Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(iast): fix IAST imports when under pytest #12323

Merged
merged 17 commits into from
Feb 14, 2025

Conversation

juanjux
Copy link
Collaborator

@juanjux juanjux commented Feb 13, 2025

Description

PR #12198 had the unintended consequence of not honoring DD_IAST_ENABLED if set after the _common_module_patches.py was evaluated. This make some tests (ssrf and probably others) to not run. This fixes the problem by moving is_iast_request_enabled and _IAST_CONTEXT to asm_config.

Checklist

  • PR author has checked that all the criteria below are met
  • The PR description includes an overview of the change
  • The PR description articulates the motivation for the change
  • The change includes tests OR the PR description describes a testing strategy
  • The PR description notes risks associated with the change, if any
  • Newly-added code is easy to change
  • The change follows the library release note guidelines
  • The change includes or references documentation updates if necessary
  • Backport labels are set (if applicable)

Reviewer Checklist

  • Reviewer has checked that all the criteria below are met
  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Newly-added code is easy to change
  • Release note makes sense to a user of the library
  • If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

Signed-off-by: Juanjo Alvarez <[email protected]>
Signed-off-by: Juanjo Alvarez <[email protected]>
@juanjux juanjux added the ASM Application Security Monitoring label Feb 13, 2025
@juanjux juanjux self-assigned this Feb 13, 2025
@juanjux juanjux requested a review from a team as a code owner February 13, 2025 16:41
Signed-off-by: Juanjo Alvarez <[email protected]>
Copy link
Contributor

github-actions bot commented Feb 13, 2025

CODEOWNERS have been resolved as:

ddtrace/appsec/_asm_request_context.py                                  @DataDog/asm-python
ddtrace/appsec/_common_module_patches.py                                @DataDog/asm-python
ddtrace/appsec/_constants.py                                            @DataDog/asm-python
ddtrace/appsec/_iast/_handlers.py                                       @DataDog/asm-python
ddtrace/appsec/_iast/_iast_request_context.py                           @DataDog/asm-python
ddtrace/appsec/_iast/_patches/json_tainting.py                          @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/_taint_objects.py                  @DataDog/asm-python
ddtrace/appsec/_iast/reporter.py                                        @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/_base.py                               @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/code_injection.py                      @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/command_injection.py                   @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/header_injection.py                    @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/insecure_cookie.py                     @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/path_traversal.py                      @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/ssrf.py                                @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/xss.py                                 @DataDog/asm-python
ddtrace/settings/asm.py                                                 @DataDog/asm-python

@juanjux juanjux added the changelog/no-changelog A changelog entry is not required for this PR. label Feb 13, 2025
@pr-commenter
Copy link

pr-commenter bot commented Feb 13, 2025

Benchmarks

Benchmark execution time: 2025-02-14 13:58:51

Comparing candidate commit 03b0465 in PR branch juanjux/fix-iast-imports-in-pytests with baseline commit 05c9824 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 394 metrics, 2 unstable metrics.

@juanjux
Copy link
Collaborator Author

juanjux commented Feb 14, 2025

Moving to draft, will be rewritten with a less clumsy implementation.

@juanjux juanjux marked this pull request as draft February 14, 2025 11:41
@juanjux juanjux marked this pull request as ready for review February 14, 2025 12:12
Signed-off-by: Juanjo Alvarez <[email protected]>
Signed-off-by: Juanjo Alvarez <[email protected]>
Signed-off-by: Juanjo Alvarez <[email protected]>
@juanjux juanjux enabled auto-merge (squash) February 14, 2025 12:38
ddtrace/settings/asm.py Outdated Show resolved Hide resolved
Signed-off-by: Juanjo Alvarez <[email protected]>
Signed-off-by: Juanjo Alvarez <[email protected]>
Signed-off-by: Juanjo Alvarez <[email protected]>
@juanjux juanjux merged commit 3940332 into main Feb 14, 2025
369 of 371 checks passed
@juanjux juanjux deleted the juanjux/fix-iast-imports-in-pytests branch February 14, 2025 14:50
gnufede pushed a commit that referenced this pull request Feb 19, 2025
## Description

PR #12198 had the unintended consequence of not honoring
`DD_IAST_ENABLED` if set after the `_common_module_patches.py` was
evaluated. This make some tests (`ssrf` and probably others) to not run.
This fixes the problem by moving `is_iast_request_enabled` and
`_IAST_CONTEXT` to `asm_config`.


## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
RamyElkest pushed a commit that referenced this pull request Feb 20, 2025
## Description

PR #12198 had the unintended consequence of not honoring
`DD_IAST_ENABLED` if set after the `_common_module_patches.py` was
evaluated. This make some tests (`ssrf` and probably others) to not run.
This fixes the problem by moving `is_iast_request_enabled` and
`_IAST_CONTEXT` to `asm_config`.


## Checklist
- [X] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ASM Application Security Monitoring changelog/no-changelog A changelog entry is not required for this PR.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants