Skip to content

chore(iast): fix IAST imports when under pytest [Backport 2.21]#12762

Merged
avara1986 merged 3 commits into
2.21from
backport-12323-to-2.21
Mar 17, 2025
Merged

chore(iast): fix IAST imports when under pytest [Backport 2.21]#12762
avara1986 merged 3 commits into
2.21from
backport-12323-to-2.21

Conversation

@avara1986

Copy link
Copy Markdown
Member

Backport # 12323 to 2.21

Description

PR #12198 had the unintended consequence of not honoring DD_IAST_ENABLED if set after the _common_module_patches.py was evaluated. This make some tests (ssrf and probably others) to not run. This fixes the problem by moving is_iast_request_enabled and _IAST_CONTEXT to asm_config.

Checklist

  • PR author has checked that all the criteria below are met
  • The PR description includes an overview of the change
  • The PR description articulates the motivation for the change
  • The change includes tests OR the PR description describes a testing strategy
  • The PR description notes risks associated with the change, if any
  • Newly-added code is easy to change
  • The change follows the library release note guidelines
  • The change includes or references documentation updates if necessary
  • Backport labels are set (if applicable)

Reviewer Checklist

  • Reviewer has checked that all the criteria below are met
  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Newly-added code is easy to change
  • Release note makes sense to a user of the library
  • If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

PR #12198 had the unintended consequence of not honoring
`DD_IAST_ENABLED` if set after the `_common_module_patches.py` was
evaluated. This make some tests (`ssrf` and probably others) to not run.
This fixes the problem by moving `is_iast_request_enabled` and
`_IAST_CONTEXT` to `asm_config`.

- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
(cherry picked from commit 3940332)
Comment thread ddtrace/appsec/_iast/taint_sinks/insecure_cookie.py
@github-actions

Copy link
Copy Markdown
Contributor

CODEOWNERS have been resolved as:

ddtrace/appsec/_common_module_patches.py                                @DataDog/asm-python
ddtrace/appsec/_constants.py                                            @DataDog/asm-python
ddtrace/appsec/_iast/_handlers.py                                       @DataDog/asm-python
ddtrace/appsec/_iast/_iast_request_context.py                           @DataDog/asm-python
ddtrace/appsec/_iast/_patches/json_tainting.py                          @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/_taint_objects.py                  @DataDog/asm-python
ddtrace/appsec/_iast/reporter.py                                        @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/_base.py                               @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/code_injection.py                      @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/command_injection.py                   @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/header_injection.py                    @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/insecure_cookie.py                     @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/path_traversal.py                      @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/ssrf.py                                @DataDog/asm-python
ddtrace/settings/asm.py                                                 @DataDog/asm-python

@avara1986 avara1986 added changelog/no-changelog A changelog entry is not required for this PR. ASM Application Security Monitoring labels Mar 17, 2025
@avara1986 avara1986 marked this pull request as ready for review March 17, 2025 15:00
@avara1986 avara1986 requested a review from a team as a code owner March 17, 2025 15:00
@pr-commenter

pr-commenter Bot commented Mar 17, 2025

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2025-03-17 15:10:15

Comparing candidate commit 394f2fb in PR branch backport-12323-to-2.21 with baseline commit e33ac7c in branch 2.21.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 418 metrics, 2 unstable metrics.

@avara1986 avara1986 merged commit e7a8d99 into 2.21 Mar 17, 2025
@avara1986 avara1986 deleted the backport-12323-to-2.21 branch March 17, 2025 15:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ASM Application Security Monitoring changelog/no-changelog A changelog entry is not required for this PR.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants