fix(asm): make sure iast is not loaded by exploit prevention if disabled by christophe-papazian · Pull Request #12198 · DataDog/dd-trace-py

christophe-papazian · 2025-02-03T14:51:38Z

Make sure, if iast is disabled, that we don't load any iast modules in the common module mechanism used both by iast and exploit prevention.

APPSEC-56659

Checklist

PR author has checked that all the criteria below are met
The PR description includes an overview of the change
The PR description articulates the motivation for the change
The change includes tests OR the PR description describes a testing strategy
The PR description notes risks associated with the change, if any
Newly-added code is easy to change
The change follows the library release note guidelines
The change includes or references documentation updates if necessary
Backport labels are set (if applicable)

Reviewer Checklist

Reviewer has checked that all the criteria below are met
Title is accurate
All changes are related to the pull request's stated goal
Avoids breaking API changes
Testing strategy adequately addresses listed risks
Newly-added code is easy to change
Release note makes sense to a user of the library
If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
Backport labels are set in a manner that is consistent with the release branch maintenance policy

…endencies_if_serverless

…azian/remove_appsec_dependencies_if_serverless

…endencies_if_serverless

…rless' of github.com:DataDog/dd-trace-py into christophe-papazian/remove_appsec_dependencies_if_serverless

…endencies_if_serverless

github-actions · 2025-02-03T14:52:11Z

CODEOWNERS have been resolved as:

releasenotes/notes/no_IAST_unguarded_loading_in_common_module_patches-123cf6d3f8844823.yaml  @DataDog/apm-python
ddtrace/appsec/_common_module_patches.py                                @DataDog/asm-python
ddtrace/appsec/_iast/_iast_request_context.py                           @DataDog/asm-python

codecov-commenter · 2025-02-03T15:05:30Z

Codecov Report

Attention: Patch coverage is 11.18421% with 135 lines in your changes missing coverage. Please review.

Please upload report for BASE (3.x-staging@4d20460). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
...appsec/integrations/flask_tests/test_iast_flask.py	0.00%	36 Missing ⚠️
...tegrations/django_tests/test_django_appsec_iast.py	0.00%	31 Missing ⚠️
ddtrace/appsec/_common_module_patches.py	25.92%	20 Missing ⚠️
ddtrace/appsec/_iast/_handlers.py	0.00%	17 Missing ⚠️
tests/contrib/dbapi/test_dbapi_appsec.py	0.00%	6 Missing ⚠️
ddtrace/appsec/_iast/_pytest_plugin.py	0.00%	3 Missing ⚠️
ddtrace/settings/asm.py	25.00%	3 Missing ⚠️
...appsec/iast/fixtures/integration/main_configure.py	0.00%	3 Missing ⚠️
ddtrace/appsec/_iast/_iast_request_context.py	60.00%	2 Missing ⚠️
ddtrace/appsec/_iast/_loader.py	0.00%	2 Missing ⚠️
... and 8 more

Additional details and impacted files

@@              Coverage Diff               @@
##             3.x-staging   #12198   +/-   ##
==============================================
  Coverage               ?    8.85%           
==============================================
  Files                  ?     1598           
  Lines                  ?   134811           
  Branches               ?        0           
==============================================
  Hits                   ?    11942           
  Misses                 ?   122869           
  Partials               ?        0

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

…n_on_windows

pr-commenter · 2025-02-03T16:25:32Z

Benchmarks

Benchmark execution time: 2025-02-03 17:33:12

Comparing candidate commit 7cf5404 in PR branch christophe-papazian/exploit_prevention_on_windows with baseline commit 1419b2f in branch 3.x-staging.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 394 metrics, 2 unstable metrics.

Co-authored-by: Ramy Elkest <4thkest@gmail.com>

…n_on_windows

Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) (cherry picked from commit fa18def)

Backport fa18def from #12212 to 3.0. Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com> Co-authored-by: Christophe Papazian <christophe.papazian@datadoghq.com>

…led (#12198) Make sure, if iast is disabled, that we don't load any iast modules in the common module mechanism used both by iast and exploit prevention. APPSEC-56659 ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Ramy Elkest <4thkest@gmail.com> (cherry picked from commit 362fa22)

Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) (cherry picked from commit fa18def)

github-actions · 2025-02-14T14:02:57Z

The backport to 2.19 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.19 2.19
# Navigate to the new working tree
cd .worktrees/backport-2.19
# Create a new branch
git switch --create backport-12198-to-2.19
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 362fa22be2f7f6b61b023adb2aa56949aa163210
# Push it to GitHub
git push --set-upstream origin backport-12198-to-2.19
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.19

Then, create a pull request where the base branch is 2.19 and the compare/head branch is backport-12198-to-2.19.

…led (#12198) Make sure, if iast is disabled, that we don't load any iast modules in the common module mechanism used both by iast and exploit prevention. APPSEC-56659 - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Ramy Elkest <4thkest@gmail.com> (cherry picked from commit 362fa22)

## Description PR #12198 had the unintended consequence of not honoring `DD_IAST_ENABLED` if set after the `_common_module_patches.py` was evaluated. This make some tests (`ssrf` and probably others) to not run. This fixes the problem by moving `is_iast_request_enabled` and `_IAST_CONTEXT` to `asm_config`. ## Checklist - [X] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>

…led [backport 2.19] (#12352) backport #12198 to 2.19 Make sure, if iast is disabled, that we don't load any iast modules in the common module mechanism used both by iast and exploit prevention. APPSEC-56659 Co-authored-by: Ramy Elkest <4thkest@gmail.com> (cherry picked from commit 362fa22) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com>

…led (#12198) Make sure, if iast is disabled, that we don't load any iast modules in the common module mechanism used both by iast and exploit prevention. APPSEC-56659 ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Ramy Elkest <4thkest@gmail.com>

Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

## Description PR #12198 had the unintended consequence of not honoring `DD_IAST_ENABLED` if set after the `_common_module_patches.py` was evaluated. This make some tests (`ssrf` and probably others) to not run. This fixes the problem by moving `is_iast_request_enabled` and `_IAST_CONTEXT` to `asm_config`. ## Checklist - [X] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>

PR #12198 had the unintended consequence of not honoring `DD_IAST_ENABLED` if set after the `_common_module_patches.py` was evaluated. This make some tests (`ssrf` and probably others) to not run. This fixes the problem by moving `is_iast_request_enabled` and `_IAST_CONTEXT` to `asm_config`. - [X] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com> (cherry picked from commit 3940332)

Backport # 12323 to 2.21 ## Description PR #12198 had the unintended consequence of not honoring `DD_IAST_ENABLED` if set after the `_common_module_patches.py` was evaluated. This make some tests (`ssrf` and probably others) to not run. This fixes the problem by moving `is_iast_request_enabled` and `_IAST_CONTEXT` to `asm_config`. ## Checklist - [X] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) Co-authored-by: Juanjo Alvarez Martinez <juanjo.alvarezmartinez@datadoghq.com>

christophe-papazian and others added 10 commits January 31, 2025 14:00

replace is_iast_enable by setting in asm_config

c2f113e

fix tests

6a9cba3

Merge branch '3.x-staging' into christophe-papazian/remove_appsec_dep…

d9cf473

…endencies_if_serverless

Merge branch '3.x-staging' into christophe-papazian/remove_appsec_dep…

9271c33

…endencies_if_serverless

Merge remote-tracking branch 'origin/3.x-staging' into christophe-pap…

283ff87

…azian/remove_appsec_dependencies_if_serverless

Merge branch '3.x-staging' into christophe-papazian/remove_appsec_dep…

19c1dd0

…endencies_if_serverless

add windows check to iast_supported field

213531f

Merge branch 'christophe-papazian/remove_appsec_dependencies_if_serve…

bdf2f49

…rless' of github.com:DataDog/dd-trace-py into christophe-papazian/remove_appsec_dependencies_if_serverless

Merge branch '3.x-staging' into christophe-papazian/remove_appsec_dep…

4e94859

…endencies_if_serverless

ensure common_module_patches does not load iast if disabled

da2e90f

datadog-datadog-prod-us1 Bot reviewed Feb 3, 2025

View reviewed changes

Comment thread ddtrace/appsec/_iast/_iast_request_context.py

Comment thread ddtrace/appsec/_iast/taint_sinks/insecure_cookie.py

christophe-papazian changed the title ~~fix(asm): make sure iast is not loaded by exploit prevention if disabled.~~ fix(asm): make sure iast is not loaded by exploit prevention if disabled Feb 3, 2025

christophe-papazian added the ASM Application Security Monitoring label Feb 3, 2025

christophe-papazian and others added 4 commits February 3, 2025 16:28

update patch method for tests

520fbb6

Merge branch '3.x-staging' into christophe-papazian/exploit_preventio…

71bcf5b

…n_on_windows

partial revert of unnessary changes

dbda12e

add release notes

1fe3b45

christophe-papazian marked this pull request as ready for review February 3, 2025 16:19

christophe-papazian requested review from a team as code owners February 3, 2025 16:19

christophe-papazian requested review from lievan and vitor-de-araujo February 3, 2025 16:19

RamyElkest reviewed Feb 3, 2025

View reviewed changes

Comment thread ddtrace/appsec/_common_module_patches.py Outdated

gnufede reviewed Feb 3, 2025

View reviewed changes

Comment thread ddtrace/appsec/_common_module_patches.py

gnufede approved these changes Feb 3, 2025

View reviewed changes

Update ddtrace/appsec/_common_module_patches.py

e1b90c1

Co-authored-by: Ramy Elkest <4thkest@gmail.com>

christophe-papazian enabled auto-merge (squash) February 3, 2025 16:44

Merge branch '3.x-staging' into christophe-papazian/exploit_preventio…

7cf5404

…n_on_windows

christophe-papazian merged commit 362fa22 into 3.x-staging Feb 3, 2025

christophe-papazian deleted the christophe-papazian/exploit_prevention_on_windows branch February 3, 2025 17:34

christophe-papazian mentioned this pull request Feb 4, 2025

fix(asm): decouple appsec #12212

Merged

2 tasks

github-actions Bot mentioned this pull request Feb 7, 2025

fix(asm): decouple appsec [backport 3.0] #12251

Merged

2 tasks

gnufede added the backport 2.20 label Feb 10, 2025

github-actions Bot mentioned this pull request Feb 10, 2025

fix(asm): make sure iast is not loaded by exploit prevention if disabled [backport 2.20] #12271

Merged

2 tasks

juanjux mentioned this pull request Feb 13, 2025

chore(iast): fix IAST imports when under pytest #12323

Merged

2 tasks

avara1986 added the backport 2.19 label Feb 14, 2025

avara1986 mentioned this pull request Feb 14, 2025

fix(asm): make sure iast is not loaded by exploit prevention if disabled [backport 2.19] #12352

Merged

2 tasks

avara1986 mentioned this pull request Mar 17, 2025

chore(iast): fix IAST imports when under pytest [Backport 2.21] #12762

Merged

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(asm): make sure iast is not loaded by exploit prevention if disabled#12198

fix(asm): make sure iast is not loaded by exploit prevention if disabled#12198
christophe-papazian merged 16 commits into3.x-stagingfrom
christophe-papazian/exploit_prevention_on_windows

christophe-papazian commented Feb 3, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Feb 3, 2025 •

edited

Loading

Uh oh!

codecov-commenter commented Feb 3, 2025

Uh oh!

Uh oh!

pr-commenter Bot commented Feb 3, 2025 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Feb 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

christophe-papazian commented Feb 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Reviewer Checklist

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Feb 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov-commenter commented Feb 3, 2025

Codecov Report

Uh oh!

Uh oh!

pr-commenter Bot commented Feb 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Uh oh!

Uh oh!

github-actions Bot commented Feb 14, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

christophe-papazian commented Feb 3, 2025 •

edited

Loading

github-actions Bot commented Feb 3, 2025 •

edited

Loading

pr-commenter Bot commented Feb 3, 2025 •

edited

Loading