rails_error_dashboard 0.12.1 → 0.13.0

data/lib/rails_error_dashboard/queries/baseline_stats.rb

@@ -23,6 +23,113 @@ module RailsErrorDashboard
         new(error_type, platform).weekly_baseline
       end
 
+      # Pairs considered by .current_anomalies, busiest first. A bound, so the
+      # check costs the same whether 5 or 50,000 error types are stored.
+      MAX_ANOMALY_PAIRS = 500
+      BASELINE_PRECEDENCE = %w[hourly daily weekly].freeze
+
+      # Every (error_type, platform) pair that is anomalous RIGHT NOW, for all
+      # pairs at once. Same rule as #check_current_anomaly -- the first baseline
+      # available among hourly / daily / weekly, compared against this hour /
+      # today / this week -- but in a fixed number of queries instead of about six
+      # per pair. DashboardStats calls this from the live stats broadcast, which
+      # runs inside the host app's capture path.
+      #
+      # Only pairs with an event this week are looked at: a pair with none has a
+      # count of zero, which no baseline can call anomalous.
+      #
+      # @return [Array<Hash>] error_type, platform, count, level, std_devs_above,
+      #   baseline_type. Empty on any failure -- never raises.
+      def self.current_anomalies(sensitivity: 2, application_id: nil)
+        return [] unless defined?(ErrorBaseline) && ErrorBaseline.table_exists?
+
+        counts = current_counts_by_pair(application_id: application_id)
+        return [] if counts.empty?
+
+        baselines = latest_baselines_for(counts.keys)
+
+        counts.filter_map do |(error_type, platform), windows|
+          kind = BASELINE_PRECEDENCE.find { |type| baselines[[ error_type, platform, type ]] }
+          next unless kind
+
+          baseline = baselines[[ error_type, platform, kind ]]
+          # A flat history has no spread to measure against; dividing by it
+          # makes any count above the mean infinitely anomalous.
+          next if baseline.std_dev.nil? || baseline.std_dev.zero?
+
+          count = windows.fetch(kind.to_sym)
+          level = baseline.anomaly_level(count, sensitivity: sensitivity)
+          next unless level
+
+          {
+            error_type: error_type,
+            platform: platform,
+            count: count,
+            level: level,
+            std_devs_above: baseline.std_devs_above_mean(count),
+            baseline_type: kind
+          }
+        end
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] current_anomalies failed: #{e.class}: #{e.message}")
+        []
+      end
+
+      # { [error_type, platform] => { hourly:, daily:, weekly: } } in ONE grouped
+      # query, counted in the units the baselines were built from (occurrence
+      # rows when that table exists). The week is the widest window, so it is
+      # the WHERE; the day and the hour are conditional sums inside it.
+      def self.current_counts_by_pair(application_id: nil)
+        logs = ErrorLog.table_name
+        column = Services::BaselineCalculator.time_column
+        now = Time.current
+
+        relation = if defined?(ErrorOccurrence) && ErrorOccurrence.table_exists?
+          ErrorOccurrence.joins(:error_log)
+        else
+          ErrorLog.all
+        end
+        relation = relation.where(logs => { application_id: application_id }) if application_id.present?
+
+        since = ->(time) { ErrorLog.sanitize_sql_array([ "SUM(CASE WHEN #{column} >= ? THEN 1 ELSE 0 END)", time ]) }
+
+        rows = relation
+                 .where("#{column} >= ?", now.beginning_of_week)
+                 .group("#{logs}.error_type", "#{logs}.platform")
+                 .order(Arel.sql("COUNT(*) DESC"))
+                 .limit(MAX_ANOMALY_PAIRS)
+                 .pluck(Arel.sql("#{logs}.error_type"), Arel.sql("#{logs}.platform"), Arel.sql("COUNT(*)"),
+                        Arel.sql(since.call(now.beginning_of_day)), Arel.sql(since.call(now.beginning_of_hour)))
+
+        rows.to_h do |error_type, platform, weekly, daily, hourly|
+          [ [ error_type, platform ], { weekly: weekly.to_i, daily: daily.to_i, hourly: hourly.to_i } ]
+        end
+      end
+
+      # { [error_type, platform, baseline_type] => ErrorBaseline }, the most recent
+      # row of each, in ONE query. Baseline rows accumulate (one per calculation
+      # period), so "latest" is resolved in SQL with a join on MAX(period_start)
+      # rather than by loading the history. The join form is portable to every
+      # adapter; a row-value IN is not.
+      def self.latest_baselines_for(pairs)
+        table = ErrorBaseline.table_name
+        types = pairs.map(&:first).compact.uniq
+        return {} if types.empty?
+
+        latest = ErrorBaseline.where(error_type: types, baseline_type: BASELINE_PRECEDENCE)
+                              .group(:error_type, :platform, :baseline_type)
+                              .select(:error_type, :platform, :baseline_type, "MAX(period_start) AS latest_period_start")
+
+        ErrorBaseline
+          .joins("INNER JOIN (#{latest.to_sql}) latest_baselines ON " \
+                 "latest_baselines.error_type = #{table}.error_type AND " \
+                 "latest_baselines.platform = #{table}.platform AND " \
+                 "latest_baselines.baseline_type = #{table}.baseline_type AND " \
+                 "latest_baselines.latest_period_start = #{table}.period_start")
+          .index_by { |baseline| [ baseline.error_type, baseline.platform, baseline.baseline_type ] }
+      end
+      private_class_method :current_counts_by_pair, :latest_baselines_for
+
       def initialize(error_type, platform)
         @error_type = error_type
         @platform = platform

data/lib/rails_error_dashboard/queries/dashboard_stats.rb

@@ -5,6 +5,9 @@ module RailsErrorDashboard
     # Query: Fetch dashboard statistics
     # This is a read operation that aggregates error data for the dashboard
     class DashboardStats
+      # One instance answers ONE call: several aggregates (today's event count,
+      # the 7-day trend, spike detection) are memoised on it so that they are
+      # computed once per call rather than once per card that shows them.
       def initialize(application_id: nil)
         @application_id = application_id
       end
@@ -24,7 +27,7 @@ module RailsErrorDashboard
               # rows reported five users hitting one error as "1 error today".
               # Summing is also exact during a storm: counted-only events never
               # create occurrence rows, but they DO raise occurrence_count.
-              total_today: event_count_since(Time.current.beginning_of_day),
+              total_today: today_event_count,
               total_week: event_count_since(7.days.ago),
               total_month: event_count_since(30.days.ago),
               unresolved: base_scope.unresolved.count,
@@ -93,13 +96,14 @@ module RailsErrorDashboard
       end
 
       def cache_key
-        # Cache key includes last error update timestamp for auto-invalidation
-        # Also includes current hour to ensure fresh data
-        # Uses base_scope to respect application_id filter for proper cache isolation
+        # The cache GENERATION, not maximum(:updated_at): the timestamp cost a
+        # query per key build and changed on every capture, so the cache never
+        # hit while errors were arriving. Freshness after a capture is the
+        # 1-minute TTL; user actions bump the generation (AnalyticsCacheManager).
         [
           "dashboard_stats",
           @application_id || "all",
-          base_scope.maximum(:updated_at)&.to_i || 0,
+          Services::AnalyticsCacheManager.generation,
           Time.current.hour
         ].join("/")
       end
@@ -147,7 +151,7 @@ module RailsErrorDashboard
         recorded = occurrence_scope
                      .where("#{ErrorOccurrence.table_name}.occurred_at >= ?", Time.current.beginning_of_day)
                      .count
-        recorded < event_count_since(Time.current.beginning_of_day)
+        recorded < today_event_count
       rescue StandardError
         false
       end
@@ -169,9 +173,10 @@ module RailsErrorDashboard
 
       # Get 7-day error trend (daily counts)
       def errors_trend_7d
-        base_scope.where("occurred_at >= ?", 7.days.ago)
-                  .group_by_day(:occurred_at, range: 7.days.ago.to_date..Date.current, default_value: 0)
-                  .sum(:occurrence_count)
+        @errors_trend_7d ||=
+          base_scope.where("occurred_at >= ?", 7.days.ago)
+                    .group_by_day(:occurred_at, range: 7.days.ago.to_date..Date.current, default_value: 0)
+                    .sum(:occurrence_count)
       end
 
       # Get error counts by severity for last 7 days
@@ -193,21 +198,25 @@ module RailsErrorDashboard
 
       # Detect if there's an error spike
       #  Uses baselines if available, falls back to simple 2x average
+      #
+      # Memoised: the stats hash asks twice (spike_detected and spike_info), and
+      # this runs from the live stats broadcast inside the capture path.
       def spike_detected?
-        return false if errors_trend_7d.empty?
+        return @spike_detected if defined?(@spike_detected)
 
-        today_count = event_count_since(Time.current.beginning_of_day)
+        @spike_detected = compute_spike_detected
+      end
 
-        # Try baseline-based detection first
-        if baseline_anomaly_detected?(today_count)
-          return true
-        end
+      def compute_spike_detected
+        trend = errors_trend_7d
+        return false if trend.empty?
+        return true if baseline_anomalies.any?
 
         # Fall back to simple 2x average detection
-        avg_count = errors_trend_7d.values.sum / 7.0
+        avg_count = trend.values.sum / 7.0
         return false if avg_count.zero?
 
-        today_count >= (avg_count * 2)
+        today_event_count >= (avg_count * 2)
       end
 
       # Get spike information
@@ -215,7 +224,7 @@ module RailsErrorDashboard
       def spike_info
         return nil unless spike_detected?
 
-        today_count = event_count_since(Time.current.beginning_of_day)
+        today_count = today_event_count
         avg_count = (errors_trend_7d.values.sum / 7.0).round(1)
 
         info = {
@@ -226,46 +235,35 @@ module RailsErrorDashboard
         }
 
         # Add baseline info if available
-        baseline_info = baseline_anomaly_info(today_count)
+        baseline_info = baseline_anomaly_info
         info.merge!(baseline_info) if baseline_info.present?
 
         info
       end
 
-      # Check if baseline indicates anomaly
-      def baseline_anomaly_detected?(_count)
-        return false unless defined?(Queries::BaselineStats)
+      def today_event_count
+        @today_event_count ||= event_count_since(Time.current.beginning_of_day)
+      end
+
+      # Every anomalous (error_type, platform) pair, from a fixed number of
+      # queries (BaselineStats.current_anomalies), loaded once per call. This
+      # used to be about six queries per distinct pair, run twice.
+      def baseline_anomalies
+        return @baseline_anomalies if defined?(@baseline_anomalies)
 
-        # Check most common error types for anomalies
-        base_scope.distinct.pluck(:error_type, :platform).compact.any? do |(error_type, platform)|
-          Queries::BaselineStats.new(error_type, platform)
-                                .check_current_anomaly(sensitivity: 2, application_id: @application_id)[:anomaly]
+        @baseline_anomalies = if defined?(Queries::BaselineStats)
+          Queries::BaselineStats.current_anomalies(sensitivity: 2, application_id: @application_id)
+        else
+          []
         end
       end
 
       # Get baseline anomaly information
-      def baseline_anomaly_info(_total_count)
-        return nil unless defined?(Queries::BaselineStats)
-
-        # Find the most anomalous error type
-        anomalies = base_scope.distinct.pluck(:error_type, :platform).compact.map do |(error_type, platform)|
-          result = Queries::BaselineStats.new(error_type, platform)
-                                         .check_current_anomaly(sensitivity: 2, application_id: @application_id)
-          next unless result[:anomaly]
-
-          {
-            error_type: error_type,
-            platform: platform,
-            count: result[:current_count],
-            level: result[:level],
-            std_devs_above: result[:std_devs_above]
-          }
-        end.compact
-
-        return nil if anomalies.empty?
+      def baseline_anomaly_info
+        return nil if baseline_anomalies.empty?
 
