From 3af0214a576a2644121dab8c54fe72fb1fe4948f Mon Sep 17 00:00:00 2001 From: Oscar Le Dauphin Date: Fri, 3 Apr 2026 15:27:55 +0200 Subject: [PATCH 1/4] feat(trace): add SQLObfuscationMode in /info - used in CSS obfuscation --- pkg/trace/api/info.go | 2 ++ pkg/trace/api/info_test.go | 1 + 2 files changed, 3 insertions(+) diff --git a/pkg/trace/api/info.go b/pkg/trace/api/info.go index e4084a37e59c..f37a55215a24 100644 --- a/pkg/trace/api/info.go +++ b/pkg/trace/api/info.go @@ -41,6 +41,7 @@ type reducedObfuscationConfig struct { Mongo bool `json:"mongo"` SQLExecPlan bool `json:"sql_exec_plan"` SQLExecPlanNormalize bool `json:"sql_exec_plan_normalize"` + SQLObfuscationMode string `json:"sql_obfuscation_mode"` HTTP obfuscate.HTTPConfig `json:"http"` RemoveStackTraces bool `json:"remove_stack_traces"` Redis obfuscate.RedisConfig `json:"redis"` @@ -87,6 +88,7 @@ func (r *HTTPReceiver) makeInfoHandler() (hash string, handler http.HandlerFunc) oconf.Mongo = o.Mongo.Enabled oconf.SQLExecPlan = o.SQLExecPlan.Enabled oconf.SQLExecPlanNormalize = o.SQLExecPlanNormalize.Enabled + oconf.SQLObfuscationMode = r.conf.SQLObfuscationMode oconf.HTTP = o.HTTP oconf.RemoveStackTraces = o.RemoveStackTraces oconf.Redis = o.Redis diff --git a/pkg/trace/api/info_test.go b/pkg/trace/api/info_test.go index 0a3a05810675..2513e88cac46 100644 --- a/pkg/trace/api/info_test.go +++ b/pkg/trace/api/info_test.go @@ -347,6 +347,7 @@ func TestInfoHandler(t *testing.T) { "mongo": nil, "sql_exec_plan": nil, "sql_exec_plan_normalize": nil, + "sql_obfuscation_mode": nil, "http": map[string]any{ "remove_query_string": nil, "remove_path_digits": nil, From f44708e65317ec22274eb23aaef0f5fc5da1bce5 Mon Sep 17 00:00:00 2001 From: Oscar Le Dauphin Date: Mon, 13 Apr 2026 16:47:45 +0200 Subject: [PATCH 2/4] fix: call function to get actual sql obfuscation mode --- pkg/trace/api/info.go | 2 +- pkg/trace/config/config.go | 9 ++++++++- pkg/trace/config/config_test.go | 19 +++++++++++++++++++ 3 files changed, 28 insertions(+), 2 deletions(-) diff --git a/pkg/trace/api/info.go b/pkg/trace/api/info.go index f37a55215a24..0931c9fbec0d 100644 --- a/pkg/trace/api/info.go +++ b/pkg/trace/api/info.go @@ -88,7 +88,7 @@ func (r *HTTPReceiver) makeInfoHandler() (hash string, handler http.HandlerFunc) oconf.Mongo = o.Mongo.Enabled oconf.SQLExecPlan = o.SQLExecPlan.Enabled oconf.SQLExecPlanNormalize = o.SQLExecPlanNormalize.Enabled - oconf.SQLObfuscationMode = r.conf.SQLObfuscationMode + oconf.SQLObfuscationMode = r.conf.EffectiveSQLObfuscationMode() oconf.HTTP = o.HTTP oconf.RemoveStackTraces = o.RemoveStackTraces oconf.Redis = o.Redis diff --git a/pkg/trace/config/config.go b/pkg/trace/config/config.go index 7ecf3a183dec..cd91634d8a1e 100644 --- a/pkg/trace/config/config.go +++ b/pkg/trace/config/config.go @@ -152,6 +152,13 @@ func obfuscationMode(conf *AgentConfig, sqllexerEnabled bool) obfuscate.Obfuscat return "" } +// EffectiveSQLObfuscationMode returns the SQL obfuscation mode the agent +// actually uses at runtime. When SQLObfuscationMode is not explicitly set, +// the mode is derived from feature flags (e.g. sqllexer → obfuscate_only). +func (c *AgentConfig) EffectiveSQLObfuscationMode() string { + return string(obfuscationMode(c, c.HasFeature("sqllexer"))) +} + // Export returns an obfuscate.Config matching o. func (o *ObfuscationConfig) Export(conf *AgentConfig) obfuscate.Config { return obfuscate.Config{ @@ -160,7 +167,7 @@ func (o *ObfuscationConfig) Export(conf *AgentConfig) obfuscate.Config { ReplaceDigits: conf.HasFeature("quantize_sql_tables") || conf.HasFeature("replace_sql_digits"), KeepSQLAlias: conf.HasFeature("keep_sql_alias"), DollarQuotedFunc: conf.HasFeature("dollar_quoted_func"), - ObfuscationMode: obfuscationMode(conf, conf.HasFeature("sqllexer")), + ObfuscationMode: conf.EffectiveSQLObfuscationMode(), }, ES: o.ES, OpenSearch: o.OpenSearch, diff --git a/pkg/trace/config/config_test.go b/pkg/trace/config/config_test.go index 577c93e55318..d5dc89c99aeb 100644 --- a/pkg/trace/config/config_test.go +++ b/pkg/trace/config/config_test.go @@ -155,6 +155,25 @@ func TestSQLObfuscationMode(t *testing.T) { }) } +func TestEffectiveSQLObfuscationMode(t *testing.T) { + t.Run("sqllexer_enabled_no_explicit_mode", func(t *testing.T) { + cfg := New() + cfg.Features = map[string]struct{}{"sqllexer": {}} + // SQLObfuscationMode is empty; effective mode must be obfuscate_only + assert.Equal(t, string(obfuscate.ObfuscateOnly), cfg.EffectiveSQLObfuscationMode()) + }) + t.Run("explicit_mode_takes_precedence", func(t *testing.T) { + cfg := New() + cfg.Features = map[string]struct{}{"sqllexer": {}} + cfg.SQLObfuscationMode = string(obfuscate.ObfuscateAndNormalize) + assert.Equal(t, string(obfuscate.ObfuscateAndNormalize), cfg.EffectiveSQLObfuscationMode()) + }) + t.Run("no_sqllexer_no_explicit_mode", func(t *testing.T) { + cfg := New() + assert.Equal(t, "", cfg.EffectiveSQLObfuscationMode()) + }) +} + func TestInECSManagedInstancesSidecar(t *testing.T) { t.Setenv("DD_ECS_DEPLOYMENT_MODE", "sidecar") t.Setenv("AWS_EXECUTION_ENV", "AWS_ECS_MANAGED_INSTANCES") From 20a4c122699b85da6b032f9519b0439acbbeaa48 Mon Sep 17 00:00:00 2001 From: Oscar Le Dauphin Date: Mon, 13 Apr 2026 17:45:28 +0200 Subject: [PATCH 3/4] fix: lint --- pkg/trace/api/info.go | 2 +- pkg/trace/config/config.go | 4 ++-- pkg/trace/config/config_test.go | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pkg/trace/api/info.go b/pkg/trace/api/info.go index 0931c9fbec0d..7f792e13ae08 100644 --- a/pkg/trace/api/info.go +++ b/pkg/trace/api/info.go @@ -41,7 +41,7 @@ type reducedObfuscationConfig struct { Mongo bool `json:"mongo"` SQLExecPlan bool `json:"sql_exec_plan"` SQLExecPlanNormalize bool `json:"sql_exec_plan_normalize"` - SQLObfuscationMode string `json:"sql_obfuscation_mode"` + SQLObfuscationMode obfuscate.ObfuscationMode `json:"sql_obfuscation_mode"` HTTP obfuscate.HTTPConfig `json:"http"` RemoveStackTraces bool `json:"remove_stack_traces"` Redis obfuscate.RedisConfig `json:"redis"` diff --git a/pkg/trace/config/config.go b/pkg/trace/config/config.go index 2c67b3795d62..3295588ee3f9 100644 --- a/pkg/trace/config/config.go +++ b/pkg/trace/config/config.go @@ -155,8 +155,8 @@ func obfuscationMode(conf *AgentConfig, sqllexerEnabled bool) obfuscate.Obfuscat // EffectiveSQLObfuscationMode returns the SQL obfuscation mode the agent // actually uses at runtime. When SQLObfuscationMode is not explicitly set, // the mode is derived from feature flags (e.g. sqllexer → obfuscate_only). -func (c *AgentConfig) EffectiveSQLObfuscationMode() string { - return string(obfuscationMode(c, c.HasFeature("sqllexer"))) +func (c *AgentConfig) EffectiveSQLObfuscationMode() obfuscate.ObfuscationMode { + return obfuscationMode(c, c.HasFeature("sqllexer")) } // Export returns an obfuscate.Config matching o. diff --git a/pkg/trace/config/config_test.go b/pkg/trace/config/config_test.go index d5dc89c99aeb..3cedc6fa189a 100644 --- a/pkg/trace/config/config_test.go +++ b/pkg/trace/config/config_test.go @@ -160,13 +160,13 @@ func TestEffectiveSQLObfuscationMode(t *testing.T) { cfg := New() cfg.Features = map[string]struct{}{"sqllexer": {}} // SQLObfuscationMode is empty; effective mode must be obfuscate_only - assert.Equal(t, string(obfuscate.ObfuscateOnly), cfg.EffectiveSQLObfuscationMode()) + assert.Equal(t, obfuscate.ObfuscateOnly, cfg.EffectiveSQLObfuscationMode()) }) t.Run("explicit_mode_takes_precedence", func(t *testing.T) { cfg := New() cfg.Features = map[string]struct{}{"sqllexer": {}} cfg.SQLObfuscationMode = string(obfuscate.ObfuscateAndNormalize) - assert.Equal(t, string(obfuscate.ObfuscateAndNormalize), cfg.EffectiveSQLObfuscationMode()) + assert.Equal(t, obfuscate.ObfuscateAndNormalize, cfg.EffectiveSQLObfuscationMode()) }) t.Run("no_sqllexer_no_explicit_mode", func(t *testing.T) { cfg := New() From dfb3c5b398a56e710bbc8b42cdef2ac8bc685bf1 Mon Sep 17 00:00:00 2001 From: Oscar Le Dauphin Date: Mon, 13 Apr 2026 18:09:42 +0200 Subject: [PATCH 4/4] fix(trace/config): fix type mismatch in TestEffectiveSQLObfuscationMode test The test was comparing a plain string "" to obfuscate.ObfuscationMode(""), which caused a type assertion failure with testify's assert.Equal. Use the correct ObfuscationMode type in the assertion. --- pkg/trace/config/config_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/trace/config/config_test.go b/pkg/trace/config/config_test.go index 3cedc6fa189a..44bf4b43f58a 100644 --- a/pkg/trace/config/config_test.go +++ b/pkg/trace/config/config_test.go @@ -170,7 +170,7 @@ func TestEffectiveSQLObfuscationMode(t *testing.T) { }) t.Run("no_sqllexer_no_explicit_mode", func(t *testing.T) { cfg := New() - assert.Equal(t, "", cfg.EffectiveSQLObfuscationMode()) + assert.Equal(t, obfuscate.ObfuscationMode(""), cfg.EffectiveSQLObfuscationMode()) }) }