getsentry / getsentry/sentry-javascript
Follow-up: SQL dialect and qualified table names in db.query.summary
- Dominant language
- TypeScript
- Stars
- 8.7k
- Forks
- 1.8k
- Avg merge
- 1d 17h
- Merged PRs (30d)
- 515
Description
Follow-ups for db span names that can only be done once the other PRs in the stack have landed. Tracking them here so they don't get lost.
### 1. Pass the SQL dialect when sanitizing
#23659 adds a `dialect` param to `sanitizeSqlQuery` (`'standard' | 'mysql'`), because `"..."` is a string literal in MySQL rather than a quoted identifier, and `\` escapes. It updates `mysql.ts` and `mysql2/`, but not knex — knex is ported in a different PR and sanitizes before summarizing without passing a dialect, so a `knex.raw()` statement with an inlined literal on the `mysql`/`mysql2` client can leak a value into `db.query.summary`.
The dialect is available at the call site: `client.driverName` is already read there for `db.system.name` (`packages/server-utils/src/integrations/knex.ts`). Only `mysql`/`mysql2` map to `'mysql'`; pg, sqlite3, mssql and oracledb are all `'standard'`.
Worth checking the prisma tracing helper for the same thing — it's multi-connector and also sanitizes with the default.
### 2. `getSqlQuerySummary` truncates schema-qualified quoted tables
`QUOTED_OR_PLAIN_TABLE_RE` in `packages/core/src/utils/sql.ts` matches the first quoted identifier and stops, while the INSERT/UPDATE/DELETE/DDL branches use `TABLE_NAME` and keep the whole qualified name:
```
SELECT ... FROM "public"."User" -> SELECT "public"
DELETE FROM "public"."User" -> DELETE "public"."User"
SELECT ... FROM "public"."A" JOIN "public"."B" -> SELECT "public" "public"
```
Pre-existing — it already affects `db.query.summary` for postgres/postgresjs — but the db span-name work promotes the value into span names, where the JOIN case makes two different tables indistinguishable.
### 3. Update the test expectations that encode #2
The prisma v5/v6/v7 node integration tests currently assert `SELECT "public"` as both the summary and the streamed span name.
Part of getsentry/sentry-javascript#22350. Blocked on #23659 and the rest of the db span name stack landing.
Contributor guide
Assessment
This issue has not been assessed yet.