Security News
New Python Packaging Proposal Aims to Solve Phantom Dependency Problem with SBOMs
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
pboling-super_exception_notifier
Advanced tools
= Super Exception Notifier
The Super Exception Notifier (SEN) gem provides a mailer object and a default set of templates for sending email notifications when errors occur in a Rails application, as well as a default set of error page templates to render based on the status code assigned to an error. The gem is configurable, allowing programmers to customize (all on a per environment basis!):
New features:
git blame
output so you can get an idea of who (may) have introduced the bugThe email includes information about the current request, session, and environment, and also gives a backtrace of the exception.
This gem is based on the wonderful exception_notification plugin created by Jamis Buck. I have modified it extensively and merged many of the improvements from a dozen or so other forks. It remains a (mostly) drop in replacement with greatly extended functionality and customization options. I keep it up to date with the work on the core team's branch.
The original is here:
http://github.com/rails/exception_notification/tree/master
The current version of this gem is a git fork of the original and has been updated to include the latest improvements from the original, including compatability with Rails 2.1, 2.2, 2.3, as well as many improvements from the other forks on github. I merge them in when I have time, and when the changes fit nicely with the enhancements I have already made.
This fork of Exception Notifier is in production use on several large websites (top 5000).
== Installation
Gem Using Git building from source:
mkdir -p ~/src cd ~/src git clone git://github.com/pboling/exception_notification.git cd exception_notification gem build exception_notification.gemspec sudo gem install super_exception_notification-1.7.1.gem # (Or whatever version gets built)
Then cd to your rails app to optionally freeze the gem into your app:
rake gems:freeze GEM=super_exception_notifier
Then in your environment.rb:
config.gem 'super_exception_notifier', :version => '~> 1.7.1', :lib => "exception_notifier"
Installing Gem from Github's Gem Server:
gem sources -a http://gems.github.com sudo gem install pboling-super_exception_notifier
Then in your environment.rb:
config.gem 'pboling-super_exception_notifier', :version => '~> 1.7.1', :lib => "exception_notifier", :source => 'http://gems.github.com'
Plugin using Git:
./script/plugin install git://github.com/pboling/exception_notification.git
SVN Plugin (very deprecated, no longer updated, install Git!):
./script/plugin install http://super-exception-notifier.googlecode.com/svn/trunk/super_exception_notifier
== Usage
class ApplicationController < ActionController::Base include ExceptionNotifiable ... end
ExceptionNotifier.configure_exception_notifier do |config| config[:exception_recipients] = %w(joe@example.com bill@example.com) end
Make sure you have your ActionMailer server settings correct if you are using the e-mail features.
That's it! The defaults take care of the rest.
== Basic Environment Configuration
These are settings that are global for SEN wherever it is used in your project. You can tweak other values to your liking, as well. In your environment file, just set any or all of the following values (defaults are shown):
ExceptionNotifier.configure_exception_notifier do |config| # If left empty web hooks will not be engaged config[:web_hooks] = [] config[:app_name] = "[MYAPP]" # NOTE: THERE IS A BUG IN RAILS 2.3.3 which forces us to NOT use anything but a simple email address string for the sender address. # https://rails.lighthouseapp.com/projects/8994/tickets/2340 config[:sender_address] = %("#{(defined?(Rails) ? Rails.env : RAILS_ENV).capitalize} Error" super.exception.notifier@example.com) config[:exception_recipients] = [] # Customize the subject line config[:subject_prepend] = "[#{(defined?(Rails) ? Rails.env : RAILS_ENV).capitalize} ERROR] " config[:subject_append] = nil # Include which sections of the exception email? config[:sections] = %w(request session environment backtrace) # Only use this gem to render, never email #defaults to false - meaning by default it sends email. Setting true will cause it to only render the error pages, and NOT email. config[:skip_local_notification] = true # Example: #config[:view_path] = 'app/views/error' config[:view_path] = nil # Error Notification will be sent if the HTTP response code for the error matches one of the following error codes config[:notify_error_codes] = %W( 405 500 503 ) # Error Notification will be sent if the error class matches one of the following error error classes config[:notify_error_classes] = %W( ) # What should we do for errors not listed? config[:notify_other_errors] = true # If you set this SEN will config[:git_repo_path] = nil config[:template_root] = "#{File.dirname(FILE)}/../views" end
== Basic Object Configuration
In any controller you do this: include ExceptionNotifiable
Then that controller (or all of them if you put it in the application controller) will have its errors handled by SEN. You can customize how each controller handles exceptions on a per controller basis, or all together in the application controller. The availalbe configuration options are shown with their default settings:
# HTTP status codes and what their 'English' status message is
self.http_error_codes = {
"400" => "Bad Request",
"403" => "Forbidden",
"404" => "Not Found",
"405" => "Method Not Allowed",
"410" => "Gone",
"418" => "I�m a teapot",
"422" => "Unprocessable Entity",
"423" => "Locked",
"500" => "Internal Server Error",
"501" => "Not Implemented",
"503" => "Service Unavailable"
}
# error_layout:
# can be defined at controller level to the name of the desired error layout,
# or set to true to render the controller's own default layout,
# or set to false to render errors with no layout
# syntax is the same as the rails 'layout' method (which is to say a string)
self.error_layout = nil
# Rails error classes to rescue and how to rescue them (which error code to use)
self.rails_error_classes = {
# These are standard errors in rails / ruby
NameError => "503",
TypeError => "503",
RuntimeError => "500",
# These are custom error names defined in lib/super_exception_notifier/custom_exception_classes
AccessDenied => "403",
PageNotFound => "404",
InvalidMethod => "405",
ResourceGone => "410",
CorruptData => "422",
NoMethodError => "500",
NotImplemented => "501",
MethodDisabled => "200"
}
# Highly dependent on the verison of rails, so we're very protective about these'
self.rails_error_classes.merge!({ ActionView::TemplateError => "500"}) if defined?(ActionView) && ActionView.const_defined?(:TemplateError)
self.rails_error_classes.merge!({ ActiveRecord::RecordNotFound => "400" }) if defined?(ActiveRecord) && ActiveRecord.const_defined?(:RecordNotFound)
self.rails_error_classes.merge!({ ActiveResource::ResourceNotFound => "404" }) if defined?(ActiveResource) && ActiveResource.const_defined?(:ResourceNotFound)
if defined?(ActionController)
self.rails_error_classes.merge!({ ActionController::UnknownController => "404" }) if ActionController.const_defined?(:UnknownController)
self.rails_error_classes.merge!({ ActionController::MissingTemplate => "404" }) if ActionController.const_defined?(:MissingTemplate)
self.rails_error_classes.merge!({ ActionController::MethodNotAllowed => "405" }) if ActionController.const_defined?(:MethodNotAllowed)
self.rails_error_classes.merge!({ ActionController::UnknownAction => "501" }) if ActionController.const_defined?(:UnknownAction)
self.rails_error_classes.merge!({ ActionController::RoutingError => "404" }) if ActionController.const_defined?(:RoutingError)
self.rails_error_classes.merge!({ ActionController::InvalidAuthenticityToken => "405" }) if ActionController.const_defined?(:InvalidAuthenticityToken)
end
# Verbosity of the gem (true or false) mainly useful for debugging
self.exception_notifier_verbose = false
# Do Not Ever send error notification emails for these Error Classes
self.silent_exceptions = []
self.silent_exceptions << ActiveRecord::RecordNotFound if defined?(ActiveRecord)
if defined?(ActionController)
self.silent_exceptions << ActionController::UnknownController
self.silent_exceptions << ActionController::UnknownAction
self.silent_exceptions << ActionController::RoutingError
self.silent_exceptions << ActionController::MethodNotAllowed
end
# Notification Level
# Web Hooks, even though they are turned on by default, only get used if you actually configure them in the environment (see above)
# Email, even though it is turned on by default, only gets used if you actually configure recipients in the environment (see above)
self.notification_level = [:render, :email, :web_hooks]
== Environmental Behavior
Email notifications will only occur when the IP address is determined not to be local. You can specify certain addresses to always be local so that you'll get a detailed error instead of the generic error page. You do this in your controller (or even per-controller):
consider_local "64.72.18.143", "14.17.21.25"
You can specify subnet masks as well, so that all matching addresses are considered local:
consider_local "64.72.18.143/24"
The address "127.0.0.1" is always considered local. If you want to completely reset the list of all addresses (for instance, if you wanted "127.0.0.1" to NOT be considered local), you can simply do, somewhere in your controller:
local_addresses.clear
== Error Layout Customization
SEN allows you to specify the layout for errors at several levels:
By default it will render the error with the layout the controller is using. You just need to set in application.rb (assuming you included ExceptionNotifiable in applicaiton.rb) (or per-controller):
self.error_layout = 'my_error_layout'
self.error_layout = 'example_controller_error_layout'
self.error_layout = true
self.error_layout = false
SuperExceptionNotifier allows customization of the error classes that will be handled, and which HTTP status codes they will be handled as: (default values are shown) Example in application.rb or on a per-controller basis:
self.http_error_codes = { "200" => "OK" "400" => "Bad Request", "403" => "Forbidden", "404" => "Not Found", "405" => "Method Not Allowed", "410" => "Gone", "500" => "Internal Server Error", "501" => "Not Implemented", "503" => "Service Unavailable" }
Q: Why is "200" listed as an error code?
A: You may want to have multiple custom errors that the standard HTTP status codes weren't designed to accommodate, and for which you need to render customized pages. Explanation and examples are a little further down...
Then you can specify which of those should send out emails! By default, the email notifier will only notify on critical errors (405 500 503 statuses). For example, ActiveRecord::RecordNotFound and ActionController::UnknownAction errors will simply render the contents of #{this gem's root}/rails/app/views/exception_notifiable/###.html file, where ### is 400 and 501 respectively.
ExceptionNotifier.config[:send_email_error_codes] = %w( 400 405 500 503 )
You can also configure the text of the HTTP request's response status code: (by default only the last 6 will be handled, the first 6 are made up error classes) Example in application.rb or on a per-controller basis:
self.rails_error_classes = { NameError => "503", TypeError => "503", ActiveRecord::RecordNotFound => "400", }
To make up your own error classes, you can define them in environment.rb, or in application.rb, or wherever you need them. These are defined by the gem and are available to you in controllers once ExceptionNotifiable is included in application.rb or the current controller:
class AccessDenied < StandardError; end
class ResourceGone < StandardError; end
class NotImplemented < StandardError; end
class PageNotFound < StandardError; end
class InvalidMethod < StandardError; end
class CorruptData < StandardError; end
class MethodDisabled < StandardError; end
These error classes can be raised in before filters, or controller actions like so: def owner_required raise AccessDenied unless current_user.id == @photo.user_id end
They can also be wrapped in methods in application.rb (or a mixin for it) like so: def access_denied raise AccessDenied end
And then used like so (as before filter in a controller): def owner_required access_denied unless current_user.id == @photo.user_id end
You may also configure which HTTP status codes will send out email: (by default = [], email sending is defined by status code only)
ExceptionNotifier.config[:send_email_error_classes] = [ NameError, TypeError, ActionController::RoutingError ]
Email will be sent if the error matches one of the error classes to send email for OR if the error's assigned HTTP status code is configured to send email!
You can also customize what is rendered. SuperExceptionNotifier will render the first file it finds in this order:
#{RAILS_ROOT}/public/###.html #{RAILS_ROOT}/#ExceptionNotifier.config[:view_path]}/###.html #{this gem's root}/rails/app/views/exception_notifiable/#{status_cd}.html
And if none of those paths has a valid file to render, this one wins:
#{RAILS_ROOT}/rails/app/views/exception_notifiable/500.html
You can configure ExceptionNotifier.config[:view_path] in your environment file like this:
ExceptionNotifier.config[:view_path] = 'app/views/error'
So public trumps your custom path which trumps the gem's default path.
== Custom Error Pages
You can render CUSTOM error pages! Here's how:
== Customization
By default, the notification email includes four parts: request, session, environment, and backtrace (in that order). You can customize how each of those sections are rendered by placing a partial named for that part in your app/views/exception_notifier directory (e.g., _session.rhtml). Each partial has access to the following variables:
You can reorder the sections, or exclude sections completely, by altering the ExceptionNotifier.config[:sections] variable.
== Not working due to nature of gem vs plugin
This might work if you install the gem as a plugin.
You can even add new sections that describe application-specific data -- just add the section's name to the list (whereever you'd like), and define the corresponding partial. Then, if your new section requires information that isn't available by default, make sure it is made available to the email using the exception_data macro:
class ApplicationController < ActionController::Base ... protected exception_data :additional_data
def additional_data
{ :document => @document,
:person => @person }
end
...
end
In the above case, @document and @person would be made available to the email renderer, allowing your new section(s) to access and display them. See the existing sections defined by the gem for examples of how to write your own.
