
+      unless new_payload.empty?
+        args[:payload] = explicit ? merge_payload(new_payload, args[:payload]) : new_payload
+      end
       args[:message] = message if message
       args
     end
@@ -197,14 +261,52 @@ module SemanticLogger
       end
     end
 
+    # Returns [String] the detail that Ruby's Exception#detailed_message adds to the message of the
+    # supplied exception, without the class name that Ruby also adds. Since Ruby 3.2 this is where
+    # did_you_mean suggestions ("Did you mean?  upcase") and the detail an exception class supplies
+    # by overriding #detailed_message appear, rather than in #message.
+    # Returns nil when there is no detail.
+    #
+    # Parameters
+    #   exception: [Exception]
+    #     This entry's exception, or one of its causes (see #each_exception).
+    #   source: [true|false]
+    #     Whether to include error_highlight's snippet of the failing source line, for example
+    #     "user_name.upcas" with "^^^^^^" under the unknown method. It re-parses that source
+    #     file on every call, so it is about 100 times slower, and it copies source code into
+    #     the log.
+    #     Default: false
+    #
+    # The result is cached on this entry, since every appender's formatter may ask for it.
+    def exception_details(exception, source: false)
+      key   = [exception, source]
+      cache = @exception_details
+      return cache[key] if cache&.key?(key)
+
+      details = ExceptionDetails.extract(exception, source: source)
+      # Replace the cache rather than change it, since appenders on other threads may be reading it.
+      @exception_details = (cache || {}).merge(key => details).freeze
+      details
+    end
+
     # Returns [String] the exception backtrace including all of the child / caused by exceptions
-    def backtrace_to_s
+    #
+    # When a block is supplied, each cause's message and each backtrace line is passed
+    # to it, and the value it returns is written in its place. This lets a caller, for
+    # example a formatter, transform that text while this method keeps the layout.
+    #
+    # Example:
+    #   log.backtrace_to_s { |text| text.gsub("\n", "\\n") }
+    def backtrace_to_s(&block)
       trace = ""
       each_exception do |exception, i|
+        lines = exception.backtrace || []
+        lines = lines.map(&block) if block
         if i.zero?
-          trace = (exception.backtrace || []).join("\n")
+          trace = lines.join("\n")
         else
-          trace << "\nCause: #{exception.class.name}: #{exception.message}\n#{(exception.backtrace || []).join("\n")}"
+          message = block ? yield(exception.message) : exception.message
+          trace << "\nCause: #{exception.class.name}: #{message}\n#{lines.join("\n")}"
         end
       end
       trace
@@ -281,8 +383,13 @@ module SemanticLogger
     # terminal escape codes out of structured (JSON/Loki) output. It is distinct
     # from Formatters::Base#escape_control_characters, which instead *escapes*
     # (preserves) control characters and is opt-in for the text formatters.
+    #
+    # A message tagged UTF-8 can hold invalid bytes, for example a request parameter that Rack
+    # decoded from "%FF", or be in another encoding, such as a binary request body. Stripping or
+    # matching such a String raises, so it is converted to valid UTF-8 first, dropping the
+    # invalid bytes, as the JSON formatters do.
     def cleansed_message
-      msg = message.to_s
+      msg = Utils.encode_utf8_string(message.to_s)
       return msg.strip unless msg.include?("\e")
 
       msg.gsub(/\e\[[\d;]*[mz]?|\e/, "").strip
@@ -290,8 +397,12 @@ module SemanticLogger
 
     # Return the payload in text form
     # Returns nil if payload is missing or empty
-    def payload_to_s
-      payload.inspect if payload?
+    #
+    # Rendered with #inspect, or with the block when given (for example Amazing Print). A payload
+    # nested too deeply for either is first cut off at Utils::MAX_JSON_SAFE_DEPTH, rather than
+    # raising SystemStackError (see Utils.safe_inspect).
+    def payload_to_s(&)
+      Utils.safe_inspect(payload, &) if payload?
     end
 
