-
-
Notifications
You must be signed in to change notification settings - Fork 1.8k
feat(server-utils): Emit low cardinality mysql db span names #23601
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: develop
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,13 +2,17 @@ import type { TracingChannel } from 'node:diagnostics_channel'; | |
| import { | ||
| DB_NAMESPACE, | ||
| DB_OPERATION_NAME, | ||
| DB_QUERY_SUMMARY, | ||
| DB_QUERY_TEXT, | ||
| DB_SYSTEM_NAME, | ||
| SERVER_ADDRESS, | ||
| SERVER_PORT, | ||
| } from '@sentry/conventions/attributes'; | ||
| import { | ||
| _INTERNAL_getSqlQuerySummary, | ||
| _INTERNAL_sanitizeSqlQuery, | ||
| getClient, | ||
| hasSpanStreamingEnabled, | ||
| SEMANTIC_ATTRIBUTE_SENTRY_OP, | ||
| SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN, | ||
| startInactiveSpan, | ||
|
|
@@ -100,14 +104,22 @@ function setupQueryChannel(tracingChannel: MySQL2TracingChannelFactory, channelN | |
| // literal before it leaves the process; `values` is never attached. | ||
| const queryText = data.query ? _INTERNAL_sanitizeSqlQuery(data.query) : undefined; | ||
| const operation = queryText?.match(SQL_OPERATION_RE)?.[1]?.toUpperCase(); | ||
| const querySummary = _INTERNAL_getSqlQuerySummary(queryText); | ||
|
|
||
| const client = getClient(); | ||
| const streamedName = | ||
| client && hasSpanStreamingEnabled(client) | ||
| ? querySummary || data.database || DB_SYSTEM_NAME_VALUE_MYSQL | ||
| : queryText || 'mysql2.query'; | ||
|
|
||
| return startInactiveSpan({ | ||
| name: queryText || 'mysql2.query', | ||
| name: streamedName, | ||
| attributes: { | ||
| [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: ORIGIN, | ||
| [SEMANTIC_ATTRIBUTE_SENTRY_OP]: 'db', | ||
| [DB_SYSTEM_NAME]: DB_SYSTEM_NAME_VALUE_MYSQL, | ||
| [DB_QUERY_TEXT]: queryText, | ||
| [DB_QUERY_SUMMARY]: querySummary, | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. MySQL escapes leak into summariesMedium Severity Summaries are built after Additional Locations (2)Reviewed by Cursor Bugbot for commit f7c6bc0. Configure here.
Member
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. might be an issue but a broader one than this change. I wanna look into this separately. |
||
| [DB_OPERATION_NAME]: operation, | ||
| [DB_NAMESPACE]: data.database || undefined, | ||
| [SERVER_ADDRESS]: data.serverAddress, | ||
|
|
||


There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
MySQL literals can leak into summaries
Medium Severity
_INTERNAL_sanitizeSqlQueryonly strips single-quoted literals, but MySQL treats double-quoted values as strings unlessANSI_QUOTESis on, and also allows backslash escapes. A user value containingfromorjoincan therefore survive sanitization and land indb.query.summaryand streamed span names, which this change presents as low-cardinality and leak-free.Additional Locations (2)
packages/server-utils/src/integrations/mysql2/index.ts#L87-L90packages/server-utils/src/integrations/mysql2/mysql2-dc-subscriber.ts#L107-L110Reviewed by Cursor Bugbot for commit 58cd60c. Configure here.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
fixed in #23659