Adding bindings to SQL spans in tracing

config/sentry.php

@@ -67,6 +67,9 @@
         // Capture SQL queries as spans
         'sql_queries' => env('SENTRY_TRACE_SQL_QUERIES_ENABLED', true),
 
+        // Capture SQL query bindings (parameters) in SQL query spans
+        'sql_bindings' => env('SENTRY_TRACE_SQL_BINDINGS_ENABLED', false),
+
         // Capture where the SQL query originated from on the SQL query spans
         'sql_origin' => env('SENTRY_TRACE_SQL_ORIGIN_ENABLED', true),
 

src/Sentry/Laravel/Tracing/EventHandler.php

@@ -41,6 +41,13 @@ class EventHandler
      */
     private $traceSqlQueries;
 
+    /**
+     * Indicates if we should add query bindings to query spans.
+     *
+     * @var bool
+     */
+    private $recordSqlBindings;
+
     /**
      * Indicates if we should we add SQL query origin data to query spans.
      *
@@ -83,6 +90,7 @@ public function __construct(array $config)
     {
         $this->traceSqlQueries = ($config['sql_queries'] ?? true) === true;
         $this->traceSqlQueryOrigins = ($config['sql_origin'] ?? true) === true;
+        $this->recordSqlBindings = ($config['sql_bindings'] ?? true) === true;
 
         $this->traceQueueJobs = ($config['queue_jobs'] ?? false) === true;
         $this->traceQueueJobsAsTransactions = ($config['queue_job_transactions'] ?? false) === true;
@@ -176,6 +184,12 @@ protected function queryExecutedHandler(DatabaseEvents\QueryExecuted $query): vo
             }
         }
 
+        if ($this->recordSqlBindings) {
+            $context->setData(array_merge($context->getData(), [
+                'db.sql.bindings' => $query->bindings
+            ]));
+        }
+
         $parentSpan->startChild($context);
     }
 

test/Sentry/TestCase.php

@@ -2,6 +2,8 @@
 
 namespace Sentry\Laravel\Tests;
 
+use Sentry\SentrySdk;
+use Sentry\Tracing\Span;
 use Sentry\Tracing\Transaction;
 use Illuminate\Config\Repository;
 use Sentry\Tracing\TransactionContext;
@@ -19,6 +21,7 @@
 use Sentry\State\HubInterface;
 use Sentry\Laravel\ServiceProvider;
 use Orchestra\Testbench\TestCase as LaravelTestCase;
+use Throwable;
 
 abstract class TestCase extends LaravelTestCase
 {
@@ -155,6 +158,16 @@ protected function getLastSentryEvent(): ?Event
         return end(self::$lastSentryEvents)[0];
     }
 
+    protected function getLastSentrySpan(): ?Span
+    {
+        try {
+            $spans = SentrySdk::getCurrentHub()->getSpan()->getSpanRecorder()->getSpans();
+            return end($spans);
+        } catch (Throwable $throwable) {
+            return null;
+        }
+    }
+
     protected function getLastEventSentryHint(): ?EventHint
     {
         if (empty(self::$lastSentryEvents)) {

test/Sentry/Tracing/EventHandlerTest.php

@@ -2,10 +2,12 @@
 
 namespace Sentry\Laravel\Tests\Tracing;
 
+use Illuminate\Database\Connection;
+use Illuminate\Database\Events\QueryExecuted;
+use Mockery;
 use ReflectionClass;
-use Sentry\Laravel\Tests\TestCase;
-use Sentry\Laravel\Tracing\BacktraceHelper;
 use RuntimeException;
+use Sentry\Laravel\Tests\TestCase;
 use Sentry\Laravel\Tracing\EventHandler;
 
 class EventHandlerTest extends TestCase
@@ -27,6 +29,56 @@ public function testAllMappedEventHandlersExist(): void
         );
     }
 
+    public function testSqlBindingsAreRecordedWhenEnabled(): void
+    {
+        $this->resetApplicationWithConfig([
+            'sentry.traces_sample_rate' => 1,
+            'sentry.tracing.sql_queries' => true,
+            'sentry.tracing.sql_bindings' => true,
+        ]);
+
+        $this->assertTrue($this->app['config']->get('sentry.tracing.sql_bindings'));
+
+        $this->startTransaction();
+
+        $this->dispatchLaravelEvent(new QueryExecuted(
+            $query = 'SELECT * FROM spans WHERE bindings = ?;',
+            $bindings = ['1'],
+            10,
+            $this->getMockedConnection()
+        ));
+
+        $span = $this->getLastSentrySpan();
+
+        $this->assertEquals($query, $span->getDescription());
+        $this->assertEquals($bindings, $span->getData()['db.sql.bindings']);
+    }
+
+    public function testSqlBindingsAreRecordedWhenDisabled(): void
+    {
+        $this->resetApplicationWithConfig([
+            'sentry.traces_sample_rate' => 1,
+            'sentry.tracing.sql_queries' => true,
+            'sentry.tracing.sql_bindings' => false,
+        ]);
+
+        $this->assertFalse($this->app['config']->get('sentry.tracing.sql_bindings'));
+
+        $this->startTransaction();
+
+        $this->dispatchLaravelEvent(new QueryExecuted(
+            $query = 'SELECT * FROM spans WHERE bindings = ?;',
+            $bindings = ['1'],
+            10,
+            $this->getMockedConnection()
+        ));
+
+        $span = $this->getLastSentrySpan();
+
+        $this->assertEquals($query, $span->getDescription());
+        $this->assertFalse(isset($span->getData()['db.sql.bindings']));
+    }
+
     private function tryAllEventHandlerMethods(array $methods): void
     {
         $handler = new EventHandler([]);
@@ -48,4 +100,15 @@ private function getEventHandlerMapFromEventHandler()
 
         return $attributes['eventHandlerMap'];
     }
+
+    private function getMockedConnection()
+    {
+        $mock = Mockery::mock(Connection::class);
+        $mock->shouldReceive('getName')->andReturn('test');
+        $mock->shouldReceive('getDatabaseName')->andReturn('test');
+        $mock->shouldReceive('getDriverName')->andReturn('mysql');
+        $mock->shouldReceive('getConfig')->andReturn(['host' => '127.0.0.1', 'port' => 3306]);
+
+        return $mock;
+    }
 }