MSP-Greg · Oct 18, 2025 · Oct 3, 2025 · Oct 17, 2025
diff --git a/lib/puma/app/status.rb b/lib/puma/app/status.rb
@@ -7,13 +7,16 @@ module App
     # can respond to.
     class Status
       OK_STATUS = '{ "status": "ok" }'.freeze
+      READ_ONLY_COMMANDS = %w[gc-stats stats].freeze
 
       # @param launcher [::Puma::Launcher]
       # @param token [String, nil] the token used for authentication
+      # @param data_only [Boolean] if true, restrict to read-only data commands
       #
-      def initialize(launcher, token = nil)
+      def initialize(launcher, token: nil, data_only: false)
         @launcher = launcher
         @auth_token = token
+        @enabled_commands = READ_ONLY_COMMANDS if data_only
       end
 
       # most commands call methods in `::Puma::Launcher` based on command in
@@ -25,8 +28,13 @@ def call(env)
 
         # resp_type is processed by following case statement, return
         # is a number (status) or a string used as the body of a 200 response
+        command = env['PATH_INFO'][/\/([^\/]+)$/, 1]
+        if @enabled_commands && !@enabled_commands.include?(command)
+          return rack_response(404, "Command #{command.inspect} unavailable", 'text/plain')
+        end
+
         resp_type =
-          case env['PATH_INFO'][/\/([^\/]+)$/, 1]
+          case command
           when 'stop'
             @launcher.stop ; 200
 

diff --git a/lib/puma/dsl.rb b/lib/puma/dsl.rb
@@ -216,6 +216,8 @@ def app(obj=nil, &block)
     #   activate_control_app 'unix:///var/run/pumactl.sock', { auth_token: '12345' }
     # @example
     #   activate_control_app 'unix:///var/run/pumactl.sock', { no_token: true }
+    # @example
+    #   activate_control_app 'unix:///var/run/pumactl.sock', { no_token: true, data_only: true}
     #
     def activate_control_app(url="auto", opts={})
       if url == "auto"
@@ -240,6 +242,7 @@ def activate_control_app(url="auto", opts={})
 
       @options[:control_auth_token] = auth_token
       @options[:control_url_umask] = opts[:umask] if opts[:umask]
+      @options[:control_data_only] = opts[:data_only] if opts[:data_only]
     end
 
     # Load additional configuration from a file.

diff --git a/lib/puma/runner.rb b/lib/puma/runner.rb
@@ -70,7 +70,7 @@ def start_control
         token = nil if token.empty? || token == 'none'
       end
 
-      app = Puma::App::Status.new @launcher, token
+      app = Puma::App::Status.new @launcher, token: token, data_only: @options[:control_data_only]
 
       # A Reactor is not created and nio4r is not loaded when 'queue_requests: false'
       # Use `nil` for events, no hooks in control server

diff --git a/test/test_app_status.rb b/test/test_app_status.rb
@@ -94,4 +94,23 @@ def test_alternate_location
     status, _ , _ = lint('__alternatE_location_/stats')
     assert_equal 200, status
   end
+
+  def test_disabled_command
+    @app = Puma::App::Status.new(@server, data_only: true)
+
+    status, _ , app = lint('/stats')
+
+    assert_equal 200, status
+    assert_equal ['{}'], app.enum_for.to_a
+
+    status, _ , app = lint('/gc-stats')
+
+    assert_equal 200, status
+
+    status, _ , app = lint('/stop')
+
+    assert_equal :running, @server.status
+    assert_equal 404, status
+    assert_equal ['Command "stop" unavailable'], app.enum_for.to_a
+  end
 end