Obfuscate the :name placeholders in PDO away for DBM correlation

Author: bwoebi

src/DDTrace/Integrations/PDO/PDOIntegration.php

@@ -128,6 +128,8 @@ public static function init(): int
 
             PDOIntegration::injectDBIntegration($instance, $hook, true);
             PDOIntegration::handleRasp($instance, $span);
+
+            $span->resource = PDOIntegration::useQuestionMarkPlaceholders($span->resource);
         }, static function (HookData $hook) {
             $pdo = $hook->returned;
             ObjectKVStore::propagate($hook->instance, $pdo, PDOIntegration::CONNECTION_TAGS_KEY);
@@ -170,6 +172,8 @@ static function (HookData $hook) {
                 PDOIntegration::setCommonSpanInfo($instance, $span);
                 PDOIntegration::addTraceAnalyticsIfEnabled($span);
                 PDOIntegration::detectError($instance, $span);
+
+                $span->resource = PDOIntegration::useQuestionMarkPlaceholders($span->resource);
             }
         );
 
@@ -352,4 +356,10 @@ function_exists('datadog\appsec\push_addresses');
         );
         \datadog\appsec\push_addresses($addresses, "sqli");
     }
+
+    public static function useQuestionMarkPlaceholders($query)
+    {
+        // Regex according to rules from pdo_sql_parser.re
+        return \preg_replace('((?:/\*([^*]++|\*++[^/])*\*/(*COMMIT)|--.*(*SKIP)(*F)|"(?:""|[^"]++)*"(*COMMIT)|\'(?:\'\'|[^\']++)*\'(*COMMIT)|[^/:\'"-]++|.)*?\K:[a-zA-Z0-9_]+)s', "?", $query);
+    }
 }

tests/Integrations/PDO/PDOTest.php

@@ -415,11 +415,11 @@ public function testPDOCommit()
 
     public function testPDOStatementOk()
     {
-        $query = "SELECT * FROM tests WHERE id = ?";
+        $query = "SELECT * FROM tests WHERE id = :param";
         $traces = $this->isolateTracer(function () use ($query) {
             $pdo = $this->pdoInstance();
             $stmt = $pdo->prepare($query);
-            $stmt->execute([1]);
+            $stmt->execute(["param" => 1]);
             $results = $stmt->fetchAll();
             $this->assertEquals('Tom', $results[0]['name']);
             $stmt->closeCursor();