== Exceptions Without a Controller
You may also use ExceptionNotifier to send information about exceptions that occur while running application scripts without a controller. Simply wrap the code you want to watch with the notifiable method:
/PATH/TO/APP/script/runner -e production "notifiable { run_billing }"
== Advanced Customization
If you want to seriously modify the rules for the notification, you will need to implement your own rescue_action_in_public method. You can look at the default implementation in ExceptionNotifiable for an example of how to go about that.
== HTTP Error Codes Used by Exception Notifier by default
For reference these are the error codes that Exception Notifier can inherently handle. Official w3.org HTTP 1.1 Error Codes: http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html Not all the error codes in use today are on that list, so here's Apache's list: http://www.askapache.com/htaccess/apache-status-code-headers-errordocument.html#apache-response-codes-57
400 Bad Request * The request could not be understood by the server due to malformed syntax. * The client SHOULD NOT repeat the request without modifications. 403 Forbidden * The server understood the request, but is refusing to fulfill it 404 Not Found * The server has not found anything matching the Request-URI 405 Method Not Allowed * The method specified in the Request-Line is not allowed for the resource identified by the Request-URI * This is not implemented entirely as the response is supposed to contain a list of accepted methods. 410 Gone * The requested resource is no longer available at the server and no forwarding address is known. This condition is expected to be considered permanent 418 I'm a teapot * ErrorDocument I'm a teapot | Sample 418 I'm a teapot * The HTCPCP server is a teapot. The responding entity MAY be short and stout. Defined by the April Fools specification RFC 2324. See Hyper Text Coffee Pot Control Protocol for more information. 422 Unprocessable Entity * ErrorDocument Unprocessable Entity | Sample 422 Unprocessable Entity * (WebDAV) (RFC 4918 ) - The request was well-formed but was unable to be followed due to semantic errors. 423 Locked * ErrorDocument Locked | Sample 423 Locked * (WebDAV) (RFC 4918 ) - The resource that is being accessed is locked 500 Internal Server Error * The server encountered an unexpected condition which prevented it from fulfilling the request. 501 Not Implemented * The server does not support the functionality required to fulfill the request. 503 Service Unavailable * The server is currently unable to handle the request due to a temporary overloading or maintenance of the server.
== CSS
All the standard error pages that come in the gem render a div with a class of "dialog", so put this in a stylesheet you are including in your app to get you started (like stardard rails error style):
div.dialog { width: 25em; padding: 0 4em; margin: 4em auto 0 auto; border: 1px solid #ccc; border-right-color: #999; border-bottom-color: #999; } h1 { font-size: 100%; color: #f00; line-height: 1.5em; }Copyright (c) 2008 Peter H. Boling, released under the MIT license Portions Copyright (c) 2005 Jamis Buck, released under the MIT license
== jamescook changes
Hooks into git blame
output so you can get an idea of who (may) have introduced the bug :)
-- Usage: set ExceptionNotifier.config[:git_repo_path] to the path of your git repo.
== ismasan changes
POST exception data in JSON format to the specified services for processing -- Usage: ExceptionNotifier.configure_exception_notifier do |config| config[:web_hooks] = %w(http://some-hook-service.example.com http://another-hook-service.example.com) # defaults to [] config[:app_name] = "[APP]" # defaults to [MYAPP] config[:exception_recipients] = %w(my@example.com another@example.com) # defaults to [] config[:sender_address] = %("Application Error" app.error@myapp.com) # defaults to super.exception.notifier@example.com end
FAQs
Unknown package
We found that pboling-super_exception_notifier demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
PEP 770 proposes adding SBOM support to Python packages to improve transparency and catch hidden non-Python dependencies that security tools often miss.
Security News
Socket CEO Feross Aboukhadijeh discusses open source security challenges, including zero-day attacks and supply chain risks, on the Cyber Security Council podcast.
Security News
Research
Socket researchers uncover how threat actors weaponize Out-of-Band Application Security Testing (OAST) techniques across the npm, PyPI, and RubyGems ecosystems to exfiltrate sensitive data.