Skip to content

fix(server-utils): Pass the SQL dialect when summarizing Prisma queries - #23854

Open
Lms24 wants to merge 2 commits into
lms/feat-server-utils-low-card-db-span-names3from
lms/fix-prisma-sql-dialect-and-qualified-table-names
Open

fix(server-utils): Pass the SQL dialect when summarizing Prisma queries#23854
Lms24 wants to merge 2 commits into
lms/feat-server-utils-low-card-db-span-names3from
lms/fix-prisma-sql-dialect-and-qualified-table-names

Conversation

@Lms24

@Lms24 Lms24 commented Sep 1, 2026

Copy link
Copy Markdown
Member

Prisma talks to Postgres, MySQL, SQLite and others, but sanitized every statement as standard SQL. In MySQL, "..." is a string literal, not a quoted identifier, so the value was never replaced with ?. If it contained FROM or JOIN, the summary parser then read it as a table name — and with span streaming, that summary is the span name.

A MySQL query with an inlined value: SELECT * FROM User WHERE bio = "x FROM secret_table"

Before After
db.query.text SELECT * FROM User WHERE bio = "x FROM secret_table" SELECT * FROM User WHERE bio = ?
db.query.summary SELECT User secret_table SELECT User

The dialect comes from the db.system.name / db.system Prisma already reports, same as knex does in the base PR. Postgres is unaffected — there "..." really is an identifier, and its values arrive as '...', which was already being replaced.

Also updates the Prisma test expectations to the qualified table names from #23853.

Stacked on #23602, and carries the commit from #23853 because those updated expectations only pass with it. Merge order: #23853#23602 → this.

Refs #23676

Lms24 and others added 2 commits September 1, 2026 16:33
`getSqlQuerySummary` matched a quoted table reference with a regex that stopped
after the first quoted identifier, so a schema-qualified name lost its table part
(`SELECT ... FROM "public"."User"` summarized as `SELECT "public"`) and a JOIN of
two tables in the same schema collapsed into two identical targets. The
INSERT/UPDATE/DELETE/DDL branches used a different, whitespace-delimited pattern
that kept the qualified name but split any quoted identifier containing a space
(`INSERT INTO "my table"` summarized as `INSERT "my`).

Both branches now build on one identifier pattern that treats each quoted or bare
part as a unit and allows dot-qualification. This matters more now that the value
is promoted into span names, where two tables that differ only by table part are
otherwise indistinguishable.

Refs #23676
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Prisma is multi-connector but sanitized every statement as standard SQL. On
MySQL and MariaDB a `"..."` run is a string literal rather than a quoted
identifier, so it survived sanitization; a literal containing `FROM` or `JOIN`
then read as a table name and landed in `db.query.summary` — and, with span
streaming, in the span name. Derive the dialect from the `db.system.name` /
`db.system` Prisma reports, matching what knex already does.

Also updates the Prisma integration test expectations for the schema-qualified
table names that the core query-summary fix now keeps intact.

Refs #23676
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 28.56 kB added added
@sentry/browser - with treeshaking flags 26.92 kB added added
@sentry/browser - with treeshaking flags tracing without tracing 26.82 kB added added
@sentry/browser (incl. Tracing) 48.86 kB added added
@sentry/browser (incl. Tracing + Span Streaming) 48.87 kB added added
@sentry/browser (incl. Tracing, Profiling) 51.79 kB added added
@sentry/browser (incl. Tracing, Replay) 88.35 kB added added
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 77.75 kB added added
@sentry/browser (incl. Tracing, Replay with Canvas) 93.04 kB added added
@sentry/browser (incl. Tracing, Replay, Feedback) 106 kB added added
@sentry/browser (incl. Feedback) 46.05 kB added added
@sentry/browser (incl. sendFeedback) 33.62 kB added added
@sentry/browser (incl. FeedbackAsync) 38.73 kB added added
@sentry/browser (incl. Metrics) 29.51 kB added added
@sentry/browser (incl. Logs) 29.8 kB added added
@sentry/browser (incl. Metrics & Logs) 30.43 kB added added
@sentry/react 30.3 kB added added
@sentry/react (incl. Tracing) 51.06 kB added added
@sentry/vue 35.73 kB added added
@sentry/vue (incl. Tracing) 51.13 kB added added
@sentry/svelte 28.59 kB added added
CDN Bundle 30.35 kB added added
CDN Bundle (incl. Tracing) 49.5 kB added added
CDN Bundle (incl. Logs, Metrics) 32.58 kB added added
CDN Bundle (incl. Tracing, Logs, Metrics) 51.41 kB added added
CDN Bundle (incl. Replay, Logs, Metrics) 73.17 kB added added
CDN Bundle (incl. Tracing, Replay) 87 kB added added
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 88.86 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) 92.93 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 94.83 kB added added
CDN Bundle - uncompressed 89.95 kB added added
CDN Bundle (incl. Tracing) - uncompressed 147.56 kB added added
CDN Bundle (incl. Logs, Metrics) - uncompressed 96.24 kB added added
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 153.25 kB added added
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 225.41 kB added added
CDN Bundle (incl. Tracing, Replay) - uncompressed 267.05 kB added added
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 272.73 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 280.75 kB added added
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 286.42 kB added added
@sentry/nextjs (client) 53.68 kB added added
@sentry/sveltekit (client) 49.29 kB added added
@sentry/core/server 65.81 kB added added
@sentry/core/browser 51.94 kB added added
@sentry/node 123.9 kB added added
@sentry/node/import (ESM hook with diagnostics-channel injection) 85.59 kB added added
@sentry/node - without tracing 88.03 kB added added
@sentry/node - without channel injection 103.32 kB added added
@sentry/aws-serverless 96.42 kB added added
@sentry/cloudflare (withSentry) - minified 201.23 kB added added
@sentry/cloudflare (withSentry) 500.71 kB added added

@Lms24
Lms24 marked this pull request as ready for review September 1, 2026 16:40
@Lms24
Lms24 requested review from a team as code owners September 1, 2026 16:40
@Lms24
Lms24 requested review from JPeer264 and isaacs and removed request for a team September 1, 2026 16:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant