Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: remove postgres example (security) #2171

Conversation

pichlermarc
Copy link
Member

@pichlermarc pichlermarc commented May 2, 2024

The @opentelemetry/instrumentation-postgres example is outdated (OTel setup gets a tracer from the setup file instead of directly via the API) and (more importantly) the example server shows a questionable approach in building the SQL statement based on unsanitized user input. It's not exploitable as it's just an example (hence the Public PR) but I think it's still important to keep this out of examples 🙂

Happy to approve PRs re-adding an updated example in the future.

Edit: This also resolves a CodeQL alert and warnings that may be picked up by other automated code-scanning tools.

@pichlermarc pichlermarc requested a review from a team May 2, 2024 11:28
Copy link

codecov bot commented May 2, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.09%. Comparing base (dfb2dff) to head (4571574).
Report is 101 commits behind head on main.

❗ Current head 4571574 differs from pull request most recent head 79f6122. Consider uploading reports for the commit 79f6122 to get more accurate results

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2171      +/-   ##
==========================================
- Coverage   90.97%   90.09%   -0.89%     
==========================================
  Files         146      140       -6     
  Lines        7492     6974     -518     
  Branches     1502     1473      -29     
==========================================
- Hits         6816     6283     -533     
- Misses        676      691      +15     

see 48 files with indirect coverage changes

@pichlermarc pichlermarc merged commit 6e6ef62 into open-telemetry:main May 2, 2024
13 checks passed
@pichlermarc pichlermarc deleted the fix/remove-postgres-example branch May 2, 2024 12:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants