forge_ops_tracker 0.14.0 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b7f1809933ffeccac536f117de7c234002826fe29414fc3fa92f12c22bb1a18
-  data.tar.gz: 84a9edadbaeb72dbe62164a84f26c7f23b6a600f176126ca82370709dc72b5c3
+  metadata.gz: 2c05c6f94c7c080f7c148cc315097b8e177d34dec772d580e21cf89a7120f1b3
+  data.tar.gz: d486796b0f26b752872118cfaad2c9c184671bc596bd6c32a04cfb6a754dc171
 SHA512:
-  metadata.gz: ca419d26d17f08e4544bb213c2949dedf7001402f163a15b0def3c0942ffcc534637911d1bc7e8890f6a3dc556f174a3ecea703351fe291d492c1c151838e3f9
-  data.tar.gz: 6890f1adbbf73ae399699ee3482a005bbfee521909c6af6acedb8a805a2aa69c3d46f75bf33a3a4722be9f0e6e84a0263850729e42380d1d1b26e23e50f285cb
+  metadata.gz: e99dddf991705420ceb4d69f21ad8d5e39885f5f2f782e0747976aa2c8cb2463a4d8f56652f23f6944c40d38bc89e95475e61ecaf2079b0f106ca401d4e25d06
+  data.tar.gz: 1e5e0e69a95ddecb9411a024dcbf1817b688312131bbffc7359cb917f86d416e7d2811b1215feeb355b4ff4df3b1a2757bafe747ddc425e057e3248bb3572287

data/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.15.0 (2026-09-29)
+
+- SQL masking now also catches strings with a backslash-escaped quote (`'o\'brien'`,
+  `E'o\'brien'`), prefixed strings (`E''`, `X''`, `N''`, `B''`, `U&''`, prefix included), hex,
+  binary and exponent numbers (`0x1F`, `0b101`, `3e10`, `1.5E-3`, `.5`), and, on MySQL and
+  MariaDB, `"double-quoted"` strings. `SqlStatement.mask` takes an optional `system:`, and
+  database spans (including `ForgeOpsTracker.span`'s `db_system:`) pass their `db.system` to it.
+
 ## 0.14.0 (2026-09-25)
 
 - Every Active Record database span now carries the query's SQL (`db.statement`), masked so every

data/README.md

@@ -416,9 +416,12 @@ on error events is sent either way.
 Every Active Record query span carries the query's SQL and the database it ran on, so a slow trace
 shows exactly which query was slow. The SQL is masked before it leaves your process: every string
 and number is replaced by `?`, so `WHERE email = 'a@b.co' AND id = 42` is sent as
-`WHERE email = ? AND id = ?`, and bind values are never sent at all. ForgeOps masks it again on
-arrival. The database comes from the connection's adapter (`postgresql`, `mysql`, `sqlite`,
-`mssql`, `oracle`, or the adapter's own name otherwise).
+`WHERE email = ? AND id = ?`, and bind values are never sent at all. That includes escaped and
+prefixed strings (`E'o\'brien'`, `X'DEADBEEF'`), hex, binary and exponent numbers (`0x1F`,
+`0b101`, `1.5E-3`), and, on MySQL and MariaDB (where `"double quotes"` hold a string, not a name),
+double-quoted strings. ForgeOps masks it again on arrival. The database comes from the
+connection's adapter (`postgresql`, `mysql`, `sqlite`, `mssql`, `oracle`, or the adapter's own
+name otherwise).
 
 Spans you create yourself can carry SQL too. Pass `statement:` (and optionally `db_system:`) on a
 `kind: "database"` span; it's masked the same way:

data/lib/forge_ops_tracker/performance_instrumentation.rb

@@ -84,9 +84,10 @@ module ForgeOpsTracker
     # and number literal becomes "?", so no value the app queried with is ever sent), and which
     # database it ran on, from the connection's adapter. Either is left out when it isn't known.
     def database_span_data(payload)
+      system = db_system(payload[:connection])
       {
-        "db.statement" => SqlStatement.mask(payload[:sql].to_s),
-        "db.system" => db_system(payload[:connection])
+        "db.statement" => SqlStatement.mask(payload[:sql].to_s, system: system),
+        "db.system" => system
       }.compact
     end
 

data/lib/forge_ops_tracker/query_explainer.rb

@@ -102,7 +102,8 @@ module ForgeOpsTracker
       return false unless duration_ms && duration_ms >= configuration.explain_threshold_ms.to_f
 
       connection = payload[:connection]
-      return false unless PerformanceInstrumentation.db_system(connection) == "postgresql"
+      system = PerformanceInstrumentation.db_system(connection)
+      return false unless system == "postgresql"
 
       sql = payload[:sql]
       return false unless self.class.explainable?(sql)
@@ -110,7 +111,7 @@ module ForgeOpsTracker
       pool = connection.respond_to?(:pool) ? connection.pool : nil
       return false unless pool
 
