Commit c5b0de30 authored by Igor's avatar Igor
Browse files

tracing: redact values in sql statements

parent fa9fd8d4

gitlab-labkit.gemspec

+1 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ Gem::Specification.new do |spec| 
  spec.add_runtime_dependency "jaeger-client", "~> 1.1"

  spec.add_runtime_dependency "opentracing", "~> 0.4"

  spec.add_runtime_dependency "redis", ">3.0.0", "<5.0.0"

  spec.add_runtime_dependency "gitlab-pg_query", "~> 1.3"



  # Please maintain alphabetical order for dev dependencies

  spec.add_development_dependency "grpc-tools", "~> 1.19"

lib/labkit/logging/sanitizer.rb

+8 −0
Original line number Diff line number Diff line 
# frozen_string_literal: true



require "pg_query"



module Labkit

  module Logging

    # Sanitizer provides log message sanitization, removing
@@ -22,6 +24,12 @@ module Labkit 
        content

      end



      def self.sanitize_sql(sql)

        PgQuery.normalize(sql)

      rescue PgQuery::ParseError

        ""

      end



      # Ensures that URLS are sanitized to hide credentials

      def self.mask_url(url)

        url = url.to_s.strip

lib/labkit/tracing.rb

+6 −0
Original line number Diff line number Diff line
@@ -28,6 +28,12 @@ module Labkit 
      ENV["GITLAB_TRACING_URL"]

    end



    # Check if the current request is being traced.

    def self.sampled?

      context = OpenTracing.active_span&.context

      context && context.respond_to?(:sampled?) && context.sampled?

    end



    def self.stacktrace_operations

      @stacktrace_operations ||= Set.new(ENV["GITLAB_TRACING_INCLUDE_STACKTRACE"].to_s.split(",").map(&:strip))

    end

lib/labkit/tracing/rails/active_record/sql_instrumenter.rb

+2 −1
Original line number Diff line number Diff line
@@ -14,13 +14,14 @@ module Labkit 
          end



          def tags(payload)

            sql = Labkit::Logging::Sanitizer.sanitize_sql(payload[:sql]) if Labkit::Tracing.sampled? && payload[:sql]

            {

              "component" => COMPONENT_TAG,

              "span.kind" => "client",

              "db.type" => "sql",

              "db.connection_id" => payload[:connection_id],

              "db.cached" => payload[:cached] || false,

              "db.statement" => payload[:sql],

              "db.statement" => sql,

            }

          end

        end

spec/logging/sanitizer_spec.rb

+12 −0
Original line number Diff line number Diff line
@@ -78,4 +78,16 @@ describe Labkit::Logging::Sanitizer do 
      it { expect(described_class.mask_scp_url(input)).to eq(output) }

    end

  end



  describe ".sanitize_sql" do

    where(:input, :output) do

      "invalid sql" | ""

      "select 42" | "select $1"

      %q[SELECT "routes".* FROM "routes" WHERE "routes"."source_type" = 'Namespace' AND "routes"."source_id" IN (1, 22, 23)] | %q[SELECT "routes".* FROM "routes" WHERE "routes"."source_type" = $1 AND "routes"."source_id" IN ($2, $3, $4)]

    end



    with_them do

      it { expect(described_class.sanitize_sql(input)).to eq(output) }

    end

  end

end