getsentry / getsentry/sentry-java

feat(database): Capture query data behind dataCollection

オープン
#6,021 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
Feature Java Platform: Java Spans
主要言語
Kotlin
スター
1.4k
フォーク
478
平均マージ
2日 23時間
マージ済み PR(30日)
67

説明

## Problem

The Java SDK exposes `dataCollection.databaseQueryData`, but the current first-party database integrations do not collect any of the value-bearing data controlled by that option:

- JDBC records the original statement text through P6Spy's `StatementInformation.getSql()`, not bound parameter values.
- Android SQLite receives bind arguments but does not attach them to spans.
- Neither integration captures write payloads or returned result data.

As a result, `databaseQueryData` currently has no production consumer in these integrations.

Sanitized or parameterized `db.query.text`, `db.query.summary`, and structural database metadata are intentionally outside this option and should continue to be collected independently.

## Proposal

In the next major version, add source-time collection of supported database query data and guard it with `dataCollection.databaseQueryData`.

Start with the value-bearing data already available to first-party instrumentation:

- JDBC prepared/callable statement bind values, where P6Spy exposes them safely.
- Android SQLite bind arguments in the SupportSQLite and SQLiteDriver integrations.

Evaluate write-operation payloads and returned result data separately; only add them where useful, bounded, and supported by established Sentry span conventions.

## Requirements

- Apply the policy when first-party instrumentation writes the data, not later during serialization or export.
- Do not put bound values into span descriptions, span names, `db.query.text`, or `db.query.summary`.
- Use standardized structured span attributes for parameters where available, such as `db.query.parameter.`.
- `databaseQueryData=false` must prevent value-bearing query data from being attached.
- Query text must remain sanitized/parameterized independently of this option.
- Add size/count limits and fail-closed handling for unsupported or malformed values.
- Preserve explicitly supplied customer span data.
- Add tests for enabled/disabled behavior, positional and named parameters, null/binary/large values, batch operations, and Android bind arguments.
- Document which integrations and database data categories are supported.

## Related

- Data Collection specification: `databaseQueryData` controls bound query parameters, write-operation payloads, and returned result data.
- SQL sanitization and `db.query.summary` generation are separate concerns and should not be made conditional on this option.

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

Start at the JDBC P6Spy StatementInformation.getSql() path and the Android SupportSQLite and SQLiteDriver integrations, tracing where databaseQueryData is available. Use the listed enabled/disabled, parameter-shape, size, batch, and Android bind-argument cases to define coverage; done means bounded source-time collection without changing sanitized query fields, plus documentation of supported categories.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
android, java, sqlite
領域
databases, mobile
issue の種類
機能追加
難易度
5/5
見積もり時間
1週間以上
活発さ
活発
明瞭さ
おおむね明確
初心者へのやさしさ
35/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。