Skip to content

Commit d01c326

Browse files
roggenkemperandrewshie-sentry
roggenkemper
authored and
andrewshie-sentry
committed
feat(detectors): add gorm as excluded package in sql injection detector (#96860)
this pr filters events with the `gorm` package - which is known to cause false positive for sql injection
1 parent e2e0506 commit d01c326

File tree

3 files changed

+171
-1
lines changed

3 files changed

+171
-1
lines changed

‎fixtures/events/performance_problems/sql-injection/sql-injection-event-gorm.json

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
{
2+
"event_id": "5d6401994d7949d2ac3474f472564370",
3+
"platform": "go",
4+
"message": "",
5+
"datetime": "2025-05-12T22:42:38.642986+00:00",
6+
"breakdowns": {
7+
"span_ops": {
8+
"ops.db": {
9+
"value": 65.715075,
10+
"unit": "millisecond"
11+
},
12+
"total.time": {
13+
"value": 67.105293,
14+
"unit": "millisecond"
15+
}
16+
}
17+
},
18+
"request": {
19+
"url": "http://localhost:3001/vulnerable-login",
20+
"method": "POST",
21+
"data": {
22+
"username": "bob"
23+
}
24+
},
25+
"modules": {
26+
"gorm.io/gorm": "v1.30.0"
27+
},
28+
"spans": [
29+
{
30+
"timestamp": 1747089758.567536,
31+
"start_timestamp": 1747089758.567,
32+
"exclusive_time": 0.536203,
33+
"op": "middleware.express",
34+
"span_id": "4a06692f4abc8dbe",
35+
"parent_span_id": "91fa92ff0205967d",
36+
"trace_id": "375a86eca09a4a4e91903838dd771f50",
37+
"status": "ok",
38+
"description": "corsMiddleware",
39+
"origin": "auto.http.otel.express",
40+
"data": {
41+
"express.name": "corsMiddleware",
42+
"express.type": "middleware",
43+
"sentry.op": "middleware.express",
44+
"sentry.origin": "auto.http.otel.express"
45+
},
46+
"sentry_tags": {
47+
"user": "ip:::1",
48+
"user.ip": "::1",
49+
"environment": "production",
50+
"transaction": "GET /vulnerable-login",
51+
"transaction.method": "GET",
52+
"transaction.op": "http.server",
53+
"browser.name": "Chrome",
54+
"sdk.name": "sentry.go",
55+
"sdk.version": "9.17.0",
56+
"platform": "go",
57+
"os.name": "macOS",
58+
"category": "middleware",
59+
"op": "middleware.express",
60+
"status": "ok",
61+
"trace.status": "ok"
62+
},
63+
"hash": "e6088cf8b370ed60"
64+
},
65+
{
66+
"timestamp": 1747089758.568761,
67+
"start_timestamp": 1747089758.568,
68+
"exclusive_time": 0.761032,
69+
"op": "middleware.express",
70+
"span_id": "92553d2584d250b8",
71+
"parent_span_id": "91fa92ff0205967d",
72+
"trace_id": "375a86eca09a4a4e91903838dd771f50",
73+
"status": "ok",
74+
"description": "jsonParser",
75+
"origin": "auto.http.otel.express",
76+
"data": {
77+
"express.name": "jsonParser",
78+
"express.type": "middleware",
79+
"sentry.op": "middleware.express",
80+
"sentry.origin": "auto.http.otel.express"
81+
},
82+
"sentry_tags": {
83+
"user": "ip:::1",
84+
"user.ip": "::1",
85+
"environment": "production",
86+
"transaction": "GET /vulnerable-login",
87+
"transaction.method": "GET",
88+
"transaction.op": "http.server",
89+
"browser.name": "Chrome",
90+
"sdk.name": "sentry.go",
91+
"sdk.version": "9.17.0",
92+
"platform": "go",
93+
"os.name": "macOS",
94+
"category": "middleware",
95+
"op": "middleware.express",
96+
"status": "ok",
97+
"trace.status": "ok"
98+
},
99+
"hash": "c81e963dad9ebc6c"
100+
},
101+
{
102+
"timestamp": 1747089758.569093,
103+
"start_timestamp": 1747089758.569,
104+
"exclusive_time": 0.092983,
105+
"op": "request_handler.express",
106+
"span_id": "435146ab0909419d",
107+
"parent_span_id": "91fa92ff0205967d",
108+
"trace_id": "375a86eca09a4a4e91903838dd771f50",
109+
"status": "ok",
110+
"description": "/vulnerable-login",
111+
"origin": "auto.http.otel.express",
112+
"data": {
113+
"express.name": "/vulnerable-login",
114+
"express.type": "request_handler",
115+
"http.route": "/vulnerable-login",
116+
"sentry.op": "request_handler.express",
117+
"sentry.origin": "auto.http.otel.express"
118+
},
119+
"sentry_tags": {
120+
"user": "ip:::1",
121+
"user.ip": "::1",
122+
"environment": "production",
123+
"transaction": "GET /vulnerable-login",
124+
"transaction.method": "GET",
125+
"transaction.op": "http.server",
126+
"browser.name": "Chrome",
127+
"sdk.name": "sentry.go",
128+
"sdk.version": "9.17.0",
129+
"platform": "go",
130+
"os.name": "macOS",
131+
"op": "request_handler.express",
132+
"status": "ok",
133+
"trace.status": "ok"
134+
},
135+
"hash": "872b0c84a6f1c590"
136+
},
137+
{
138+
"timestamp": 1747089758.637715,
139+
"start_timestamp": 1747089758.572,
140+
"exclusive_time": 65.715075,
141+
"op": "db",
142+
"span_id": "4703181ac343f71a",
143+
"parent_span_id": "91fa92ff0205967d",
144+
"trace_id": "375a86eca09a4a4e91903838dd771f50",
145+
"status": "ok",
146+
"description": "SELECT * FROM \"user\" WHERE username = 'bob' AND \"user\".\"deleted_at\" IS NULL ORDER BY \"user\".\"id\" LIMIT 1",
147+
"origin": "auto.db.otel.mysql2",
148+
"sentry_tags": {
149+
"description": "SELECT * FROM \"user\" WHERE username = 'bob' AND \"user\".\"deleted_at\" IS NULL ORDER BY \"user\".\"id\" LIMIT 1"
150+
},
151+
"data": {
152+
"db.system": "mysql",
153+
"db.connection_string": "jdbc:mysql://localhost:3306/injection_test",
154+
"db.name": "injection_test",
155+
"db.statement": "SELECT * FROM \"user\" WHERE username = 'bob' AND \"user\".\"deleted_at\" IS NULL ORDER BY \"user\".\"id\" LIMIT 1",
156+
"db.user": "root",
157+
"net.peer.name": "localhost",
158+
"net.peer.port": 3306,
159+
"otel.kind": "CLIENT",
160+
"sentry.op": "db",
161+
"sentry.origin": "auto.db.otel.mysql2"
162+
},
163+
"hash": "45330ba0cafa5997"
164+
}
165+
]
166+
}

‎src/sentry/performance_issues/detectors/sql_injection_detector.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
"PAGE",
5656
]
5757

58-
EXCLUDED_PACKAGES = ["github.com/go-sql-driver/mysql", "sequelize"]
58+
EXCLUDED_PACKAGES = ["github.com/go-sql-driver/mysql", "sequelize", "gorm.io/gorm"]
5959
PARAMETERIZED_KEYWORDS = ["?", "$1", "%s"]
6060

6161

‎tests/sentry/performance_issues/test_sql_injection_detector.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,3 +86,7 @@ def test_sql_injection_on_laravel_query(self) -> None:
8686
def test_sql_injection_on_query_with_bindings(self) -> None:
8787
injection_event = get_event("sql-injection/sql-injection-query-with-bindings")
8888
assert len(self.find_problems(injection_event)) == 0
89+
90+
def test_sql_injection_on_event_with_gorm(self) -> None:
91+
injection_event = get_event("sql-injection/sql-injection-event-gorm")
92+
assert len(self.find_problems(injection_event)) == 0

0 commit comments

Comments
 (0)