Skip to content

fix(server-utils): avoid quadratic SQL summary regex backtracking - #25255

Merged
msonnb merged 1 commit into
developfrom
ms/fix-sql-summary-redos
Oct 12, 2026
Merged

msonnb merged 1 commit into
developfrom
ms/fix-sql-summary-redos

Conversation

@msonnb

@msonnb msonnb commented Oct 12, 2026 •

Copy link
Copy Markdown
Member

The SQL summary SELECT regex could backtrack quadratically on long whitespace prefixes before non-SELECT statements. Grouping the optional opening parenthesis with its following whitespace removes the overlapping matches while preserving accepted queries. Regression coverage reproduces the slowdown and checks parenthesized SELECTs.

Fixes code-scanning alert #524.

@msonnb

msonnb commented Oct 12, 2026

Copy link
Copy Markdown
Member Author

bugbot run

@github-actions

Copy link
Copy Markdown
Contributor

size-limit report 📦

Path Size % Change Change
@sentry/browser 29.82 kB - -
@sentry/browser - with treeshaking flags 27.96 kB - -
@sentry/browser - with treeshaking flags tracing without tracing 27.87 kB - -
@sentry/browser (incl. Tracing) 51.89 kB - -
@sentry/browser (incl. Tracing + Span Streaming) 51.91 kB - -
@sentry/browser (incl. Tracing, Profiling) 54.84 kB - -
@sentry/browser (incl. Tracing, Replay) 91.64 kB - -
@sentry/browser (incl. Tracing, Replay) - with treeshaking flags 80.51 kB - -
@sentry/browser (incl. Tracing, Replay with Canvas) 96.36 kB - -
@sentry/browser (incl. Tracing, Replay, Feedback) 109.34 kB - -
@sentry/browser (incl. Feedback) 47.35 kB - -
@sentry/browser (incl. sendFeedback) 34.87 kB - -
@sentry/browser (incl. FeedbackAsync) 39.98 kB - -
@sentry/browser (incl. Metrics) 30.85 kB - -
@sentry/browser (incl. Logs) 31.14 kB - -
@sentry/browser (incl. Metrics & Logs) 31.78 kB - -
@sentry/react 31.66 kB - -
@sentry/react (incl. Tracing) 54.22 kB - -
@sentry/vue 37.89 kB - -
@sentry/vue (incl. Tracing) 54.81 kB - -
@sentry/svelte 29.85 kB - -
@sentry/remix (Remix 3 client bundle) 56.88 kB - -
CDN Bundle 31.57 kB - -
CDN Bundle (incl. Tracing) 52.4 kB - -
CDN Bundle (incl. Logs, Metrics) 33.76 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) 54.35 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) 74.68 kB - -
CDN Bundle (incl. Tracing, Replay) 90.07 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) 92.01 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) 96.23 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) 98.2 kB - -
CDN Bundle - uncompressed 93.05 kB - -
CDN Bundle (incl. Tracing) - uncompressed 155.64 kB - -
CDN Bundle (incl. Logs, Metrics) - uncompressed 99.59 kB - -
CDN Bundle (incl. Tracing, Logs, Metrics) - uncompressed 161.59 kB - -
CDN Bundle (incl. Replay, Logs, Metrics) - uncompressed 229.63 kB - -
CDN Bundle (incl. Tracing, Replay) - uncompressed 275.8 kB - -
CDN Bundle (incl. Tracing, Replay, Logs, Metrics) - uncompressed 281.74 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback) - uncompressed 289.51 kB - -
CDN Bundle (incl. Tracing, Replay, Feedback, Logs, Metrics) - uncompressed 295.44 kB - -
@sentry/nextjs (client) 56.59 kB - -
@sentry/sveltekit (client) 52.27 kB - -
@sentry/core/server 40.87 kB - -
@sentry/core/browser 13.73 kB - -
@sentry/node 151.74 kB +0.01% +14 B 🔺
@sentry/node/import (ESM hook with diagnostics-channel injection) 83.77 kB - -
@sentry/node - without tracing 94.29 kB +0.02% +13 B 🔺
@sentry/node - without channel injection 129.91 kB +0.02% +15 B 🔺
@sentry/aws-serverless 102.45 kB +0.01% +1 B 🔺
@sentry/cloudflare (withSentry) - minified 210.34 kB +0.01% +4 B 🔺
@sentry/cloudflare (withSentry) 521.41 kB +0.01% +4 B 🔺
@sentry/nextjs/cloudflare (withSentry) - minified 228.01 kB +0.01% +4 B 🔺

View base workflow run

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

Reviewed by Cursor Bugbot for commit 37a0d05. Configure here.

@msonnb
msonnb marked this pull request as ready for review October 12, 2026 08:36
@msonnb
msonnb requested a review from a team as a code owner October 12, 2026 08:36
@msonnb
msonnb requested review from JPeer264, andreiborza, isaacs and mydea and removed request for a team October 12, 2026 08:36
@msonnb
msonnb merged commit 153f4f8 into develop Oct 12, 2026
278 checks passed
@msonnb
msonnb deleted the ms/fix-sql-summary-redos branch October 12, 2026 08:50
msonnb pushed a commit that referenced this pull request Oct 12, 2026
…#25257)

Backport of: #25255

## Differences to the original PR

- Applied the change to `packages/core/src/utils/sql.ts` and
`packages/core/test/lib/utils/sql.test.ts` instead of
`packages/server-utils/src/utils/sql.ts` and
`packages/server-utils/test/utils/sql.test.ts`. On v10 the SQL summary
utils still live in `@sentry/core`; the move to `server-utils` (#23828)
only happened on develop. The code and test changes are the same as the
original.

<!-- junior-request-attribution:start -->
via Junior system actor `junior`.
<!-- junior-request-attribution:end -->

<!-- junior-session-footer:start -->
<!--
junior-conversation-id:agent-dispatch%3Adispatch_cba0ea32a70f73a49ad84af28ebfdde6
-->

--

[View Junior
Session](https://junior-prod.sentry.dev/conversations/agent-dispatch%3Adispatch_cba0ea32a70f73a49ad84af28ebfdde6)
[[Sentry]](https://sentry.sentry.io/explore/conversations/agent-dispatch%3Adispatch_cba0ea32a70f73a49ad84af28ebfdde6/?project=4510944073809921)

<!-- junior-session-footer:end -->

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants