next is red: queue_depth.go calls (*gorm.DB).Scan, which interpolates bound values into logged SQL #234

New Issue

clawbot · 2026-08-20T07:31:29+02:00

clawbot commented

2026-08-20 07:31:29 +02:00

next at aba02bc fails make check on its own, with no branch applied.

--- FAIL: TestGormScanIsNeverCalledOutsideTests (0.15s)
    Error: Should be empty, but was
      [internal/delivery/queue_depth.go:109:3 internal/delivery/queue_depth.go:161:3]
FAIL	sneak.berlin/go/webhooker/internal/gormlog	0.889s

Both call sites are in internal/delivery/queue_depth.go, which arrived
with the queue-depth metrics work. internal/gormlog/scan_guard_test.go
exists because (*gorm.DB).Scan swaps GORM's own trace recorder in for
the logging adapter, and that recorder does not implement
gorm.ParamsFilter — so the statement is logged with its bound values
interpolated, bypassing (*Logger).ParamsFilter. The guard is the only
thing holding that invariant.

The second call site binds a status IN ? list of delivery statuses,
so today's leak is low-value; the point of the guard is that the next
call site added by copying this pattern will not be.

The fix per the guard's own message is Find, Pluck, or
Raw(...).Row().Scan.

Reproduced by checking out origin/next clean and running make check
— it is not caused by any open branch. Found while running the gate for
#228, whose branch inherits the
failure through its rebase; nothing in that branch touches
internal/delivery/queue_depth.go or internal/gormlog.

`next` at `aba02bc` fails `make check` on its own, with no branch applied. ``` --- FAIL: TestGormScanIsNeverCalledOutsideTests (0.15s) Error: Should be empty, but was [internal/delivery/queue_depth.go:109:3 internal/delivery/queue_depth.go:161:3] FAIL sneak.berlin/go/webhooker/internal/gormlog 0.889s ``` Both call sites are in `internal/delivery/queue_depth.go`, which arrived with the queue-depth metrics work. `internal/gormlog/scan_guard_test.go` exists because `(*gorm.DB).Scan` swaps GORM's own trace recorder in for the logging adapter, and that recorder does not implement `gorm.ParamsFilter` — so the statement is logged with its bound values interpolated, bypassing `(*Logger).ParamsFilter`. The guard is the only thing holding that invariant. The second call site binds a `status IN ?` list of delivery statuses, so today's leak is low-value; the point of the guard is that the next call site added by copying this pattern will not be. The fix per the guard's own message is `Find`, `Pluck`, or `Raw(...).Row().Scan`. Reproduced by checking out `origin/next` clean and running `make check` — it is not caused by any open branch. Found while running the gate for https://git.eeqj.de/sneak/webhooker/pulls/228, whose branch inherits the failure through its rebase; nothing in that branch touches `internal/delivery/queue_depth.go` or `internal/gormlog`.