Class: Monolith::ExceptionsController

Inherits:
ApplicationController show all
Defined in:
app/controllers/monolith/exceptions_controller.rb

Defined Under Namespace

Classes: ExceptionInfo, Show, SourceExtract

Instance Method Summary collapse

Instance Method Details

#show ⇒ Object 



6
7
8
9
10
11
12
13
14
 
# File 'app/controllers/monolith/exceptions_controller.rb', line 6

def show
  exception = request.env['action_dispatch.exception']

  if exception.nil?
    return render plain: "No exception found", status: :not_found
  end

  render Show.new.tap { |v| v.exception = ExceptionInfo.new(exception) }
end

#source ⇒ Object 



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
 
# File 'app/controllers/monolith/exceptions_controller.rb', line 16

def source
  file = params[:file]
  line = params[:line].to_i

  if file.blank? || line <= 0
    Rails.logger.error "Invalid parameters for source: file=#{file}, line=#{line}"
    return render plain: "Invalid parameters", status: :bad_request
  end

  # Security: ensure file exists and is a real file (not a directory traversal)
  unless File.exist?(file) && File.file?(file)
    Rails.logger.error "File not found: #{file}"
    return render plain: "File not found", status: :not_found
  end

  # Security: resolve path and ensure it's not trying to escape via symlinks
  real_path = File.realpath(file)

  # Allow files in Rails.root or gem directories
  allowed = real_path.start_with?(Rails.root.to_s) ||
            real_path.include?('/gems/') ||
            real_path.include?('/.rbenv/') ||
            real_path.include?('/.rvm/') ||
            real_path.include?('/ruby/')

  unless allowed
    Rails.logger.error "Access denied for file: #{real_path}"
    return render plain: "Access denied", status: :forbidden
  end

  extract = ExceptionInfo.new(nil).send(:extract_source, file, line)

  if extract
    render SourceExtract.new.tap { |v| v.extract = extract }, layout: false
  else
    Rails.logger.error "Source not available for file: #{file}, line: #{line}"
    render plain: "Source not available", status: :not_found
  end
rescue => e
  Rails.logger.error "Exception in source action: #{e.class.name}: #{e.message}\n#{e.backtrace.join("\n")}"
  render plain: "Error: #{e.message}", status: :internal_server_error
end