Security/Privacy Bug Fix: SQL command collection off by default [change in behavior]

[TimothyMothra]

We're introducing a new change in 2.14 which will disable the collection SQL command text by default.
We understand this will likely be a breaking change for many customers, but this is being addressed as a security and privacy bug fix.

This will be introduced in 2.14-Beta1 and the stable release will be early April.

Before then we MUST update public documentation and add a post on our Announcements repo.
We will discuss with PMs to consider a blog post about this breaking change.

[TimothyMothra]

#1514

[TimothyMothra]

@Dmitry-Matveev @reyang @ank3it

[cijothomas]

@TimothyMothra Lets mention explicitly that this only affects .NET Core apps. For .NET Framework, SQL command was not collected by default and required additional steps.

[cijothomas]

https://github.com/microsoft/ApplicationInsights-Announcements/issues - we can announce it here instead of a blog post?

[stebet]

@TimothyMothra Lets mention explicitly that this only affects .NET Core apps. For .NET Framework, SQL command was not collected by default and required additional steps.

This does affect the .NET Framework as well, since the SQL Command can now be collected when using the Microsoft.Data.SqlClient package.

[cijothomas]

I meant "Off by default" is a new behavior for .NET Core. For .NET Framework, it was always "Off by default".

Agree that doc should cover the new way to turn on SQL Text for .NET Framework.

[stebet]

It's on by default in the .NET Framework if you use the latest release of the Microsoft.Data.SqlClient libs. It's why I submitted #1723

[cijothomas]

@stebet
https://github.com/microsoft/ApplicationInsights-dotnet/blob/develop/WEB/Src/DependencyCollector/Shared/DependencyTrackingTelemetryModule.cs#L76

This shows the default value is false?
For .NET framework, using MS.Data.SqlClient also, one has to turn this ON to get full query, right?

[stebet]

Yeah, my point was that before this change, if you referenced Microsoft.Data.SqlClient, you will get full SQL statements on .NET Framework, so this will affect those scenarios as well, even if they were just recently possible.

[cijothomas]

Got it. Thanks for clarifying.

[TimothyMothra]

Just an update,

@ank3it is working on public announcements about this issue.
He posted an announcement here: microsoft/ApplicationInsights-Announcements#28
There will be an official blog post soon.

I'm working on the release and this will be published to NuGet this week. :)

[TimothyMothra]

TODO:
Need to follow up with Attach Teams (App Service and Functions)

• need to update to our SDK v2.14
• will need a config change (opt-in)
• need to update SqlClient dependency

[TimothyMothra]

Reopening this.
I think we need to update this page has well: https://docs.microsoft.com/azure/azure-monitor/app/asp-net-dependencies

@cijothomas, @ank3it lets discuss in our next standup