From 1b2f734d31ee5f836a3eea374497eb245dc7b442 Mon Sep 17 00:00:00 2001
From: "sentry-junior[bot]"
 <264270552+sentry-junior[bot]@users.noreply.github.com>
Date: Mon, 12 Oct 2026 08:58:01 +0000
Subject: [PATCH] fix(v10/server-utils): avoid quadratic SQL summary regex
 backtracking

Backport of: #25255
---
 packages/core/src/utils/sql.ts           |  2 +-
 packages/core/test/lib/utils/sql.test.ts | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/utils/sql.ts b/packages/core/src/utils/sql.ts
index 45c5c4fd19aa..85331e8a9eb8 100644
--- a/packages/core/src/utils/sql.ts
+++ b/packages/core/src/utils/sql.ts
@@ -22,7 +22,7 @@ const UPDATE_RE = new RegExp(
 );
 const DELETE_RE = new RegExp(`^\\s*(?<operation>DELETE)\\s+FROM\\s+(?<table>${TABLE_NAME})`, 'i');
 
-const SELECT_RE = /^\s*\(?\s*(?<operation>SELECT)\b/i;
+const SELECT_RE = /^\s*(?:\(\s*)?(?<operation>SELECT)\b/i;
 
 const PRAGMA_RE = /^\s*(?<operation>PRAGMA)\s+(?<command>\S+)/i;
 
diff --git a/packages/core/test/lib/utils/sql.test.ts b/packages/core/test/lib/utils/sql.test.ts
index 7e5bb2140c38..5a7d3ae97638 100644
--- a/packages/core/test/lib/utils/sql.test.ts
+++ b/packages/core/test/lib/utils/sql.test.ts
@@ -12,6 +12,8 @@ describe('getSqlQuerySummary', () => {
       ['select count(*) from orders', 'select orders'],
       ['SELECT DISTINCT email FROM subscribers WHERE active = ?', 'SELECT subscribers'],
       ['  SELECT * FROM users', 'SELECT users'],
+      ['(SELECT * FROM users)', 'SELECT users'],
+      [' \t( \nselect * from users)', 'select users'],
     ])('%j => %j', (input, expected) => {
       expect(getSqlQuerySummary(input)).toBe(expected);
     });
@@ -165,6 +167,17 @@ describe('getSqlQuerySummary', () => {
     it('handles leading whitespace in fallback', () => {
       expect(getSqlQuerySummary('  VACUUM')).toBe('VACUUM');
     });
+
+    it('handles long leading whitespace without excessive backtracking', () => {
+      const query = `${' '.repeat(100_000)}VACUUM`;
+      const start = performance.now();
+
+      const summary = getSqlQuerySummary(query);
+      const duration = performance.now() - start;
+
+      expect(summary).toBe('VACUUM');
+      expect(duration).toBeLessThan(1_000);
+    });
   });
 
   describe('set operations', () => {