-      statement = SqlStatement.mask(sql)
+      statement = SqlStatement.mask(sql, system: system)
       return false unless reserve(statement)
 
       enqueue(Job.new(

data/lib/forge_ops_tracker/sql_statement.rb

@@ -15,11 +15,19 @@ module ForgeOpsTracker
     MAX_NAME_LENGTH = 200
     MAX_CAUSE_DEPTH = 5
 
-    LITERAL = /
-      '(?:[^']|'')*(?:'|\z)                      # string literal, or one cut off by truncation
-      | (?<tag>\$[A-Za-z_]*\$).*?(?:\k<tag>|\z)  # dollar-quoted string
-      | (?<![\w$.])\d+(?:\.\d+)?(?!\w)           # number, not part of an identifier or placeholder
-    /mx
+    # db.system values where "double quotes" are a string, not a name.
+    DOUBLE_QUOTED_STRING_SYSTEMS = %w[mysql mariadb].freeze
+
+    # The prefix only counts as one when it isn't the end of a word, but the quote always does:
+    # LIKE'%x%', with no space, is still a string. A backslash can be the statement's last character
+    # ('secret\ cut off mid-escape), and the string is still masked to the end.
+    STRING = /(?:(?<![\w$])(?:[EeXxNnBb]|[Uu]&))?'(?:[^'\\]|\\(?:.|\z)|'')*(?:'|\z)/m
+    DOUBLE_QUOTED_STRING = /"(?:[^"\\]|\\(?:.|\z)|"")*(?:"|\z)/m
+    DOLLAR_QUOTED = /(?<tag>\$[A-Za-z_]*\$).*?(?:\k<tag>|\z)/m
+    NUMBER = /(?<![\w$.])(?:0[xX]\h+|0[bB][01]+|(?:\d+(?:\.\d+)?|\.\d+)(?:[eE][+-]?\d+)?)(?!\w)/
+
+    LITERAL = Regexp.union(STRING, DOLLAR_QUOTED, NUMBER)
+    LITERAL_WITH_DOUBLE_QUOTES = Regexp.union(STRING, DOUBLE_QUOTED_STRING, DOLLAR_QUOTED, NUMBER)
 
     PART = /(?:[\w$#@]+|"[^"]+"|\[[^\]]+\]|`[^`]+`)/
     NAME = /#{PART}(?:\.#{PART})*/
@@ -51,10 +59,13 @@ module ForgeOpsTracker
       nil
     end
 
-    def mask(statement)
+    # system is the query's db.system, when known: on MySQL and MariaDB "double quotes" are a
+    # string too, so they're masked there and left alone everywhere else.
+    def mask(statement, system: nil)
       return nil if statement.nil? || statement.strip.empty?
 
-      masked = statement.gsub(LITERAL, MASK)
+      pattern = DOUBLE_QUOTED_STRING_SYSTEMS.include?(system.to_s.downcase) ? LITERAL_WITH_DOUBLE_QUOTES : LITERAL
+      masked = statement.gsub(pattern, MASK)
       masked.length > MAX_LENGTH ? "#{masked[0, MAX_LENGTH]}..." : masked
     end
 

data/lib/forge_ops_tracker/version.rb

@@ -1,3 +1,3 @@
 module ForgeOpsTracker
-  VERSION = "0.14.0"
+  VERSION = "0.15.0"
 end

data/lib/forge_ops_tracker.rb

@@ -155,9 +155,10 @@ module ForgeOpsTracker
 
     private
       def database_span_data(data, statement, db_system)
+        system = (db_system.to_s.strip.downcase unless db_system.nil? || db_system.to_s.strip.empty?)
         extra = {
-          "db.statement" => (SqlStatement.mask(statement.to_s) unless statement.nil?),
-          "db.system" => (db_system.to_s.strip.downcase unless db_system.nil? || db_system.to_s.strip.empty?)
+          "db.statement" => (SqlStatement.mask(statement.to_s, system: system) unless statement.nil?),
+          "db.system" => system
         }.compact
         extra.empty? ? data : data.merge(extra)
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: forge_ops_tracker
 version: !ruby/object:Gem::Version
-  version: 0.14.0
+  version: 0.15.0
 platform: ruby
 authors:
 - ForgeOps
@@ -29,14 +29,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '8.1'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '8.1'
 - !ruby/object:Gem::Dependency
   name: puma
   requirement: !ruby/object:Gem::Requirement