Merge branch 'develop' into fix/deno-tracing-gate

Author: isaacs

.cursor/BUGBOT.md

@@ -68,6 +68,11 @@ Keep reviews high-signal. Prefer actionable, high-confidence findings over specu
   - `consoleSandbox(() => { console.warn(...) })` for intentional user-facing warnings (e.g. init-time misconfiguration messages). The `consoleSandbox` wrapper prevents the SDK's own console instrumentation from intercepting the call. Bare `console.*` calls outside very early init paths (e.g. before the logger is available) should be flagged.
 - Flag `url.full`, `url.query`, `http.target` or `request.query_string` being set from a URL that isn't filtered. Wrap the value in `filterCollectedUrl()` (or `filterCollectedUrlQuery()` for a bare query string), passing the `client` if one is in scope, so `dataCollection.urlQueryParams` applies. Values that can't contain a query (a bare pathname, a queue URL) are fine. The `sdk/no-unfiltered-url-attributes` lint rule catches direct attribute writes, so look for what it can't: URLs passed through a helper or variable first, deprecated aliases set next to a filtered attribute, and URLs on breadcrumbs or events instead of spans.
 - Flag span names built from a raw URL. Names follow `METHOD scheme://host/path` and must never contain a query string, so they need `stripUrlQueryAndFragment()`, not `filterCollectedUrl()`.
+- Flag a SQL statement that reaches telemetry unsanitized. `db.query.text`, `db.query.summary`, a DB span name, and a breadcrumb carrying a statement all have to come from `sanitizeSqlQuery()` or `sanitizeSqlQueryWithSummary()` (`@sentry/server-utils`). Inline literals are user data, and OTel allows collecting query text only once they are replaced with `?`. This is deliberately not gated on `dataCollection.databaseQueryData`, which does not cover query text.
+  - Cover every place the statement lands, not only the span attribute. The two that get forgotten are the breadcrumb beside the span and the span name used when span streaming is off.
+  - Sanitize each statement of a batch before joining them.
+  - Pass the dialect. `toSqlDialect()` maps a driver or `db.system.name` value to one, and a missing dialect leaves MySQL and SQL Server values in the statement.
+  - Leave Redis command text alone. It is not SQL and has its own redaction path.
 - Flag usage of the following APIs: `getCurrentScope()`, `getIsolationScope()`, `getClient()` if they are avoidable. Flag it with severity Low and acknowledge from the start that this is more a "is this necessary" check, rather than a rule violation.
   - Reason for flagging: Usage of these APIs is problematic for multi-client setups where either there is no "current" client/scope, or the wrong client might be used. Calling these APIs would create a current scope, thereby misleading any future calls to these APIs.
   - What to do instead: Use an existing reference to the scope or client. For example, this is possible in most `Integration` hooks.

dev-packages/cloudflare-integration-tests/suites/prisma/test.ts

@@ -55,9 +55,9 @@ it('captures a transaction with Prisma spans for a D1 query via the @sentry/clou
             origin: 'auto.db.cloudflare.d1',
           },
           {
-            description: expect.stringMatching(
-              /^SELECT `main`\.`User`\.`id`, `main`\.`User`\.`email`, `main`\.`User`\.`name` FROM `main`\.`User` WHERE 1=1 LIMIT \? OFFSET \? \/\* traceparent='00-[\da-f]{32}-[\da-f]{16}-01' \*\/$/,
-            ),
+            // The sanitizer strips the D1 adapter's traceparent comment and replaces the literals.
+            description:
+              'SELECT `main`.`User`.`id`, `main`.`User`.`email`, `main`.`User`.`name` FROM `main`.`User` WHERE ?=? LIMIT ? OFFSET ?',
             op: 'db.query',
             origin: 'auto.db.cloudflare.d1',
           },

dev-packages/deno-integration-tests/suites/orchestrion-mysql/test.ts

@@ -93,9 +93,9 @@ Deno.test('mysql instrumentation: orchestrion:mysql:query channel produces a nes
 
   const mysqlSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(mysqlSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(mysqlSpan!.description, 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.description, 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['db.system.name'], 'mysql');
-  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['server.address'], '127.0.0.1');
   assertEquals(mysqlSpan!.data?.['server.port'], 3306);
   assertEquals(mysqlSpan!.data?.['db.user'], 'root');

dev-packages/deno-integration-tests/suites/orchestrion-mysql2/test.ts

@@ -54,9 +54,9 @@ Deno.test('mysql2 instrumentation: orchestrion:mysql2:query channel produces a n
 
   const mysqlSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(mysqlSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(mysqlSpan!.description, 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.description, 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['db.system.name'], 'mysql');
-  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['db.namespace'], 'mydb');
   assertEquals(mysqlSpan!.data?.['db.user'], 'root');
   assertEquals(mysqlSpan!.data?.['server.address'], '127.0.0.1');

dev-packages/deno-integration-tests/suites/orchestrion-postgres/test.ts

@@ -93,9 +93,9 @@ Deno.test('pg instrumentation: orchestrion:pg:query channel produces a nested db
 
   const pgSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(pgSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(pgSpan!.description, 'SELECT 1 AS solution');
+  assertEquals(pgSpan!.description, 'SELECT ? AS solution');
   assertEquals(pgSpan!.data?.['db.system.name'], 'postgresql');
-  assertEquals(pgSpan!.data?.['db.query.text'], 'SELECT 1 AS solution');
+  assertEquals(pgSpan!.data?.['db.query.text'], 'SELECT ? AS solution');
   assertEquals(pgSpan!.data?.['server.address'], '127.0.0.1');
   assertEquals(pgSpan!.data?.['server.port'], 5432);
   assertEquals(pgSpan!.data?.['db.user'], 'root');

dev-packages/deno-integration-tests/suites/orchestrion-tedious/test.ts

@@ -57,11 +57,11 @@ Deno.test('tedious instrumentation: orchestrion:tedious:execSql channel produces
 
   const tediousSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(tediousSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(tediousSpan!.description, 'SELECT 1');
+  assertEquals(tediousSpan!.description, 'SELECT ?');
   assertEquals(tediousSpan!.data?.['db.system.name'], 'mssql');
   assertEquals(tediousSpan!.data?.['db.namespace'], 'mydb');
   assertEquals(tediousSpan!.data?.['db.user'], 'sa');
-  assertEquals(tediousSpan!.data?.['db.query.text'], 'SELECT 1');
+  assertEquals(tediousSpan!.data?.['db.query.text'], 'SELECT ?');
   assertEquals(tediousSpan!.data?.['server.address'], '127.0.0.1');
   assertEquals(tediousSpan!.data?.['server.port'], 1433);
   assertEquals(tediousSpan!.data?.['sentry.origin'], 'auto.db.tedious');

dev-packages/e2e-tests/test-applications/astro-6-cf-workers/tests/db.test.ts

@@ -12,14 +12,14 @@ test('a real mysql query emits a db span with orchestrion-channel attributes', a
   const spans = await spansPromise;
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   // With span streaming the span name is the low-cardinality query summary; the statement stays in
   // `db.query.text`.
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes['sentry.origin']?.value).toBe('auto.db.mysql');
   expect(firstQuery!.attributes['db.system.name']?.value).toBe('mysql');
-  expect(firstQuery!.attributes['db.query.text']?.value).toBe('SELECT 1 + 1 AS solution');
+  expect(firstQuery!.attributes['db.query.text']?.value).toBe('SELECT ? + ? AS solution');
   expect(firstQuery!.attributes['server.address']?.value).toBe('127.0.0.1');
   expect(firstQuery!.attributes['server.port']?.value).toBe(3306);
   expect(firstQuery!.attributes['db.user']?.value).toBe('root');
@@ -35,6 +35,6 @@ test('a nested query lands on the same trace (async context restored)', async ({
   const queryTexts = spans
     .filter(span => getSpanOp(span) === 'db')
     .map(span => span.attributes['db.query.text']?.value);
-  expect(queryTexts).toContain('SELECT 1 + 1 AS solution');
+  expect(queryTexts).toContain('SELECT ? + ? AS solution');
   expect(queryTexts).toContain('SELECT NOW()');
 });

dev-packages/e2e-tests/test-applications/astro-7-static/tests/db.test.ts

@@ -58,11 +58,11 @@ test('Instruments mysql automatically', async ({ baseURL }) => {
     expect.objectContaining({
       op: 'db',
       origin: 'auto.db.mysql',
-      description: 'SELECT 1 + 1 AS solution',
+      description: 'SELECT ? + ? AS solution',
       status: 'ok',
       data: expect.objectContaining({
         'db.system.name': 'mysql',
-        'db.query.text': 'SELECT 1 + 1 AS solution',
+        'db.query.text': 'SELECT ? + ? AS solution',
         'db.user': 'root',
         'db.connection_string': expect.any(String),
         'server.address': expect.any(String),

dev-packages/e2e-tests/test-applications/astro-7/tests/db.test.ts

@@ -62,6 +62,6 @@ test('Instruments mysql automatically', async ({ baseURL }) => {
       }),
     });
 
-  expect(mysqlSpans).toContainEqual(expectedQuerySpan('SELECT 1 + 1 AS solution'));
+  expect(mysqlSpans).toContainEqual(expectedQuerySpan('SELECT ? + ? AS solution'));
   expect(mysqlSpans).toContainEqual(expectedQuerySpan('SELECT NOW()'));
 });

dev-packages/e2e-tests/test-applications/bun-mysql/tests/mysql.test.ts

@@ -25,14 +25,14 @@ test('mysql queries emit a db span with orchestrion-channel attributes', async (
   const spans = await spansPromise;
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   // With span streaming, db span names are the low-cardinality query summary, not the raw SQL
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes).toMatchObject({
     'sentry.origin': { value: 'auto.db.mysql', type: 'string' },
     'db.system.name': { value: 'mysql', type: 'string' },
-    'db.query.text': { value: 'SELECT 1 + 1 AS solution', type: 'string' },
+    'db.query.text': { value: 'SELECT ? + ? AS solution', type: 'string' },
     'server.port': { value: 3306, type: 'integer' },
     'db.user': { value: 'root', type: 'string' },
   });
@@ -58,7 +58,7 @@ test('a nested query lands on the same trace (async context restored)', async ({
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
   const queries = dbSpans.map(span => span.attributes['db.query.text']?.value);
-  expect(queries).toContain('SELECT 1 + 1 AS solution');
+  expect(queries).toContain('SELECT ? + ? AS solution');
   expect(queries).toContain('SELECT NOW()');
   expect(dbSpans.every(span => span.parent_span_id === segment.span_id)).toBe(true);
 });