chore(iast): fix all known memleaks in the native module + safety fixes

[juanjux]

Signed-off-by: Juanjo Alvarez [email protected]

Description

• Move the TaintedObjectPtr from TaintedObject* to share_ptr<TaintedObject>. This fixes the infamous flask-appsec-iast-p100 leak on the add_aspect.
• Fix a leak when iterating a Py_List on AspectJoin.
• Handle a missing case in AspectOperatorAdd.
• Fix leak in args_are_text_and_same_type.
• Add some nullptr-checks.

Thanks @avara1986 for the joint work on this.

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

ddtrace/appsec/_iast/_taint_tracking/tests/test_add_aspect.cpp          @DataDog/asm-python
.gitignore                                                              @DataDog/apm-core-python
ddtrace/appsec/_iast/_taint_tracking/Aspects/AspectJoin.cpp             @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Aspects/AspectOperatorAdd.cpp      @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Initializer/Initializer.cpp        @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Initializer/Initializer.h          @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/TaintTracking/TaintRange.cpp       @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/TaintTracking/TaintRange.h         @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/TaintTracking/TaintedObject.cpp    @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/TaintTracking/TaintedObject.h      @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Utils/StringUtils.cpp              @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Utils/StringUtils.h                @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/tests/test_common.hpp              @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/tests/test_helpers.cpp             @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/tests/test_index_aspect.cpp        @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/tests/test_other.cpp               @DataDog/asm-python
scripts/iast/mod_leak_functions.py                                      @DataDog/asm-python

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-10-07 09:39:52

Comparing candidate commit 75458b3 in PR branch juanjux/leak-in-add-aspect with baseline commit dc1dc3a in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 194 metrics, 2 unstable metrics.

[github-actions]

The backport to 2.13 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.13 2.13
# Navigate to the new working tree
cd .worktrees/backport-2.13
# Create a new branch
git switch --create backport-10947-to-2.13
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 c4cfa38673986f41ddb82aa7d027375040ae5c3a
# Push it to GitHub
git push --set-upstream origin backport-10947-to-2.13
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.13

Then, create a pull request where the base branch is 2.13 and the compare/head branch is backport-10947-to-2.13.

[github-actions]

The backport to 2.14 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.14 2.14
# Navigate to the new working tree
cd .worktrees/backport-2.14
# Create a new branch
git switch --create backport-10947-to-2.14
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 c4cfa38673986f41ddb82aa7d027375040ae5c3a
# Push it to GitHub
git push --set-upstream origin backport-10947-to-2.14
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.14

Then, create a pull request where the base branch is 2.14 and the compare/head branch is backport-10947-to-2.14.