Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SqlClient] Sanitize SQL query text #2446

Open
wants to merge 5 commits into
base: main
Choose a base branch
from

Conversation

alanwest
Copy link
Member

Fixes #2221

Performs sanitization of SQL text. First 1000 results are cached. This number is arbitrary. I do not wish to make it configurable yet in this PR though I'm open to choosing a different arbitrary number.

@alanwest alanwest requested a review from a team as a code owner December 23, 2024 18:37
@github-actions github-actions bot added the comp:instrumentation.sqlclient Things related to OpenTelemetry.Instrumentation.SqlClient label Dec 23, 2024
@@ -123,12 +123,13 @@ This instrumentation can be configured to change the default behavior by using

### SetDbStatementForText

Capturing the text of a database query may run the risk of capturing sensitive data.
`SetDbStatementForText` controls whether the
The text of a database query may include sensitive data. `SetDbStatementForText`
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm finding this whole block a bit confusing. Took a stab at rewriting it:

SetDbStatementForText controls whether the db.statement attribute is emitted for instrument SqlCommands. The behavior of SetDbStatementForText depends on the runtime used, see below for more details.

Query text may contain sensitive data so when SetDbStatementForText is enabled the raw query text is sanitized by automatically replacing literal values with a ? character.

Copy link
Member

@CodeBlanch CodeBlanch left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One comment but LGTM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
comp:instrumentation.sqlclient Things related to OpenTelemetry.Instrumentation.SqlClient
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[sql] Add option to sanitize db.query.text
2 participants