     # Returns [true|false] whether the log entry has a payload
@@ -314,5 +425,40 @@ module SemanticLogger
     def metric_only?
       metric && message.nil? && exception.nil?
     end
+
+    private
+
+    # Returns the kept payload with the keys of the added one that it does not have, so that a kept
+    # value is never replaced. A String and a Symbol key of the same name, such as "account_id" from
+    # JSON.parse and :account_id, count as the same key, since the formatters write both under that
+    # name. A payload that is not a Hash is kept as its :payload key, but the kept payload is
+    # returned unchanged when there is nothing to add. Neither payload is modified.
+    def merge_payload(kept, added)
+      added = {payload: added} unless added.nil? || added.is_a?(Hash)
+      return kept if added.nil? || added.empty?
+
+      kept = {payload: kept} unless kept.nil? || kept.is_a?(Hash)
+      return added if kept.nil? || kept.empty?
+
+      merged = kept.merge(added) { |_key, kept_value, _added_value| kept_value }
+      # Only the kept keys, usually a few supplied by the application, are checked one at a time.
+      kept.each_key do |key|
+        next unless key.is_a?(Symbol) || key.is_a?(String)
+
+        other = key.is_a?(Symbol) ? key.name : key.to_sym
+        merged.delete(other) unless kept.key?(other)
+      end
+      merged
+    end
+
+    # Whether a log argument from the Hash returned by a logging block, already checked by
+    # .argument?, is assigned to its attribute: only when this entry does not have it yet. As in
+    # #extract_arguments, an empty message counts as none.
+    def block_attribute?(key, value)
+      return message.nil? || message == "" if key == :message
+      return exception.nil? && value.is_a?(Exception) if key == :exception
+
+      ASSIGNABLE_KEYS.include?(key) && public_send(key).nil?
+    end
   end
 end

data/lib/semantic_logger/loggable.rb

@@ -88,17 +88,40 @@ module SemanticLogger
         #   return false
         # end
 
-        index = Levels.index(level)
+        # These values are written into the source of the generated method, so only accept values
+        # that are certain to produce valid literals, rather than code.
+        #
+        # Ruby writes a Symbol that is a valid method name, including operators such as `[]=` and
+        # non-ASCII identifiers, without quotes. Any other Symbol is quoted, as in `:"a; b"`.
+        # Instance, class, and global variable names are unquoted, but are not method names.
+        source_name = method_name.to_s.to_sym.inspect.delete_prefix(":")
+        if source_name.start_with?('"', "@", "$")
+          raise(ArgumentError, "Invalid method name to measure: #{method_name.inspect}")
+        end
+        unless Log.log_exception_option?(log_exception)
+          raise(ArgumentError, "Invalid value:#{log_exception.inspect} for argument :log_exception")
+        end
+
+        duration = Float(min_duration, exception: false)
+        unless duration&.finite?
+          raise(ArgumentError, "Invalid value:#{min_duration.inspect} for argument :min_duration")
+        end
+
+        index              = Levels.index(level)
+        level              = Levels.level(index)
+        on_exception_level = Levels.level(Levels.index(on_exception_level)) if on_exception_level
+        message            = message&.to_s
+        metric             = metric&.to_s
 
         logger_measure_module.module_eval(<<~MEASURE_METHOD, __FILE__, __LINE__ + 1)
-          def #{method_name}(*args, &block)
+          def #{source_name}(*args, &block)
             if logger.send(:level_index) <= #{index}
               logger.send(
                 :measure_method,
                 index:              #{index},
                 level:              #{level.inspect},
                 message:            #{message.inspect},
-                min_duration:       #{min_duration},
+                min_duration:       #{duration},
                 metric:             #{metric.inspect},
                 log_exception:      #{log_exception.inspect},
                 on_exception_level: #{on_exception_level.inspect}

data/lib/semantic_logger/metric/new_relic.rb

@@ -52,7 +52,7 @@ module SemanticLogger
       end
 
       def log(log)
-        name = formatter.call(log, self)
+        name = format_log(log)
         if (duration = log.duration)
           # Convert duration to seconds
           ::NewRelic::Agent.record_metric(name, duration / 1000.0)