         # Return info about worst anomaly
-        worst = anomalies.max_by { |a| a[:std_devs_above] || 0 }
+        worst = baseline_anomalies.max_by { |a| a[:std_devs_above] || 0 }
         {
           baseline_detected: true,
           anomaly_error_type: worst[:error_type],
@@ -283,7 +281,7 @@ module RailsErrorDashboard
       # make a real failure percentage from, so the honest figure is the rate
       # itself, uncapped, labelled with its unit.
       def error_rate
-        today_events = event_count_since(Time.current.beginning_of_day)
+        today_events = today_event_count
         return 0.0 if today_events.zero?
 
         hours_today = ((Time.current - Time.current.beginning_of_day) / 1.hour).round(1)
@@ -299,11 +297,12 @@ module RailsErrorDashboard
       # affected user. Storm count-only events create no occurrence row, so
       # this is a floor during a storm -- affected_users_incomplete? says when.
       def affected_users_today
-        distinct_affected_users(Time.current.beginning_of_day, nil)
+        @affected_users_today ||= distinct_affected_users(Time.current.beginning_of_day, nil)
       end
 
       def affected_users_yesterday
-        distinct_affected_users(1.day.ago.beginning_of_day, Time.current.beginning_of_day)
+        @affected_users_yesterday ||=
+          distinct_affected_users(1.day.ago.beginning_of_day, Time.current.beginning_of_day)
       end
 
       def distinct_affected_users(from, to)
@@ -334,7 +333,13 @@ module RailsErrorDashboard
 
       # Calculate percentage change in errors (today vs yesterday)
       def trend_percentage
-        today = event_count_since(Time.current.beginning_of_day)
+        return @trend_percentage if defined?(@trend_percentage)
+
+        @trend_percentage = compute_trend_percentage
+      end
+
+      def compute_trend_percentage
+        today = today_event_count
         yesterday = event_count_between(1.day.ago.beginning_of_day, Time.current.beginning_of_day)
 
         return 0.0 if today.zero? && yesterday.zero?

data/lib/rails_error_dashboard/queries/error_correlation.rb

@@ -224,12 +224,15 @@ module RailsErrorDashboard
         previous_start = @start_date
         previous_end = current_start
 
-        current_errors = ErrorLog
+        # Both periods come from base_query, which carries the application
+        # filter (and the window start). Querying ErrorLog directly made this
+        # the one panel on an application-filtered page that counted every app.
+        current_errors = base_query
           .where("occurred_at >= ?", current_start)
           .count
 
-        previous_errors = ErrorLog
-          .where("occurred_at >= ? AND occurred_at < ?", previous_start, previous_end)
+        previous_errors = base_query
+          .where("occurred_at < ?", previous_end)
           .count
 
