fix(persistence): hide SQL parameters in failure logs - #1336
Merged
PsiACE merged 1 commit intoAug 24, 2026
Conversation
Enable SQLAlchemy parameter hiding for SQLite, OceanBase, and SeekDB engines to prevent Memory content from appearing in failure tracebacks. Add regression coverage for formatted Server logs and engine configuration. Refs oceanbase#1318
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Which issue or RFC does this PR close?
Closes #1318
Rationale for this change
Unexpected database failures could include SQLAlchemy bound parameters in exception tracebacks. Because the Server logs the original exception with
exc_info, complete Memory content could be written to Server logs.This violates the data-safety contract in RFC 0046. SQL parameters must be hidden while preserving safe diagnostic information such as the error category and traceback.
What changes are included in this PR?
hide_parameters=Truefor the SQLite, OceanBase, and SeekDB SQLAlchemy engines.Are there any user-facing changes?
There are no end-user API or behavior changes.
For operators, database failure logs now hide SQL bound parameter values while retaining the SQL template, error category, traceback, operation metadata, and request context.
How was this change tested?
Targeted regression tests:
Result:
3 passedFull validation:
make check make test git diff --checkResult:
695 passed, 9 skippedAI usage statement
OpenAI Codex (GPT-5.6 Sol) was used to analyze the issue, inspect the affected persistence and logging paths, implement the fix and regression tests, run validation, and review the resulting diff.