From 657dae7d07f3621db7d6bff5bfc32c5e8db027ca Mon Sep 17 00:00:00 2001 From: Friso Modderman Date: Thu, 23 Oct 2025 13:16:28 +0200 Subject: [PATCH 1/3] Add JSON validation before ActionCable broadcast Validate JSON-encodability of payload before broadcasting to ActionCable to prevent crashes from data formats that could not be encoded. for example xkt files --- lib/debugbar/middlewares/track_current_request.rb | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/lib/debugbar/middlewares/track_current_request.rb b/lib/debugbar/middlewares/track_current_request.rb index 640852b..1911f7a 100644 --- a/lib/debugbar/middlewares/track_current_request.rb +++ b/lib/debugbar/middlewares/track_current_request.rb @@ -25,8 +25,15 @@ def call(env) RequestBuffer.push(Debugbar::Current.pop_request!) # TODO: Refactor since not having ActionCable might be more common than I thought - if defined?(ActionCable) - ActionCable.server.broadcast("debugbar_channel", RequestBuffer.to_h) + payload = RequestBuffer.to_h + + # Validate JSON-encodability before broadcast; skip if it would crash + begin + ActiveSupport::JSON.encode(payload) # will raise on invalid UTF-8 + ActionCable.server.broadcast("debugbar_channel", payload) + rescue JSON::GeneratorError + # Non-text/binary snuck into the payload (e.g. .xkt). Skip live update. + # (Everything else — header, request logging, X-Debugbar-Url — still works.) end end From a4e81c73bcd32259cead38196eed8f494b109dc4 Mon Sep 17 00:00:00 2001 From: Friso Modderman Date: Thu, 23 Oct 2025 13:25:02 +0200 Subject: [PATCH 2/3] Version 0.4.4 --- lib/debugbar/version.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/debugbar/version.rb b/lib/debugbar/version.rb index 3885631..1b47d3b 100644 --- a/lib/debugbar/version.rb +++ b/lib/debugbar/version.rb @@ -1,5 +1,5 @@ # frozen_string_literal: true module Debugbar - VERSION = "0.4.3" + VERSION = "0.4.4" end From 95a6b6263c745345d9dd4475c07f8dae456579ac Mon Sep 17 00:00:00 2001 From: Friso Modderman Date: Mon, 2 Mar 2026 11:07:00 +0100 Subject: [PATCH 3/3] Update .gitignore --- .gitignore | 1 + 1 file changed, 1 insertion(+) diff --git a/.gitignore b/.gitignore index f980e2e..b7dd4f7 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ public/debugbar.js package-lock.json Gemfile.lock +.DS_Store