         change_percentage = if previous_errors > 0

data/lib/rails_error_dashboard/queries/errors_list.rb

@@ -5,6 +5,9 @@ module RailsErrorDashboard
     # Query: Fetch errors with filtering and pagination
     # This is a read operation that returns a filtered collection of errors
     class ErrorsList
+      # Escape character for LIKE patterns; see filter_by_search.
+      LIKE_ESCAPE = "!"
+
       def self.call(filters = {})
         new(filters).call
       end
@@ -129,9 +132,19 @@ module RailsErrorDashboard
         else
           # Fall back to LIKE for SQLite/MySQL - search across all relevant fields
           # Use LOWER() for case-insensitive search
-          search_pattern = "%#{@filters[:search]}%"
+          #
+          # % and _ in the term are escaped so they match themselves: a search
+          # for "snake_case" must not match "snakeXcase", and "%" must not
+          # match every row. The escape character is named explicitly because
+          # SQLite has no default one, and it is "!" rather than a backslash
+          # because a backslash inside a quoted SQL literal means different
+          # things to MySQL and to everyone else.
+          escaped = ActiveRecord::Base.sanitize_sql_like(@filters[:search].to_s, LIKE_ESCAPE)
+          search_pattern = "%#{escaped}%"
           query.where(
-            "LOWER(message) LIKE LOWER(?) OR LOWER(COALESCE(backtrace, '')) LIKE LOWER(?) OR LOWER(error_type) LIKE LOWER(?)",
+            "LOWER(message) LIKE LOWER(?) ESCAPE '#{LIKE_ESCAPE}' " \
+            "OR LOWER(COALESCE(backtrace, '')) LIKE LOWER(?) ESCAPE '#{LIKE_ESCAPE}' " \
+            "OR LOWER(error_type) LIKE LOWER(?) ESCAPE '#{LIKE_ESCAPE}'",
             search_pattern, search_pattern, search_pattern
           )
         end

data/lib/rails_error_dashboard/queries/similar_errors.rb

@@ -78,7 +78,7 @@ module RailsErrorDashboard
           if error_prefix.present?
             candidates += ErrorLog
                             .where(platform: target_error.platform)
-                            .where("error_type LIKE ?", "%#{error_prefix}%")
+                            .where("error_type LIKE ? ESCAPE '!'", "%#{ActiveRecord::Base.sanitize_sql_like(error_prefix, "!")}%")
                             .where.not(id: target_error.id)
                             .where.not(id: candidates.map(&:id))
                             .limit(20)

data/lib/rails_error_dashboard/services/analytics_cache_manager.rb

@@ -2,29 +2,54 @@
 
 module RailsErrorDashboard
   module Services
-    # Infrastructure service: Clear analytics caches
+    # Infrastructure service: invalidate the dashboard's cached statistics
     #
-    # Clears dashboard_stats, analytics_stats, and platform_comparison
-    # cache entries. Handles cache stores that don't support delete_matched
-    # (e.g., SolidCache) gracefully.
+    # Every cached stats key (DashboardStats, AnalyticsStats) embeds a
+    # GENERATION number read from Rails.cache. Invalidation is one increment of
+    # that number: entries written under the old generation are simply never
+    # read again and age out by their own TTL.
+    #
+    # This replaced delete_matched("dashboard_stats/*") and friends, which is a
+    # SCAN of the HOST app's whole Redis keyspace, NotImplementedError on
+    # memcached, and used to run from ErrorLog's after_save -- i.e. inside the
+    # host's request thread on every captured error.
+    #
+    # Who calls .clear: user actions and maintenance that change what the cards
+    # show (resolve, status change, batch actions, mute, retention). Captures
+    # deliberately do NOT: they rely on the TTL (1 minute for the stat cards,
+    # 5 for analytics), which decouples capture cost from dashboard freshness.
+    #
+    # With :memory_store the generation is per process, so an action handled by
+    # one worker reaches the others when their entries expire. With :null_store
+    # nothing is cached and there is nothing to invalidate.
     class AnalyticsCacheManager
-      CACHE_PATTERNS = %w[
-        dashboard_stats/*
-        analytics_stats/*
-        platform_comparison/*
-      ].freeze
+      GENERATION_KEY = "red/cache_gen"
+
+      # @return [Integer] the current cache generation; 0 when unset or unreadable
+      def self.generation
+        Rails.cache.read(GENERATION_KEY).to_i
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] cache generation unreadable: #{e.class}: #{e.message}")
+        0
+      end
 
-      # Clear all analytics caches
+      # Invalidate every cached dashboard statistic. Never raises.
+      #
+      # A plain read + write, deliberately not Rails.cache.increment: increment
+      # is unimplemented on some stores, returns nil for a missing key on
+      # others, and on Redis is an INCRBY that fails against an entry written
+      # by #write. It does not need to be atomic either -- racing clears only
+      # need the number to differ from the one stale entries were written under.
+      #
+      # Never lower than the clock in milliseconds, so that a store which evicts
+      # the generation key cannot restart at a number that entries still inside
+      # their TTL were written under a few minutes earlier.
       def self.clear
-        if Rails.cache.respond_to?(:delete_matched)
-          CACHE_PATTERNS.each { |pattern| Rails.cache.delete_matched(pattern) }
-        else
-          Rails.logger.info("Cache store doesn't support delete_matched, skipping cache clear") if Rails.logger
-        end
-      rescue NotImplementedError => e
-        Rails.logger.info("Cache store doesn't support delete_matched: #{e.message}") if Rails.logger
+        Rails.cache.write(GENERATION_KEY, [ generation + 1, (Time.now.to_f * 1000).to_i ].max)
+        nil
       rescue => e
-        Rails.logger.error("Failed to clear analytics cache: #{e.message}") if Rails.logger
+        RailsErrorDashboard::Logger.error("[RailsErrorDashboard] Failed to clear analytics cache: #{e.class}: #{e.message}")
+        nil
       end
     end
   end

data/lib/rails_error_dashboard/services/backtrace_processor.rb

@@ -22,7 +22,9 @@ module RailsErrorDashboard
 
         max_lines ||= RailsErrorDashboard.configuration.max_backtrace_lines
 
-        limited_backtrace = backtrace.first(max_lines).map { |line| shorten_gem_path(line) }
+        # Scrubbed per line: a frame label can hold any bytes, and both the sub
+        # below and the join (mixed encodings) raise on an invalid one.
+        limited_backtrace = backtrace.first(max_lines).map { |line| shorten_gem_path(EncodingSanitizer.scrub(line)) }
         result = limited_backtrace.join("\n")
 
         if backtrace.length > max_lines

data/lib/rails_error_dashboard/services/cause_chain_extractor.rb

@@ -43,7 +43,9 @@ module RailsErrorDashboard
           depth += 1
         end
 
-        chain.empty? ? nil : chain.to_json
+        # to_json raises on a cause message or frame with invalid bytes, which
+        # used to drop the whole chain.
+        chain.empty? ? nil : EncodingSanitizer.scrub_deep(chain).to_json
       rescue => e
         # SAFETY: Never let cause chain extraction break error logging
         RailsErrorDashboard::Logger.debug(

data/lib/rails_error_dashboard/services/codeberg_issue_client.rb

@@ -40,7 +40,7 @@ module RailsErrorDashboard
           auth_headers
         )
 
-        response[:status] == 201 ? success_response({}) : error_response("Codeberg API error (#{response[:status]})")
+        patch_result(response)
       end
 
       def reopen_issue(number:)
@@ -50,7 +50,7 @@ module RailsErrorDashboard
           auth_headers
         )
 
-        response[:status] == 201 ? success_response({}) : error_response("Codeberg API error (#{response[:status]})")
+        patch_result(response)
       end
 
       def add_comment(number:, body:)
@@ -114,6 +114,17 @@ module RailsErrorDashboard
 
       private
 
+      # Gitea/Forgejo answer a successful PATCH with 200; 201 is what they
+      # return for creation. Accepting only 201 reported every close and reopen
+      # as failed although the forge had applied it.
+      def patch_result(response)
+        if [ 200, 201 ].include?(response[:status])
+          success_response({})
+        else
+          error_response("Codeberg API error (#{response[:status]})")
+        end
+      end
+
       def auth_headers
         { "Authorization" => "token #{@token}" }
       end

data/lib/rails_error_dashboard/services/diagnostic_dump_generator.rb

@@ -27,7 +27,9 @@ module RailsErrorDashboard
       end
 
       def call
-        {
+        # Thread names and breadcrumb text are arbitrary bytes; both callers
+        # immediately to_json this, which raises on an invalid one.
+        EncodingSanitizer.scrub_deep(
           captured_at: Time.current.iso8601,
           pid: Process.pid,
           uptime_seconds: process_uptime,
@@ -37,9 +39,9 @@ module RailsErrorDashboard
           threads: thread_info,
           gc: gc_info,
           object_counts: object_counts
-        }
+        )
       rescue => e
-        { captured_at: Time.current.iso8601, error: e.message }
+        { captured_at: Time.current.iso8601, error: EncodingSanitizer.scrub(e.message) }
       end
 
       private

data/lib/rails_error_dashboard/services/encoding_sanitizer.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module RailsErrorDashboard
+  module Services
+    # Pure algorithm: make every String in a value safe to store, serialize and render
+    #
+    # Exception messages, backtrace lines, request URLs, user agents and params can
+    # carry bytes that are not valid UTF-8 (a binary upload echoed in a message, a
+    # Latin-1 query string, a NUL from a fuzzer). Left alone they raise at the
+    # worst possible moments: ActiveJob JSON-encoding the async payload in the
+    # host's request thread, the PostgreSQL INSERT, or `blank?` while rendering the
+    # error's own page.
+    #
+    # Invalid sequences become "?" and NUL bytes are removed (PostgreSQL text
+    # columns reject them). Strings tagged ASCII-8BIT (or any other encoding) are
+    # re-tagged UTF-8 and then scrubbed — not transcoded, because a binary tag
+    # says nothing about what the bytes mean and transcoding would raise.
+    #
+    # The common case costs one `valid_encoding?` scan and returns the SAME
+    # object. Nothing here raises, and the caller's objects are never mutated.
+    #
+    # @example
+    #   EncodingSanitizer.scrub("caf\xC3 \xFF".b)          # => "caf? ?"
+    #   EncodingSanitizer.scrub_deep({ url: "/?q=\xFF" })   # => { url: "/?q=?" }
+    class EncodingSanitizer
+      REPLACEMENT = "?"
+      UNREADABLE = "[unreadable]"
+      TOO_DEEP = "[truncated: nested too deep]"
+      MAX_DEPTH = 10
+      NUL = "\0"
+
+      # @param str [Object] anything; only Strings are touched
+      # @return [Object] the same object when already clean, otherwise a clean copy
+      def self.scrub(str)
+        return str unless String === str
+
+        s = str.encoding == Encoding::UTF_8 ? str : str.dup.force_encoding(Encoding::UTF_8)
+        return s if s.valid_encoding? && !s.include?(NUL)
+
+        s = s.scrub(REPLACEMENT) unless s.valid_encoding?
+        s.delete(NUL)
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] EncodingSanitizer.scrub failed: #{e.class}")
+        UNREADABLE
+      end
+
+      # Recursively scrub Strings inside Hashes (keys and values) and Arrays.
+      # Anything else is returned untouched. A container nested deeper than
+      # MAX_DEPTH is replaced by a placeholder rather than passed through: an
+      # unscrubbed subtree would defeat the point, and a self-referencing one
+      # would never end.
+      #
+      # @param obj [Object]
+      # @return [Object]
+      def self.scrub_deep(obj, depth = 0)
+        case obj
+        when String
+          scrub(obj)
+        when Hash
+          return TOO_DEEP if depth >= MAX_DEPTH
+
+          # Build into an empty copy of the same class so a
+          # HashWithIndifferentAccess stays one.
+          obj.each_with_object(obj.class.new) do |(key, value), result|
+            result[scrub_deep(key, depth + 1)] = scrub_deep(value, depth + 1)
+          end
+        when Array
+          return TOO_DEEP if depth >= MAX_DEPTH
+
+          obj.map { |value| scrub_deep(value, depth + 1) }
+        else
+          obj
+        end
+      rescue => e
+        RailsErrorDashboard::Logger.debug("[RailsErrorDashboard] EncodingSanitizer.scrub_deep failed: #{e.class}")
+        String === obj ? UNREADABLE : obj
+      end
+    end
+  end
+end