feat(clickhouse_driver): Set breadcrumbs in the streaming trace lifecycle - #7325
2 issues
find-bugs: Found 2 issues (1 high, 1 medium)
High
Streaming breadcrumbs always attach db.result, bypassing PII guards - `sentry_sdk/integrations/clickhouse_driver.py:161-165`
In _wrap_end, db.result is always merged into breadcrumb data even when the PII/database_query_data check fails; pass data=breadcrumb_data instead so results are only included when that guard succeeds.
Also found at:
tests/integrations/clickhouse_driver/test_clickhouse_driver.py:161-165tests/integrations/clickhouse_driver/test_clickhouse_driver.py:745-779tests/integrations/clickhouse_driver/test_clickhouse_driver.py:1148-1246tests/integrations/clickhouse_driver/test_clickhouse_driver.py:2053-2151tests/integrations/clickhouse_driver/test_clickhouse_driver.py:2349-2358tests/integrations/clickhouse_driver/test_clickhouse_driver.py:30tests/integrations/clickhouse_driver/test_clickhouse_driver.py:433-443tests/integrations/clickhouse_driver/test_clickhouse_driver.py:945-1043
Medium
Streaming ClickHouse breadcrumbs drop opted-in db.params - `tests/integrations/clickhouse_driver/test_clickhouse_driver.py:2273-2346`
When ClickHouse uses the streaming trace lifecycle, query breadcrumbs omit db.params even when database query data collection or send_default_pii is enabled. The non-streaming path records query and insert parameters in breadcrumbs, but the streaming path only records connection metadata, causing a loss of opted-in database observability data.
⏱ 21m 19s · 6.0M in / 261.2k out · $3.81
Annotations
Check failure on line 165 in sentry_sdk/integrations/clickhouse_driver.py
sentry-warden / warden: find-bugs
Streaming breadcrumbs always attach db.result, bypassing PII guards
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 165 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 779 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 1246 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 2151 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 2358 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 30 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 443 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check failure on line 1043 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
[G7E-BU5] Streaming breadcrumbs always attach db.result, bypassing PII guards (additional location)
In `_wrap_end`, `db.result` is always merged into breadcrumb data even when the PII/`database_query_data` check fails; pass `data=breadcrumb_data` instead so results are only included when that guard succeeds.
Check warning on line 2346 in tests/integrations/clickhouse_driver/test_clickhouse_driver.py
sentry-warden / warden: find-bugs
Streaming ClickHouse breadcrumbs drop opted-in db.params
When ClickHouse uses the streaming trace lifecycle, query breadcrumbs omit db.params even when database query data collection or send_default_pii is enabled. The non-streaming path records query and insert parameters in breadcrumbs, but the streaming path only records connection metadata, causing a loss of opted-in database observability data.