Skip to content

[BUG] Postgresql query obfuscation fails in queries using slices and bind params #49460

@dobegor

Description

@dobegor

Agent version

Datadog Tracer v2.3.0

Bug Report

Queries using Postgresql array access with slices syntax and parameter fail to be obfuscated by Datadog tracer due to incorrect/incomplete parser implementation.

Example log:

2026/04/16 14:05:55 Datadog Tracer v2.3.0 ERROR: Error obfuscating stats group resource "-- name: JobGetAvailable :many
WITH locked_jobs AS (
    SELECT
        id, args, attempt, attempted_at, attempted_by, created_at, errors, finalized_at, kind, max_attempts, metadata, priority, queue, state, scheduled_at, tags, unique_key, unique_states
    FROM
        river_job
    WHERE
        state = 'available'
        AND queue = $4::text
        AND scheduled_at <= coalesce($1::timestamptz, now())
    ORDER BY
        priority ASC,
        scheduled_at ASC,
        id ASC
    LIMIT $5::integer
    FOR UPDATE
    SKIP LOCKED
)
UPDATE
    river_job
SET
    state = 'running',
    attempt = river_job.attempt + 1,
    attempted_at = coalesce($1::timestamptz, now()),
    attempted_by = array_append(
        CASE WHEN array_length(river_job.attempted_by, 1) >= $2::int
        -- +2 instead of +1 because Postgres array indexing starts at 1, not 0.
        THEN river_job.attempted_by[array_length(river_job.attempted_by, 1) + 2 - $2:] -- <<---- ERROR IS HERE, parameter $2 plus slice access
        ELSE river_job.attempted_by
        END,
        $3::text
    )
FROM
    locked_jobs
WHERE
    river_job.id = locked_jobs.id
RETURNING
    river_job.id, river_job.args, river_job.attempt, river_job.attempted_at, river_job.attempted_by, river_job.created_at, river_job.errors, river_job.finalized_at, river_job.kind, river_job.max_attempts, river_job.metadata, river_job.priority, river_job.queue, river_job.state, river_job.scheduled_at, river_job.tags, river_job.unique_key, river_job.unique_states
": at position 944: bind variables should start with letters or digits, got "]" (93), 59 additional messages skipped (first occurrence: 16 Apr 26 14:04 UTC)

Reproduction Steps

Run a query using slice array access with a parameter (example) traced with Datadog tracer.

Agent configuration

No response

Operating System

No response

Other environment details

No response

Metadata

Metadata

Assignees

Labels

oss/0External contributions priority 0pendingLabel for issues waiting a Datadog member's response.team/agent-apmtrace-agent

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions