Sanitise SQL queries in collector mode

When `set_sql_body` is used in collector mode, emit attributes
following the OpenTelemetry Semantic Conventions for Database Spans,
as the collector expects, rather than the `appsignal.sql_body`
attribute that the agent expects.

Author: unflxw

.changesets/sanitize-sql-body-in-collector-mode.md

@@ -0,0 +1,9 @@
+---
+bump: patch
+type: fix
+---
+
+Emit the `db.system.name` and `db.query.text` semantic-convention attributes
+instead of `appsignal.sql_body` when `set_sql_body` is used in collector
+mode. This fixes SQL query sanitization when using the experimental collector
+mode. 

src/appsignal/tracing.py

@@ -101,7 +101,14 @@ def set_body(body: str, span: Span | None = None) -> None:
 
 
 def set_sql_body(body: str, span: Span | None = None) -> None:
-    _set_attribute("appsignal.sql_body", body, span)
+    # The collector sanitizes SQL via the `db.query.text` attribute, gated on
+    # `db.system.name` being set to a recognized SQL system. The agent
+    # sanitizes via the `appsignal.sql_body` magic attribute.
+    if _use_collector():
+        _set_attribute("db.system.name", "other_sql", span)
+        _set_attribute("db.query.text", body, span)
+    else:
+        _set_attribute("appsignal.sql_body", body, span)
 
 
 def set_namespace(namespace: str, span: Span | None = None) -> None:

tests/test_tracing.py

@@ -3,8 +3,6 @@
 from opentelemetry import trace
 from opentelemetry.trace import StatusCode
 
-from appsignal.client import Client
-
 from appsignal import (
     send_error,
     send_error_with_context,
@@ -21,6 +19,7 @@
     set_sql_body,
     set_tag,
 )
+from appsignal.client import Client
 
 
 tracer = trace.get_tracer("appsignal/tests")
@@ -98,6 +97,23 @@ def test_set_name_collector_mode(spans):
     assert "appsignal.name" not in dict(span.attributes)
 
 
+def test_set_sql_body_collector_mode(spans):
+    Client(
+        active=True,
+        name="MyApp",
+        push_api_key="0000-0000-0000-0000",
+        collector_endpoint="https://custom-endpoint.appsignal.com",
+    )
+
+    with tracer.start_as_current_span("span"):
+        set_sql_body("SELECT * FROM users")
+
+    attributes = dict(spans()[0].attributes)
+    assert attributes["db.system.name"] == "other_sql"
+    assert attributes["db.query.text"] == "SELECT * FROM users"
+    assert "appsignal.sql_body" not in attributes
+
+
 def test_set_attributes_on_span(spans):
     with tracer.start_as_current_span("parent span") as span:
         with tracer.start_as_current_span("child span"):