rails_error_dashboard 0.12.0 → 0.13.0

data/app/jobs/rails_error_dashboard/notification_burst_summary_job.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  # Sends the ONE message that replaces the rest of a burst of new-error
+  # notifications.
+  #
+  # A bad deploy can produce hundreds of DISTINCT new errors. Each is a first
+  # occurrence, so the per-error cooldown never applies; without a cap every
+  # one of them pages. NotificationThrottler.burst_decision lets the first
+  # config.notification_burst_limit through per window and asks for this job
+  # exactly once, when the limit is first exceeded.
+  #
+  # The message states the limit and the window rather than a count of what
+  # was suppressed: it is sent when suppression STARTS, and a count at that
+  # moment would always be one. Every error is still stored and counted; only
+  # the notifications are held back.
+  class NotificationBurstSummaryJob < ApplicationJob
+    include Concerns::PlainChannelMessage
+
+    queue_as :default
+
+    # @param limit [Integer] config.notification_burst_limit when the cap engaged
+    # @param window_seconds [Integer] config.notification_burst_window_seconds
+    # @param locale [String, nil] resolved at enqueue time
+    def perform(limit:, window_seconds:, locale: nil)
+      config = RailsErrorDashboard.configuration
+
+      deliver_plain_message(build_message(limit, window_seconds, config, job_locale(locale)), {
+        event: "new_error_notifications_suppressed",
+        limit: limit,
+        window_seconds: window_seconds,
+        application: app_name(config)
+      })
+    rescue => e
+      Rails.logger.error("[RailsErrorDashboard] NotificationBurstSummaryJob failed: #{e.class} - #{e.message}")
+    end
+
+    private
+
+    # Whole sentences joined, never fragments: see StormNotificationJob.
+    # ":warning:" is Slack/Discord emoji shortcode, not text.
+    def build_message(limit, window_seconds, config, locale)
+      dashboard = (config.dashboard_base_url || "").chomp("/")
+      link = if dashboard.present?
+        " " + t("red.notifications.burst.dashboard", locale, url: "#{dashboard}/errors")
+      else
+        ""
+      end
+
+      ":warning: " \
+        "#{t("red.notifications.burst.suppressed", locale, application: app_name(config), limit: limit, window: window_seconds)} " \
+        "#{t("red.notifications.burst.still_recorded", locale)}#{link}"
+    end
+  end
+end

data/app/jobs/rails_error_dashboard/retention_cleanup_job.rb

@@ -14,6 +14,25 @@ module RailsErrorDashboard
   class RetentionCleanupJob < ApplicationJob
     queue_as :default
 
+    # The errors retention applies to: "not seen for retention_days", not
+    # "first seen retention_days ago". occurred_at is stamped when a group is
+    # created and never moves, so expiring by it deleted errors that were still
+    # happening today -- with their comments and triage history -- the day
+    # they turned N days old.
+    #
+    # Equivalent to COALESCE(last_seen_at, occurred_at) < cutoff (the NULL arm
+    # covers rows from before last_seen_at existed), but written so that each
+    # arm can use its own index; wrapping the columns in COALESCE would force a
+    # full scan of the largest table on every run.
+    #
+    # Public because the rake task previews the same selection before it asks
+    # for confirmation.
+    def self.expired_scope(cutoff)
+      ErrorLog.where(
+        "last_seen_at < :cutoff OR (last_seen_at IS NULL AND occurred_at < :cutoff)", cutoff: cutoff
+      )
+    end
+
     # @return [Integer] number of errors deleted
     def perform
       retention_days = RailsErrorDashboard.configuration.retention_days
@@ -26,8 +45,10 @@ module RailsErrorDashboard
       # whenever no error logs happen to be expired.
       cleanup_rack_attack_events(cutoff)
       cleanup_storm_flush_batches(cutoff)
+      cleanup_diagnostic_dumps(cutoff)
+      cleanup_swallowed_exceptions(cutoff)
 
-      expired_scope = ErrorLog.where("occurred_at < ?", cutoff)
+      expired_scope = self.class.expired_scope(cutoff)
       return 0 if expired_scope.none?
 
       deleted_count = 0
@@ -48,6 +69,9 @@ module RailsErrorDashboard
         deleted_count += batch_size
       end
 
+      # delete_all skips callbacks, and the stat cards are cached.
+      Services::AnalyticsCacheManager.clear if deleted_count > 0
+
       if deleted_count > 0
         RailsErrorDashboard::Logger.info(
           "[RailsErrorDashboard] Retention cleanup: deleted #{deleted_count} errors older than #{retention_days} days"
@@ -86,6 +110,49 @@ module RailsErrorDashboard
       )
     end
 
+    # Diagnostic dumps and swallowed-exception aggregates are written
+    # independently of error logs and nothing else ever deletes them, so they
+    # grew without bound. Not gated on their feature flags: rows written while
+    # a feature was on must still expire after it is switched off. Own rescue
+    # each, like the cleanups around them.
+    def cleanup_diagnostic_dumps(cutoff)
+      return unless DiagnosticDump.table_exists?
+
+      deleted = 0
+      DiagnosticDump.where("captured_at < ?", cutoff).in_batches(of: 1000) do |batch|
+        deleted += batch.delete_all
+      end
+
+      if deleted > 0
+        RailsErrorDashboard::Logger.info(
+          "[RailsErrorDashboard] Retention cleanup: deleted #{deleted} diagnostic dumps"
+        )
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] Diagnostic dump retention cleanup failed: #{e.class} - #{e.message}"
+      )
+    end
+
+    def cleanup_swallowed_exceptions(cutoff)
+      return unless SwallowedException.table_exists?
+
+      deleted = 0
+      SwallowedException.where("period_hour < ?", cutoff).in_batches(of: 1000) do |batch|
+        deleted += batch.delete_all
+      end
+
+      if deleted > 0
+        RailsErrorDashboard::Logger.info(
+          "[RailsErrorDashboard] Retention cleanup: deleted #{deleted} swallowed exception records"
+        )
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug(
+        "[RailsErrorDashboard] Swallowed exception retention cleanup failed: #{e.class} - #{e.message}"
+      )
+    end
+
     # Expire aggregated Rack Attack event rows. Isolated in its own rescue so a
     # failure here (e.g. table not yet migrated) never blocks error cleanup.
     def cleanup_rack_attack_events(cutoff)

data/app/jobs/rails_error_dashboard/storm_notification_job.rb

@@ -7,6 +7,8 @@ module RailsErrorDashboard
   # help nobody) — this one message replaces them. The gate guarantees at
   # most one enqueue per episode; this job just delivers.
   class StormNotificationJob < ApplicationJob
+    include Concerns::PlainChannelMessage
+
     queue_as :default
 
     # @param started_at [String] ISO8601 episode start
@@ -17,23 +19,12 @@ module RailsErrorDashboard
       config = RailsErrorDashboard.configuration
       message = build_message(started_at, state, config, job_locale(locale))
 
-      if config.enable_slack_notifications && config.slack_webhook_url.present?
-        post_json(config.slack_webhook_url, { text: message })
-      end
-
-      if config.enable_discord_notifications && config.discord_webhook_url.present?
-        post_json(config.discord_webhook_url, { content: message })
-      end
-
-      if config.enable_webhook_notifications && config.webhook_urls.any?
-        payload = {
-          event: "error_storm_detected",
-          started_at: started_at,
-          state: state,
-          application: app_name(config)
-        }
-        config.webhook_urls.each { |url| post_json(url, payload) }
-      end
+      deliver_plain_message(message, {
+        event: "error_storm_detected",
+        started_at: started_at,
+        state: state,
+        application: app_name(config)
+      })
     rescue => e
       Rails.logger.error("[RailsErrorDashboard] StormNotificationJob failed: #{e.class} - #{e.message}")
     end
@@ -61,32 +52,5 @@ module RailsErrorDashboard
         "#{t("red.notifications.storm.engaged", locale, mode: mode)} " \
         "#{t("red.notifications.storm.suppressed", locale)}#{link}"
     end
-
-    def t(key, locale, **options)
-      RailsErrorDashboard::I18nStore.translate(key, locale: locale, **options)
-    end
-
-    def app_name(config)
-      config.application_name || ENV["APPLICATION_NAME"] ||
-        (defined?(Rails) && Rails.application.class.module_parent_name) || "Rails Application"
-    end
-
-    def post_json(url, payload)
-      if defined?(HTTParty)
-        HTTParty.post(url, body: payload.to_json,
-          headers: { "Content-Type" => "application/json" }, timeout: 10)
-      else
-        uri = URI(url)
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = uri.scheme == "https"
-        http.open_timeout = 5
-        http.read_timeout = 10
-        request = Net::HTTP::Post.new(uri.path, { "Content-Type" => "application/json" })
-        request.body = payload.to_json
-        http.request(request)
-      end
-    rescue => e
-      Rails.logger.error("[RailsErrorDashboard] Storm notification post failed: #{e.message}")
-    end
   end
 end

data/app/models/rails_error_dashboard/error_baseline.rb

@@ -48,17 +48,20 @@ module RailsErrorDashboard
       return nil if mean.nil? || std_dev.nil?
       return nil if current_count <= mean
 
-      std_devs_above = (current_count - mean) / std_dev
+      # nil when std_dev is zero: a perfectly flat history has no spread to
+      # measure against, and dividing by it made every count :critical.
+      sigma = std_devs_above_mean(current_count)
+      return nil if sigma.nil?
 
-      case std_devs_above
-      when sensitivity..(sensitivity + 1)
-        :elevated
-      when (sensitivity + 1)..(sensitivity + 2)
-        :high
-      when (sensitivity + 2)..Float::INFINITY
+      # Half-open bands, highest first: a boundary value belongs to the band it
+      # opens (3.0 is :high, 4.0 is :critical). Inclusive ranges matched
+      # top-down gave each boundary to the band below it.
+      if sigma >= sensitivity + 2
         :critical
-      else
-        nil
+      elsif sigma >= sensitivity + 1
+        :high
+      elsif sigma >= sensitivity
+        :elevated
       end
     end
 

data/app/models/rails_error_dashboard/error_comment.rb

@@ -14,11 +14,6 @@ module RailsErrorDashboard
     scope :recent_first, -> { order(created_at: :desc) }
     scope :oldest_first, -> { order(created_at: :asc) }
 
-    # Get formatted timestamp for display
-    def formatted_time
-      created_at.strftime("%b %d, %Y at %I:%M %p")
-    end
-
     # Check if comment was created recently (within last hour)
     def recent?
       created_at > 1.hour.ago

data/app/models/rails_error_dashboard/error_log.rb

@@ -86,9 +86,9 @@ module RailsErrorDashboard
     after_create_commit -> { Services::ErrorBroadcaster.broadcast_new(self) }
     after_update_commit -> { Services::ErrorBroadcaster.broadcast_update(self) }
 
-    # Cache invalidation - clear analytics caches when errors are created/updated/deleted
-    after_save -> { Services::AnalyticsCacheManager.clear }
-    after_destroy -> { Services::AnalyticsCacheManager.clear }
+    # No cache invalidation here, on purpose. A save is what a CAPTURE does, in
+    # the host app's request thread; the stats caches expire by TTL instead, and
+    # the commands behind user actions call AnalyticsCacheManager.clear themselves.
 
     def set_defaults
       self.platform ||= "API"
@@ -271,7 +271,13 @@ module RailsErrorDashboard
       end
     end
 
+    # The five workflow statuses. One list, so that a command can tell
+    # "unknown status" from "known, but not reachable from here".
+    STATUSES = %w[new in_progress investigating resolved wont_fix].freeze
+
     def can_transition_to?(new_status)
+      return false unless STATUSES.include?(new_status)
+
       # Define valid status transitions
       valid_transitions = {
         "new" => [ "in_progress", "investigating", "wont_fix" ],

data/app/models/rails_error_dashboard/error_logs_record.rb

@@ -35,6 +35,23 @@ module RailsErrorDashboard
     # after the user's configuration is loaded
     # See lib/rails_error_dashboard/engine.rb
 
+    # Read-side half of the invalid-bytes defence. Capture scrubs what it
+    # writes, but SQLite and MySQL will happily hold a row written before that
+    # (or by anything else), and one such string takes down every page that
+    # renders it: ERB raises "invalid byte sequence in UTF-8". Scrubbing on load
+    # makes the page render whether or not the operator has run
+    # error_dashboard:scrub_invalid_encoding yet. In memory only: nothing is
+    # written, and the record is not left dirty.
+    after_find :scrub_invalid_strings
+
+    # Names of the attributes the load-time scrub had to repair, so that
+    # Commands::ScrubInvalidEncoding can persist the repair: once the values
+    # are clean in memory, re-reading them can no longer tell a bad row apart.
+    # @return [Array<String>]
+    def invalid_encoding_attributes
+      @invalid_encoding_attributes || []
+    end
+
     # Rails' default for a string column when the adapter has one (MySQL).
     DEFAULT_STRING_LIMIT = 255
 
@@ -68,5 +85,22 @@ module RailsErrorDashboard
         limits[name] = column.limit || DEFAULT_STRING_LIMIT if column.type == :string
       end
     end
+
+    private
+
+    def scrub_invalid_strings
+      @attributes.each_value do |attribute|
+        value = attribute.value_before_type_cast
+        next unless value.is_a?(String)
+        next if value.encoding == Encoding::UTF_8 && value.valid_encoding? && !value.include?("\0")
+
+        name = attribute.name
+        self[name] = Services::EncodingSanitizer.scrub(value)
+        clear_attribute_changes([ name ])
+        (@invalid_encoding_attributes ||= []) << name
+      end
+    rescue => e
+      RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] scrub on load failed: #{e.class}: #{e.message}")
+    end
   end
 end

data/app/models/rails_error_dashboard/error_occurrence.rb

@@ -23,7 +23,15 @@ module RailsErrorDashboard
     scope :in_time_window, ->(start_time, end_time) { where(occurred_at: start_time..end_time) }
     scope :for_user, ->(user_id) { where(user_id: user_id) }
     scope :for_request, ->(request_id) { where(request_id: request_id) }
-    scope :for_session, ->(session_id) { where(session_id: session_id) }
+    # Takes the raw session ID (or a stored digest). Rows are stored as a keyed
+    # digest while filter_sensitive_data is on, and raw otherwise or before the
+    # upgrade, so both forms are matched. Blank matches nothing.
+    scope :for_session, lambda { |session_id|
+      raw = session_id.to_s
+      next none if raw.empty?
+
+      where(session_id: [ raw, Services::SensitiveDataFilter.digest_session_id(raw) ].compact.uniq)
+    }
 
     # Find occurrences within a time window around this occurrence
     # @param window_minutes [Integer] Time window in minutes (default: 5)

data/app/views/layouts/rails_error_dashboard.html.erb

@@ -1182,10 +1182,18 @@ tr[data-red-row-href]:hover .sev-bar { opacity: 1 !important; }
               <i class="bi bi-layout-sidebar-inset"></i>
             </button>
             <!-- Search -->
-            <div style="position: relative;">
+            <%# A plain GET form to the errors index, using the same "search"
+                parameter as the index's own field. Hand-written rather than
+                form_with: a GET form must not put an authenticity token or a
+                utf8 field into the query string. Only String parameters are
+                echoed back; a nested one is ignored. %>
+            <form action="<%= errors_path %>" method="get" role="search" style="position: relative; margin: 0;">
               <i class="bi bi-search" style="position: absolute; left: 10px; top: 50%; transform: translateY(-50%); font-size: 13px; color: var(--text-tertiary);"></i>
-              <input class="red-search-input" placeholder="<%= red_t("red.navbar.search_placeholder") %>" id="globalSearch" />
-            </div>
+              <input class="red-search-input" type="text" name="search" value="<%= params[:search] if params[:search].is_a?(String) %>" placeholder="<%= red_t("red.navbar.search_placeholder") %>" aria-label="<%= red_t("red.navbar.search_placeholder") %>" id="globalSearch" />
+              <% if params[:application_id].is_a?(String) && params[:application_id].present? %>
+                <input type="hidden" name="application_id" value="<%= params[:application_id] %>" />
+              <% end %>
+            </form>
           </div>
           <div style="display: flex; align-items: center; gap: var(--space-3);">
             <!-- Application Switcher (multi-app) -->

data/app/views/rails_error_dashboard/errors/_discussion.html.erb

@@ -1,4 +1,7 @@
 <% has_linked_issue = error.respond_to?(:external_issue_url) && error.external_issue_url.present? %>
+<%# nil when the stored value is not plain http(s); the button is then omitted
+    (the issue card explains why). See safe_external_url. %>
+<% discussion_issue_url = has_linked_issue ? safe_external_url(error.external_issue_url) : nil %>
 <% has_audit_comments = error.respond_to?(:comments) && error.comments.any? %>
 <% platform_comments = @platform_comments || [] %>
 <% issue_tracking_enabled = RailsErrorDashboard.configuration.enable_issue_tracking %>
@@ -30,9 +33,11 @@
           <span class="badge bg-secondary ms-2"><%= platform_comments.size %></span>
         <% end %>
       </h5>
-      <a href="<%= error.external_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
-        <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.reply_on", provider: discussion_provider) %>
-      </a>
+      <% if discussion_issue_url %>
+        <a href="<%= discussion_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
+          <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.reply_on", provider: discussion_provider) %>
+        </a>
+      <% end %>
     </div>
     <div class="card-body p-0">
       <% if platform_comments.any? %>
@@ -40,14 +45,14 @@
           <% platform_comments.each_with_index do |comment, index| %>
             <div class="px-3 py-3 <%= index < platform_comments.size - 1 ? 'border-bottom' : '' %>">
               <div class="d-flex align-items-start gap-2 mb-2">
-                <% if comment[:avatar_url].present? %>
-                  <img src="<%= comment[:avatar_url] %>" alt="<%= comment[:author] %>" width="24" height="24" class="rounded-circle" style="flex-shrink: 0;">
+                <% if (avatar = safe_external_url(comment[:avatar_url])) %>
+                  <img src="<%= avatar %>" alt="<%= comment[:author] %>" width="24" height="24" class="rounded-circle" style="flex-shrink: 0;">
                 <% else %>
                   <i class="bi bi-person-circle" style="font-size: 1.3em; flex-shrink: 0;"></i>
                 <% end %>
                 <div>
                   <strong class="text-primary"><%= comment[:author] || red_t("red.common.unknown") %></strong>
-                  <small class="text-muted ms-2"><%= comment[:created_at] ? Time.parse(comment[:created_at]).strftime(red_time_format(:datetime)) : "" %></small>
+                  <small class="text-muted ms-2"><%= local_time(safe_parse_time(comment[:created_at]), format: :datetime, fallback: "") %></small>
                 </div>
               </div>
               <div class="ms-4 text-break" style="font-size: 0.9em;">
@@ -68,7 +73,7 @@
             <div class="d-flex justify-content-between align-items-start">
               <div>
                 <small class="text-primary fw-bold"><i class="bi bi-person-circle"></i> <%= comment.author_name %></small>
-                <small class="text-muted ms-2"><%= comment.formatted_time %></small>
+                <small class="text-muted ms-2"><%= local_time(comment.created_at, format: :datetime) %></small>
               </div>
             </div>
             <small class="text-muted text-break"><%= simple_format(h(comment.body), {}, wrapper_tag: "span") %></small>
@@ -84,9 +89,11 @@
       <h5 class="mb-0">
         <i class="bi bi-chat-dots"></i> <%= red_t("red.errors.discussion.title") %>
       </h5>
-      <a href="<%= error.external_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
-        <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.start_on", provider: discussion_provider) %>
-      </a>
+      <% if discussion_issue_url %>
+        <a href="<%= discussion_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
+          <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.discussion.start_on", provider: discussion_provider) %>
+        </a>
+      <% end %>
     </div>
     <div class="card-body text-center py-3">
       <p class="text-muted small mb-0"><%= red_t("red.errors.discussion.empty", provider: discussion_provider_lc) %></p>
@@ -106,7 +113,7 @@
           <div class="d-flex justify-content-between align-items-start">
             <div>
               <small class="text-primary fw-bold"><i class="bi bi-person-circle"></i> <%= comment.author_name %></small>
-              <small class="text-muted ms-2"><%= comment.formatted_time %></small>
+              <small class="text-muted ms-2"><%= local_time(comment.created_at, format: :datetime) %></small>
             </div>
           </div>
           <small class="text-muted text-break"><%= simple_format(h(comment.body), {}, wrapper_tag: "span") %></small>

data/app/views/rails_error_dashboard/errors/_issue_section.html.erb

@@ -5,8 +5,10 @@
         <i class="bi bi-link-45deg me-2"></i>
         <%= red_t("red.errors.issue_section.title") %>
       </h5>
-      <% if @error.external_issue_url.present? %>
-        <a href="<%= @error.external_issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
+      <%# nil unless the stored value is plain http(s) — see safe_external_url. %>
+      <% issue_url = safe_external_url(@error.external_issue_url) %>
+      <% if issue_url %>
+        <a href="<%= issue_url %>" target="_blank" rel="noopener" class="btn btn-sm btn-outline-primary">
           <i class="bi bi-box-arrow-up-right me-1"></i> <%= red_t("red.errors.issue_section.view_issue") %>
         </a>
       <% end %>
@@ -23,6 +25,15 @@
                    end %>
         <% issue = @platform_issue %>
 
+        <% unless issue_url %>
+          <%# Stored, but not plain http(s): shown as text, never as a link. %>
+          <div class="alert alert-warning py-2 px-3 mb-3" style="font-size: 0.85em;">
+            <i class="bi bi-exclamation-triangle me-1"></i>
+            <%= red_t("red.errors.issue_section.unsafe_link") %>
+            <code class="d-block text-break mt-1"><%= @error.external_issue_url.to_s.truncate(200) %></code>
+          </div>
+        <% end %>
+
         <!-- Issue badge + status -->
         <div class="d-flex align-items-center gap-2 mb-3">
           <span class="badge bg-success">
@@ -50,8 +61,8 @@
                 <div class="d-flex align-items-center gap-2 flex-wrap">
                   <% issue[:assignees].each do |assignee| %>
                     <span class="d-inline-flex align-items-center gap-1 border rounded-pill px-2 py-1" style="font-size: 0.85em;">
-                      <% if assignee[:avatar_url].present? %>
-                        <img src="<%= assignee[:avatar_url] %>" width="18" height="18" class="rounded-circle">
+                      <% if (avatar = safe_external_url(assignee[:avatar_url])) %>
+                        <img src="<%= avatar %>" width="18" height="18" class="rounded-circle">
                       <% end %>
                       <%= assignee[:login] %>
                     </span>
@@ -68,8 +79,9 @@
               <% if issue[:labels].present? && issue[:labels].any? %>
                 <div class="d-flex align-items-center gap-1 flex-wrap">
                   <% issue[:labels].each do |label| %>
-                    <% bg_color = label[:color].present? ? "##{label[:color]}" : "#6c757d" %>
-                    <% text_color = label[:color].present? && label[:color].scan(/../).map { |c| c.to_i(16) }.sum > 382 ? "#000" : "#fff" %>
+                    <%# Third-party value going into style=: validated, never interpolated raw. %>
+                    <% bg_color = safe_label_color(label[:color]) %>
+                    <% text_color = label_text_color(bg_color) %>
                     <span class="badge rounded-pill" style="background-color: <%= bg_color %>; color: <%= text_color %>; font-size: 0.78em;">
                       <%= label[:name] %>
                     </span>
@@ -118,10 +130,12 @@
     </div>
   </div>
 
-  <% if flash[:new_issue_url].present? %>
+  <%# The URL comes from the forge's API response; window.open would run a
+      javascript: target, so it gets the same http(s) check as the links. %>
+  <% if (new_issue_url = safe_external_url(flash[:new_issue_url])) %>
     <script<%= " nonce=\"#{red_csp_nonce}\"".html_safe if red_csp_nonce %>>
       (function() {
-        window.open('<%= j flash[:new_issue_url] %>', '_blank');
+        window.open(<%= js_safe_json(new_issue_url) %>, '_blank');
       })();
     </script>
   <% end %>

data/app/views/rails_error_dashboard/errors/_sidebar_metadata.html.erb

@@ -72,7 +72,7 @@
 
           <% if error.respond_to?(:environment) && error.environment.present? %>
             <div class="mb-3">
-              <small class="metadata-label d-block mb-1"><%= red_t("red.errors.sidebar.environment") %></small>
+              <small class="metadata-label d-block mb-1"><%= red_t("red.errors.sidebar.environment.title") %></small>
               <%= link_to errors_path(environment: error.environment, unresolved: '0'), class: "text-decoration-none", title: red_t("red.errors.sidebar.view_all_environment", environment: error.environment) do %>
                 <span class="badge badge-api" data-environment-badge="<%= error.environment %>"><i class="bi bi-hdd-stack"></i> <%= error.environment %></span>
               <% end %>
@@ -106,12 +106,21 @@
                     The <a> is built here rather than living in the key. The key
                     is _html and therefore html_safe, so a raw URL interpolated
                     into an href inside it would not be escaped and a crafted
-                    external_issue_url could inject an event handler. link_to
-                    escapes the URL. %>
-                <% if error.respond_to?(:external_issue_url) && error.external_issue_url.present? %>
+                    external_issue_url could inject an event handler.
+
+                    link_to escapes the URL, which stops attribute BREAKOUT. It
+                    does not reject a scheme: link_to("x", "javascript:...")
+                    is a working link. That protection comes from
+                    safe_external_url, which returns nil for anything that is
+                    not plain http(s). %>
+                <% stored_issue_url = error.respond_to?(:external_issue_url) ? error.external_issue_url : nil %>
+                <% sidebar_issue_url = safe_external_url(stored_issue_url) %>
+                <% if sidebar_issue_url %>
                   <%= red_t("red.errors.sidebar.issue_tracking_linked_html",
                         link: link_to(red_t("red.errors.sidebar.issue_tracking_link_text"),
-                              error.external_issue_url, target: "_blank", rel: "noopener")) %>
+                              sidebar_issue_url, target: "_blank", rel: "noopener")) %>
+                <% elsif stored_issue_url.present? %>
+                  <%= red_t("red.errors.issue_section.unsafe_link") %>
                 <% else %>
                   <%= red_t("red.errors.sidebar.issue_tracking_unlinked") %>
                 <% end %>
@@ -504,7 +513,7 @@
                   <% if health[:job_queue] %>
                     <% jq = health[:job_queue] %>
                     <div class="mb-1">
-                      <small class="text-muted">Job Queue (<%= jq[:adapter] %>):</small>
+                      <small class="text-muted"><%= red_t("red.errors.sidebar.health.job_queue", adapter: jq[:adapter]) %></small>
                       <code class="ms-1">
                         <% case jq[:adapter] %>
                         <% when "sidekiq" %>