fix(server-utils): Always sanitize inline literals out of db.query.text

dev-packages/cloudflare-integration-tests/suites/prisma/test.ts

@@ -55,9 +55,9 @@ it('captures a transaction with Prisma spans for a D1 query via the @sentry/clou
             origin: 'auto.db.cloudflare.d1',
           },
           {
-            description: expect.stringMatching(
-              /^SELECT `main`\.`User`\.`id`, `main`\.`User`\.`email`, `main`\.`User`\.`name` FROM `main`\.`User` WHERE 1=1 LIMIT \? OFFSET \? \/\* traceparent='00-[\da-f]{32}-[\da-f]{16}-01' \*\/$/,
-            ),
+            // The sanitizer strips the D1 adapter's traceparent comment and replaces the literals.
+            description:
+              'SELECT `main`.`User`.`id`, `main`.`User`.`email`, `main`.`User`.`name` FROM `main`.`User` WHERE ?=? LIMIT ? OFFSET ?',
             op: 'db.query',
             origin: 'auto.db.cloudflare.d1',
           },

dev-packages/deno-integration-tests/suites/orchestrion-mysql/test.ts

@@ -89,9 +89,9 @@ Deno.test('mysql instrumentation: orchestrion:mysql:query channel produces a nes
 
   const mysqlSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(mysqlSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(mysqlSpan!.description, 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.description, 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['db.system.name'], 'mysql');
-  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['server.address'], '127.0.0.1');
   assertEquals(mysqlSpan!.data?.['server.port'], 3306);
   assertEquals(mysqlSpan!.data?.['db.user'], 'root');

dev-packages/deno-integration-tests/suites/orchestrion-mysql2/test.ts

@@ -50,9 +50,9 @@ Deno.test('mysql2 instrumentation: orchestrion:mysql2:query channel produces a n
 
   const mysqlSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(mysqlSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(mysqlSpan!.description, 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.description, 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['db.system.name'], 'mysql');
-  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT 1 AS solution');
+  assertEquals(mysqlSpan!.data?.['db.query.text'], 'SELECT ? AS solution');
   assertEquals(mysqlSpan!.data?.['db.namespace'], 'mydb');
   assertEquals(mysqlSpan!.data?.['db.user'], 'root');
   assertEquals(mysqlSpan!.data?.['server.address'], '127.0.0.1');

dev-packages/deno-integration-tests/suites/orchestrion-postgres/test.ts

@@ -89,9 +89,9 @@ Deno.test('pg instrumentation: orchestrion:pg:query channel produces a nested db
 
   const pgSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(pgSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(pgSpan!.description, 'SELECT 1 AS solution');
+  assertEquals(pgSpan!.description, 'SELECT ? AS solution');
   assertEquals(pgSpan!.data?.['db.system.name'], 'postgresql');
-  assertEquals(pgSpan!.data?.['db.query.text'], 'SELECT 1 AS solution');
+  assertEquals(pgSpan!.data?.['db.query.text'], 'SELECT ? AS solution');
   assertEquals(pgSpan!.data?.['server.address'], '127.0.0.1');
   assertEquals(pgSpan!.data?.['server.port'], 5432);
   assertEquals(pgSpan!.data?.['db.user'], 'root');

dev-packages/deno-integration-tests/suites/orchestrion-tedious/test.ts

@@ -53,11 +53,11 @@ Deno.test('tedious instrumentation: orchestrion:tedious:execSql channel produces
 
   const tediousSpan = parent.spans?.find(s => s.op === 'db');
   assertExists(tediousSpan, `expected a db child span, got ops: ${parent.spans?.map(s => s.op).join(', ')}`);
-  assertEquals(tediousSpan!.description, 'SELECT 1');
+  assertEquals(tediousSpan!.description, 'SELECT ?');
   assertEquals(tediousSpan!.data?.['db.system.name'], 'mssql');
   assertEquals(tediousSpan!.data?.['db.namespace'], 'mydb');
   assertEquals(tediousSpan!.data?.['db.user'], 'sa');
-  assertEquals(tediousSpan!.data?.['db.query.text'], 'SELECT 1');
+  assertEquals(tediousSpan!.data?.['db.query.text'], 'SELECT ?');
   assertEquals(tediousSpan!.data?.['server.address'], '127.0.0.1');
   assertEquals(tediousSpan!.data?.['server.port'], 1433);
   assertEquals(tediousSpan!.data?.['sentry.origin'], 'auto.db.tedious');

dev-packages/e2e-tests/test-applications/astro-6-cf-workers/tests/db.test.ts

@@ -12,14 +12,14 @@ test('a real mysql query emits a db span with orchestrion-channel attributes', a
   const spans = await spansPromise;
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   // With span streaming the span name is the low-cardinality query summary; the statement stays in
   // `db.query.text`.
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes['sentry.origin']?.value).toBe('auto.db.mysql');
   expect(firstQuery!.attributes['db.system.name']?.value).toBe('mysql');
-  expect(firstQuery!.attributes['db.query.text']?.value).toBe('SELECT 1 + 1 AS solution');
+  expect(firstQuery!.attributes['db.query.text']?.value).toBe('SELECT ? + ? AS solution');
   expect(firstQuery!.attributes['server.address']?.value).toBe('127.0.0.1');
   expect(firstQuery!.attributes['server.port']?.value).toBe(3306);
   expect(firstQuery!.attributes['db.user']?.value).toBe('root');
@@ -35,6 +35,6 @@ test('a nested query lands on the same trace (async context restored)', async ({
   const queryTexts = spans
     .filter(span => getSpanOp(span) === 'db')
     .map(span => span.attributes['db.query.text']?.value);
-  expect(queryTexts).toContain('SELECT 1 + 1 AS solution');
+  expect(queryTexts).toContain('SELECT ? + ? AS solution');
   expect(queryTexts).toContain('SELECT NOW()');
 });

dev-packages/e2e-tests/test-applications/astro-7-static/tests/db.test.ts

@@ -58,11 +58,11 @@ test('Instruments mysql automatically', async ({ baseURL }) => {
     expect.objectContaining({
       op: 'db',
       origin: 'auto.db.mysql',
-      description: 'SELECT 1 + 1 AS solution',
+      description: 'SELECT ? + ? AS solution',
       status: 'ok',
       data: expect.objectContaining({
         'db.system.name': 'mysql',
-        'db.query.text': 'SELECT 1 + 1 AS solution',
+        'db.query.text': 'SELECT ? + ? AS solution',
         'db.user': 'root',
         'db.connection_string': expect.any(String),
         'server.address': expect.any(String),

dev-packages/e2e-tests/test-applications/astro-7/tests/db.test.ts

@@ -62,6 +62,6 @@ test('Instruments mysql automatically', async ({ baseURL }) => {
       }),
     });
 
-  expect(mysqlSpans).toContainEqual(expectedQuerySpan('SELECT 1 + 1 AS solution'));
+  expect(mysqlSpans).toContainEqual(expectedQuerySpan('SELECT ? + ? AS solution'));
   expect(mysqlSpans).toContainEqual(expectedQuerySpan('SELECT NOW()'));
 });

dev-packages/e2e-tests/test-applications/bun-mysql/tests/mysql.test.ts

@@ -25,14 +25,14 @@ test('mysql queries emit a db span with orchestrion-channel attributes', async (
   const spans = await spansPromise;
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   // With span streaming, db span names are the low-cardinality query summary, not the raw SQL
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes).toMatchObject({
     'sentry.origin': { value: 'auto.db.mysql', type: 'string' },
     'db.system.name': { value: 'mysql', type: 'string' },
-    'db.query.text': { value: 'SELECT 1 + 1 AS solution', type: 'string' },
+    'db.query.text': { value: 'SELECT ? + ? AS solution', type: 'string' },
     'server.port': { value: 3306, type: 'integer' },
     'db.user': { value: 'root', type: 'string' },
   });
@@ -58,7 +58,7 @@ test('a nested query lands on the same trace (async context restored)', async ({
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
   const queries = dbSpans.map(span => span.attributes['db.query.text']?.value);
-  expect(queries).toContain('SELECT 1 + 1 AS solution');
+  expect(queries).toContain('SELECT ? + ? AS solution');
   expect(queries).toContain('SELECT NOW()');
   expect(dbSpans.every(span => span.parent_span_id === segment.span_id)).toBe(true);
 });

dev-packages/e2e-tests/test-applications/cloudflare-orchestrion-mysql/tests/mysql.test.ts

@@ -23,13 +23,13 @@ test('a real mysql query emits a db span with orchestrion-channel attributes', a
   const spans = await spansPromise;
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   // With span streaming the span name is the low-cardinality query summary; the statement stays in `db.query.text`.
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes['sentry.origin']?.value).toBe('auto.db.mysql');
   expect(firstQuery!.attributes['db.system.name']?.value).toBe('mysql');
-  expect(firstQuery!.attributes['db.query.text']?.value).toBe('SELECT 1 + 1 AS solution');
+  expect(firstQuery!.attributes['db.query.text']?.value).toBe('SELECT ? + ? AS solution');
   expect(firstQuery!.attributes['server.address']?.value).toBe('127.0.0.1');
   expect(firstQuery!.attributes['server.port']?.value).toBe(3306);
   expect(firstQuery!.attributes['db.user']?.value).toBe('root');
@@ -58,6 +58,6 @@ test('a nested query lands on the same trace (async context restored)', async ({
   const queryTexts = spans
     .filter(span => getSpanOp(span) === 'db')
     .map(span => span.attributes['db.query.text']?.value);
-  expect(queryTexts).toContain('SELECT 1 + 1 AS solution');
+  expect(queryTexts).toContain('SELECT ? + ? AS solution');
   expect(queryTexts).toContain('SELECT NOW()');
 });

dev-packages/e2e-tests/test-applications/create-remix-app-v2-static/tests/db.test.ts

@@ -62,11 +62,11 @@ test.describe('orchestrion DB instrumentation', () => {
       expect.objectContaining({
         op: 'db',
         origin: 'auto.db.mysql',
-        description: 'SELECT 1 + 1 AS solution',
+        description: 'SELECT ? + ? AS solution',
         status: 'ok',
         data: expect.objectContaining({
           'db.system.name': 'mysql',
-          'db.query.text': 'SELECT 1 + 1 AS solution',
+          'db.query.text': 'SELECT ? + ? AS solution',
           'db.user': 'root',
           'db.connection_string': expect.any(String),
           'server.address': expect.any(String),

dev-packages/e2e-tests/test-applications/create-remix-app-v2/tests/db.test.ts

@@ -53,7 +53,7 @@ test.describe('orchestrion DB instrumentation', () => {
 
     // With span streaming the span name is the low-cardinality query summary; the statement
     // stays in `db.query.text`.
-    for (const query of ['SELECT 1 + 1 AS solution', 'SELECT NOW()']) {
+    for (const query of ['SELECT ? + ? AS solution', 'SELECT NOW()']) {
       expect(mysqlSpans).toContainEqual(
         expect.objectContaining({
           name: 'SELECT',

dev-packages/e2e-tests/test-applications/deno-mysql/tests/mysql.test.ts

@@ -24,14 +24,14 @@ test('mysql queries emit a db span with orchestrion-channel attributes', async (
   const spans = await spansPromise;
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   // With span streaming, db span names are the low-cardinality query summary, not the raw SQL
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes).toMatchObject({
     'sentry.origin': { value: 'auto.db.mysql', type: 'string' },
     'db.system.name': { value: 'mysql', type: 'string' },
-    'db.query.text': { value: 'SELECT 1 + 1 AS solution', type: 'string' },
+    'db.query.text': { value: 'SELECT ? + ? AS solution', type: 'string' },
     'server.port': { value: 3306, type: 'integer' },
     'db.user': { value: 'root', type: 'string' },
   });
@@ -57,7 +57,7 @@ test('a nested query lands on the same trace (AsyncLocalStorage context restored
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
   const queries = dbSpans.map(span => span.attributes['db.query.text']?.value);
-  expect(queries).toContain('SELECT 1 + 1 AS solution');
+  expect(queries).toContain('SELECT ? + ? AS solution');
   expect(queries).toContain('SELECT NOW()');
   expect(dbSpans.every(span => span.parent_span_id === segment.span_id)).toBe(true);
 });

dev-packages/e2e-tests/test-applications/deno-pg/tests/pg.test.ts

@@ -24,14 +24,14 @@ test('pg queries emit a db span with orchestrion-channel attributes', async ({ b
   const spans = await spansPromise;
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   // With span streaming, db span names are the low-cardinality query summary, not the raw SQL
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes).toMatchObject({
     'sentry.origin': { value: 'auto.db.postgres', type: 'string' },
     'db.system.name': { value: 'postgresql', type: 'string' },
-    'db.query.text': { value: 'SELECT 1 + 1 AS solution', type: 'string' },
+    'db.query.text': { value: 'SELECT ? + ? AS solution', type: 'string' },
     'server.port': { value: 5432, type: 'integer' },
     'db.user': { value: 'postgres', type: 'string' },
   });
@@ -58,7 +58,7 @@ test('a nested query lands on the same trace (AsyncLocalStorage context restored
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db');
 
   const queries = dbSpans.map(span => span.attributes['db.query.text']?.value);
-  expect(queries).toContain('SELECT 1 + 1 AS solution');
+  expect(queries).toContain('SELECT ? + ? AS solution');
   expect(queries).toContain('SELECT NOW()');
   expect(dbSpans.every(span => span.parent_span_id === segment.span_id)).toBe(true);
 });

dev-packages/e2e-tests/test-applications/nextjs-16-static/tests/db-page.test.ts

@@ -20,11 +20,11 @@ test('Instruments DB calls made during server-side rendering of a page', async (
     expect.objectContaining({
       op: 'db',
       origin: 'auto.db.postgres',
-      description: 'SELECT 40 + 2 AS answer',
+      description: 'SELECT ? + ? AS answer',
       status: 'ok',
       data: expect.objectContaining({
         'db.system.name': 'postgresql',
-        'db.query.text': 'SELECT 40 + 2 AS answer',
+        'db.query.text': 'SELECT ? + ? AS answer',
       }),
     }),
   );

dev-packages/e2e-tests/test-applications/nextjs-16/tests/db-page.test.ts

@@ -21,7 +21,7 @@ test('Instruments DB calls made during server-side rendering of a page', async (
         'sentry.op': { value: 'db', type: 'string' },
         'sentry.origin': { value: 'auto.db.postgres', type: 'string' },
         'db.system.name': { value: 'postgresql', type: 'string' },
-        'db.query.text': { value: 'SELECT 40 + 2 AS answer', type: 'string' },
+        'db.query.text': { value: 'SELECT ? + ? AS answer', type: 'string' },
       }),
     }),
   );

dev-packages/e2e-tests/test-applications/node-express-esm-loader/tests/server.test.ts

@@ -154,7 +154,7 @@ test('Instruments MySQL via Orchestrion', async ({ baseURL }) => {
         attributes: expect.objectContaining({
           'sentry.op': { value: 'db', type: 'string' },
           'sentry.origin': { value: 'auto.db.mysql', type: 'string' },
-          'db.query.text': { value: 'SELECT 1 + 1 AS solution', type: 'string' },
+          'db.query.text': { value: 'SELECT ? + ? AS solution', type: 'string' },
         }),
       }),
       expect.objectContaining({

dev-packages/e2e-tests/test-applications/node-express-v5/tests/mysql.test.ts

@@ -31,7 +31,7 @@ test('Instruments MySQL via Orchestrion', async ({ baseURL }) => {
         attributes: expect.objectContaining({
           'sentry.op': { value: 'db', type: 'string' },
           'sentry.origin': { value: 'auto.db.mysql', type: 'string' },
-          'db.query.text': { value: 'SELECT 1 + 1 AS solution', type: 'string' },
+          'db.query.text': { value: 'SELECT ? + ? AS solution', type: 'string' },
         }),
       }),
       expect.objectContaining({

dev-packages/e2e-tests/test-applications/nuxt-3/tests/database.test.ts

@@ -114,7 +114,7 @@ test.describe('database integration', () => {
     expect(insertSpan).toBeDefined();
     expect(insertSpan?.attributes).toMatchObject({
       'db.query.summary': { type: 'string', value: 'INSERT logs' },
-      'db.query.text': { type: 'string', value: `INSERT INTO logs (message, level) VALUES ('Test log', 'INFO')` },
+      'db.query.text': { type: 'string', value: `INSERT INTO logs (message, level) VALUES (?, ?)` },
       'db.system.name': { type: 'string', value: 'sqlite' },
       'sentry.origin': { type: 'string', value: 'auto.db.nuxt' },
     });
@@ -183,8 +183,8 @@ test.describe('database integration', () => {
     );
 
     expect(dbBreadcrumb).toBeDefined();
-    expect(dbBreadcrumb?.message).toBe(`INSERT INTO logs (message, level) VALUES ('Test log', 'INFO')`);
-    expect(dbBreadcrumb?.data?.['db.query.text']).toBe(`INSERT INTO logs (message, level) VALUES ('Test log', 'INFO')`);
+    expect(dbBreadcrumb?.message).toBe(`INSERT INTO logs (message, level) VALUES (?, ?)`);
+    expect(dbBreadcrumb?.data?.['db.query.text']).toBe(`INSERT INTO logs (message, level) VALUES (?, ?)`);
   });
 
   test('multiple database operations in single request create multiple spans', async ({ request }) => {

dev-packages/e2e-tests/test-applications/nuxt-4-cloudflare/tests/db.test.ts

@@ -26,13 +26,13 @@ test('a real mysql query emits a db span with orchestrion-channel attributes', a
 
   const dbSpans = spans.filter(span => getSpanOp(span) === 'db' && span.trace_id === rootSpan!.trace_id);
 
-  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT 1 + 1 AS solution');
+  const firstQuery = dbSpans.find(span => span.attributes['db.query.text']?.value === 'SELECT ? + ? AS solution');
   expect(firstQuery).toBeDefined();
   expect(firstQuery!.name).toBe('SELECT');
   expect(firstQuery!.attributes).toMatchObject({
     'sentry.origin': { type: 'string', value: 'auto.db.mysql' },
     'db.system.name': { type: 'string', value: 'mysql' },
-    'db.query.text': { type: 'string', value: 'SELECT 1 + 1 AS solution' },
+    'db.query.text': { type: 'string', value: 'SELECT ? + ? AS solution' },
     'server.address': { type: 'string', value: '127.0.0.1' },
     'server.port': { type: 'integer', value: 3306 },
     'db.user': { type: 'string', value: 'root' },
@@ -52,6 +52,6 @@ test('a nested query lands on the same trace (async context restored)', async ({
   const queryTexts = spans
     .filter(span => getSpanOp(span) === 'db' && span.trace_id === rootSpan!.trace_id)
     .map(span => span.attributes['db.query.text']?.value);
-  expect(queryTexts).toContain('SELECT 1 + 1 AS solution');
+  expect(queryTexts).toContain('SELECT ? + ? AS solution');
   expect(queryTexts).toContain('SELECT NOW()');
 });

dev-packages/e2e-tests/test-applications/nuxt-4-static/tests/database.test.ts

@@ -120,9 +120,9 @@ test.describe('database integration', () => {
 
     expect(dbSpan).toBeDefined();
     expect(dbSpan?.op).toBe('db.query');
-    expect(dbSpan?.description).toBe(`INSERT INTO logs (message, level) VALUES ('Test log', 'INFO')`);
+    expect(dbSpan?.description).toBe(`INSERT INTO logs (message, level) VALUES (?, ?)`);
     expect(dbSpan?.data?.['db.system.name']).toBe('sqlite');
-    expect(dbSpan?.data?.['db.query.text']).toBe(`INSERT INTO logs (message, level) VALUES ('Test log', 'INFO')`);
+    expect(dbSpan?.data?.['db.query.text']).toBe(`INSERT INTO logs (message, level) VALUES (?, ?)`);
     expect(dbSpan?.data?.['sentry.origin']).toBe('auto.db.nuxt');
   });
 
@@ -180,8 +180,8 @@ test.describe('database integration', () => {
 
     expect(dbBreadcrumb).toBeDefined();
     expect(dbBreadcrumb?.category).toBe('query');
-    expect(dbBreadcrumb?.message).toBe(`INSERT INTO logs (message, level) VALUES ('Test log', 'INFO')`);
-    expect(dbBreadcrumb?.data?.['db.query.text']).toBe(`INSERT INTO logs (message, level) VALUES ('Test log', 'INFO')`);
+    expect(dbBreadcrumb?.message).toBe(`INSERT INTO logs (message, level) VALUES (?, ?)`);
+    expect(dbBreadcrumb?.data?.['db.query.text']).toBe(`INSERT INTO logs (message, level) VALUES (?, ?)`);
   });
 
   test('multiple database operations in single request create multiple spans', async ({ request }) => {