Skip to content

fix(server-utils): Pass the SQL dialect when summarizing Prisma queries - #23854

Merged
Lms24 merged 1 commit into
lms/fix-core-qualified-table-names-in-query-summaryfrom
lms/fix-prisma-sql-dialect-and-qualified-table-names
Sep 8, 2026
Merged

fix(server-utils): Pass the SQL dialect when summarizing Prisma queries#23854
Lms24 merged 1 commit into
lms/fix-core-qualified-table-names-in-query-summaryfrom
lms/fix-prisma-sql-dialect-and-qualified-table-names

Conversation

@Lms24

@Lms24 Lms24 commented Sep 1, 2026

Copy link
Copy Markdown
Member

Prisma talks to Postgres, MySQL, SQLite and others, but sanitized every statement as standard SQL. In MySQL, "..." is a string literal, not a quoted identifier, so the value was never replaced with ?. If it contained FROM or JOIN, the summary parser then read it as a table name, which landed in the span name when span streaming is enabled.

A MySQL query with an inlined value: SELECT * FROM User WHERE bio = "x FROM secret_table"

Before After
Sanitized SQL the summary is built from SELECT * FROM User WHERE bio = "x FROM secret_table" SELECT * FROM User WHERE bio = ?
db.query.summary SELECT User secret_table SELECT User

Refs #23676

@github-actions

github-actions Bot commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 28.8 kB - -
@sentry/browser - with treeshaking flags 27.11 kB - -
@sentry/browser - with treeshaking flags tracing without tracing 27 kB - -
@sentry/browser (incl. Tracing) 49.22 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 49.22 kB - -
@sentry/browser (incl. Tracing, Profiling) 52.12 kB - -
@sentry/browser (incl. Tracing, Replay) 88.76 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 77.95 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 93.44 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 106.37 kB - -
@sentry/browser (incl. Feedback) 46.3 kB - -
@sentry/browser (incl. sendFeedback) 33.86 kB - -
@sentry/browser (incl. FeedbackAsync) 38.97 kB - -
@sentry/browser (incl. Metrics) 29.82 kB - -
@sentry/browser (incl. Logs) 30.09 kB - -
@sentry/browser (incl. Metrics & Logs) 30.75 kB - -
@sentry/react 30.55 kB - -
@sentry/react (incl. Tracing) 51.56 kB - -
@sentry/vue 36.05 kB - -
@sentry/vue (incl. Tracing) 51.48 kB - -
@sentry/svelte 28.83 kB - -
CDN Bundle 30.55 kB - -
CDN Bundle (incl. Tracing) 49.74 kB - -
CDN Bundle (incl. Logs, Metrics) 32.82 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 51.7 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 73.48 kB - -
CDN Bundle (incl. Tracing, Replay) 87.29 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 89.18 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 93.22 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 95.21 kB - -
CDN Bundle - uncompressed 90.46 kB - -
CDN Bundle (incl. Tracing) - uncompressed 148.17 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 97.03 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 154.14 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 226.29 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 267.76 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 273.71 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 281.46 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 287.4 kB - -
@sentry/nextjs (client) 54 kB - -
@sentry/sveltekit (client) 49.65 kB - -
@sentry/core/server 36.99 kB - -
@sentry/core/browser 13.55 kB - -
@sentry/node 127.81 kB +0.07% +81 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 81.61 kB - -
@sentry/node - without tracing 88.73 kB +0.03% +21 B 🔺
@sentry/node - without channel injection 107.05 kB +0.07% +72 B 🔺
@sentry/aws-serverless 97.12 kB +0.03% +26 B 🔺
@sentry/cloudflare (withSentry) - minified 201.98 kB +0.02% +24 B 🔺
@sentry/cloudflare (withSentry) 502.68 kB +0.01% +12 B 🔺

View base workflow run

@Lms24
Lms24 marked this pull request as ready for review September 1, 2026 16:40
@Lms24
Lms24 requested review from a team as code owners September 1, 2026 16:40
@Lms24
Lms24 requested review from JPeer264 and isaacs and removed request for a team September 1, 2026 16:40
@Lms24
Lms24 force-pushed the lms/fix-prisma-sql-dialect-and-qualified-table-names branch 2 times, most recently from 4860c0d to 22dcddf Compare September 2, 2026 07:28
Comment thread packages/server-utils/src/integrations/prisma/tracing-helper.ts
Base automatically changed from lms/feat-server-utils-low-card-db-span-names3 to develop September 2, 2026 12:52
@Lms24
Lms24 force-pushed the lms/fix-prisma-sql-dialect-and-qualified-table-names branch 2 times, most recently from 5ca67c0 to b29a245 Compare September 2, 2026 12:58
@Lms24
Lms24 changed the base branch from develop to lms/fix-core-qualified-table-names-in-query-summary September 2, 2026 12:58
@Lms24
Lms24 force-pushed the lms/fix-prisma-sql-dialect-and-qualified-table-names branch from b29a245 to 517a6b5 Compare September 3, 2026 07:26
@Lms24 Lms24 self-assigned this Sep 3, 2026
@github-actions

github-actions Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

👋 @isaacs, @JPeer264, @getsentry/team-javascript-sdks — Please review this PR when you get a chance!

Prisma is multi-connector but sanitized every statement as standard SQL. On
MySQL and MariaDB a `"..."` run is a string literal rather than a quoted
identifier, so it survived sanitization; a literal containing `FROM` or `JOIN`
then read as a table name and landed in `db.query.summary` — and, with span
streaming, in the span name. Derive the dialect from the `db.system.name` /
`db.system` Prisma reports, matching what knex already does.

Refs #23676
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@Lms24
Lms24 force-pushed the lms/fix-prisma-sql-dialect-and-qualified-table-names branch from 517a6b5 to 5f1672b Compare September 8, 2026 12:06
@Lms24
Lms24 merged commit 701be20 into develop Sep 8, 2026
449 of 483 checks passed
@Lms24
Lms24 deleted the lms/fix-prisma-sql-dialect-and-qualified-table-names branch September 8, 2026 13:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants