fix(asm): decouple appsec by christophe-papazian · Pull Request #12212 · DataDog/dd-trace-py

christophe-papazian · 2025-02-04T09:22:23Z

Second part of #12198

Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules).
Ensure we don't load iast modules if iast is disabled or unavailable.
Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation)
Add test on module loading with a mini flask application in tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled.
remove dead code in ddtrace/contrib/internal/langchain/patch.py

APPSEC-56626

(should be backported to 3.0 when possible)

Checklist

PR author has checked that all the criteria below are met
The PR description includes an overview of the change
The PR description articulates the motivation for the change
The change includes tests OR the PR description describes a testing strategy
The PR description notes risks associated with the change, if any
Newly-added code is easy to change
The change follows the library release note guidelines
The change includes or references documentation updates if necessary
Backport labels are set (if applicable)

Reviewer Checklist

Reviewer has checked that all the criteria below are met
Title is accurate
All changes are related to the pull request's stated goal
Avoids breaking API changes
Testing strategy adequately addresses listed risks
Newly-added code is easy to change
Release note makes sense to a user of the library
If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
Backport labels are set in a manner that is consistent with the release branch maintenance policy

pr-commenter · 2025-02-04T09:59:46Z

Benchmarks

Benchmark execution time: 2025-02-07 09:35:16

Comparing candidate commit 01ef338 in PR branch christophe-papazian/decouple_appsec_from_tracer with baseline commit 1247ac2 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 394 metrics, 2 unstable metrics.

…azian/decouple_appsec_from_tracer

github-actions · 2025-02-04T10:53:52Z

CODEOWNERS have been resolved as:

releasenotes/notes/ensure_no_appsec_loading-8ce46c58d6ecf81f.yaml       @DataDog/apm-python
tests/appsec/integrations/flask_tests/mini.py                           @DataDog/asm-python
tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py    @DataDog/asm-python
ddtrace/appsec/__init__.py                                              @DataDog/asm-python
ddtrace/appsec/_asm_request_context.py                                  @DataDog/asm-python
ddtrace/appsec/_common_module_patches.py                                @DataDog/asm-python
ddtrace/appsec/_constants.py                                            @DataDog/asm-python
ddtrace/appsec/_utils.py                                                @DataDog/asm-python
ddtrace/contrib/internal/httplib/patch.py                               @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/langchain/patch.py                             @DataDog/ml-observability
ddtrace/contrib/internal/mysql/patch.py                                 @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/mysqldb/patch.py                               @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/pytest/_plugin_v2.py                           @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/pytest/plugin.py                               @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/requests/patch.py                              @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/sqlalchemy/patch.py                            @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/sqlite3/patch.py                               @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/subprocess/patch.py                            @DataDog/asm-python
ddtrace/contrib/internal/urllib/patch.py                                @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/urllib3/patch.py                               @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/webbrowser/patch.py                            @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/internal/appsec/product.py                                      @DataDog/asm-python
ddtrace/internal/writer/writer.py                                       @DataDog/apm-core-python
ddtrace/settings/asm.py                                                 @DataDog/asm-python
hatch.toml                                                              @DataDog/python-guild
tests/appsec/integrations/flask_tests/test_iast_flask.py                @DataDog/asm-python
tests/contrib/subprocess/test_subprocess.py                             @DataDog/asm-python
tests/contrib/subprocess/test_subprocess_patch.py                       @DataDog/asm-python
tests/utils.py                                                          @DataDog/python-guild

…azian/decouple_appsec_from_tracer

datadog-dd-trace-py-rkomorn · 2025-02-04T13:06:06Z

Datadog Report

Branch report: christophe-papazian/decouple_appsec_from_tracer
Commit report: 01ef338
Test service: dd-trace-py

✅ 0 Failed, 130 Passed, 1184 Skipped, 4m 26.12s Total duration (24m 51.86s time saved)

…rom_tracer

+
+
+if __name__ == "__main__":
+    app.run(debug=True, port=8475)


To fix the problem, we need to ensure that the Flask application does not run in debug mode in a production environment. The best way to achieve this is to conditionally set the debug parameter based on an environment variable or a configuration setting that distinguishes between development and production environments.

We will:

Introduce an environment variable FLASK_DEBUG to control the debug mode.

Modify the app.run call to set debug based on the value of this environment variable.

Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) (cherry picked from commit fa18def)

Backport fa18def from #12212 to 3.0. Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com> Co-authored-by: Christophe Papazian <christophe.papazian@datadoghq.com>

github-actions · 2025-02-13T14:02:01Z

The backport to 2.20 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.20 2.20
# Navigate to the new working tree
cd .worktrees/backport-2.20
# Create a new branch
git switch --create backport-12212-to-2.20
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 fa18def52e13f863bd8de48cb8ef88feba0caf92
# Push it to GitHub
git push --set-upstream origin backport-12212-to-2.20
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.20

Then, create a pull request where the base branch is 2.20 and the compare/head branch is backport-12212-to-2.20.

Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) (cherry picked from commit fa18def)

Backport #12212 to 2.20 ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com>

…t 2.20] (#12270) Co-authored-by: Federico Mon <federico.mon@datadoghq.com> fix(asm): make sure iast is not loaded by exploit prevention if disabled [backport 2.20] (#12271) Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com> chore(asm): don't load appsec modules (iast)... [backport 2.20] (#12298) The goal is to make sure no appsec module is loaded if appsec is disabled. This PR is the first one of 2, handling IAST. It removes all non guarded IAST import from outside appsec. - ensure we don't load any iast module if iast is disabled - replace `_is_iast_enabled()` by a field `_iast_enabled` in the asm config APPSEC-56626 - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) (cherry picked from commit ea2a9a5) --------- Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com> Co-authored-by: Alberto Vara <alberto.vara@datadoghq.com> chore(asm): clean libddwaf loading [backport 2.20] (#12320) Backport 4f0bcb5 from #12102 to 2.20. Depending of the timing, libddwaf loading process could create triggers that would create loops in our instrumentation. From what I investigated: - if loaded too early, it could have bad interactions with gevent. - if loaded too late, it could be self instrumented by the tracer, creating a loop, as ctypes is using Popen and subprocess. while keeping the late loading introduced by 2 previous PRs - #11987 - #12013 this PR introduced a mechanism to bypass tracer instrumentation during ctypes loading, to avoid a possible loop that would prevent the WAF to be loaded. - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com> fix(asm): decouple appsec [backport 2.20] (#12319) Backport #12212 to 2.20 - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com> chore(iast): relase note of #12298 [backport 2.20] (#12317) Release note of the PR #12298 - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

fix(asm): decouple appsec [backport 2.21] (#12319) Backport #12212 to 2.21 ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

backports #11931 #12184 #12212 #12320 to 2.19 ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting) --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Christophe Papazian <114495376+christophe-papazian@users.noreply.github.com>

Second part of #12198 - Ensure we don't load appsec modules if appsec is disabled or unavailable (except for a few safe modules). - Ensure we don't load iast modules if iast is disabled or unavailable. - Ensure all initialisation logic for enable flags are handled in ddtrace.settings.asm (small factorisation) - Add test on module loading with a mini flask application in `tests/appsec/integrations/flask_tests/test_appsec_loading_modules.py`, checking with all possible combinations of appsec/iast/aws_lambda enabled or disabled. - remove dead code in `ddtrace/contrib/internal/langchain/patch.py` APPSEC-56626 (should be backported to 3.0 when possible) ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

decouple monkey

befa9ac

christophe-papazian added changelog/no-changelog A changelog entry is not required for this PR. ASM Application Security Monitoring labels Feb 4, 2025

christophe-papazian changed the base branch from main to 3.x-staging February 4, 2025 09:22

christophe-papazian added 2 commits February 4, 2025 11:10

Merge remote-tracking branch 'origin/3.x-staging' into christophe-pap…

f2d19ba

…azian/decouple_appsec_from_tracer

fix patch logic

abf96da

christophe-papazian added 3 commits February 4, 2025 12:58

import iast only if enabled in asm_request_context

27bee95

Merge remote-tracking branch 'origin/3.x-staging' into christophe-pap…

9e14f11

…azian/decouple_appsec_from_tracer

factor logic

ee6950d

christophe-papazian added 3 commits February 4, 2025 16:27

fix subprocess tests

bdca801

ensure patch is working on windows

517659d

ensure unpatch is guarded

f85e7d6

datadog-datadog-prod-us1 Bot reviewed Feb 4, 2025

View reviewed changes

Comment thread ddtrace/contrib/internal/subprocess/patch.py

christophe-papazian and others added 11 commits February 4, 2025 17:33

fix test

c0a5e17

fix selenium test

c460b93

disable subprocess patches when asm disabled

1582b13

enable subprocess patches when iast enabled

4532d04

ensure IAST is enabled at start for appsec_integrations_flask tests

5ec6f3b

disable iast explicitely when required

05de3c1

Merge branch '3.x-staging' into christophe-papazian/decouple_appsec_f…

31739c8

…rom_tracer

more iast guards on pytest and langchain. remove dead code

15a2561

complete decoupling

a265dd0

fix lint

20dbe8d

unpatch less strict

fed3053

datadog-datadog-prod-us1 Bot reviewed Feb 5, 2025

View reviewed changes

Comment thread ddtrace/contrib/internal/requests/patch.py

christophe-papazian and others added 2 commits February 6, 2025 10:29

revert test_serverless

0da9bea

Merge branch '3.x-staging' into christophe-papazian/decouple_appsec_f…

47e11f9

…rom_tracer

erikayasuda requested review from a team as code owners February 6, 2025 20:43

erikayasuda requested review from ManuelPalenzuelaDD and mabdinur February 6, 2025 20:43

Merge branch 'main' into christophe-papazian/decouple_appsec_from_tracer

01ef338

github-advanced-security AI found potential problems Feb 7, 2025

View reviewed changes

christophe-papazian added the backport 3.0 label Feb 7, 2025

christophe-papazian enabled auto-merge (squash) February 7, 2025 08:58

christophe-papazian merged commit fa18def into main Feb 7, 2025

christophe-papazian deleted the christophe-papazian/decouple_appsec_from_tracer branch February 7, 2025 11:54

github-actions Bot mentioned this pull request Feb 7, 2025

fix(asm): decouple appsec [backport 3.0] #12251

Merged

2 tasks

gnufede added the backport 2.20 label Feb 10, 2025

DataDog deleted a comment from github-actions Bot Feb 10, 2025

gnufede added backport 2.20 and removed backport 2.20 labels Feb 13, 2025

avara1986 mentioned this pull request Feb 13, 2025

fix(asm): decouple appsec [backport 2.20] #12319

Merged

2 tasks

gnufede mentioned this pull request Feb 14, 2025

fix(asm): decouple appsec and iast [backport 2.21] #12351

Merged

2 tasks

purple4reina mentioned this pull request Feb 14, 2025

Re-remove iast .so file. DataDog/datadog-lambda-python#560

Merged

11 tasks

avara1986 mentioned this pull request Feb 17, 2025

chore(appsec): don't load appsec modules (iast) [backport 2.19] #12350

Merged

2 tasks

@@ -35,2 +35,3 @@
             if __name__ == "__main__":
-                app.run(debug=True, port=8475)
+                debug_mode = os.getenv("FLASK_DEBUG", "false").lower() == "true"
+                app.run(debug=debug_mode, port=8475)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(asm): decouple appsec#12212

fix(asm): decouple appsec#12212
christophe-papazian merged 29 commits intomainfrom
christophe-papazian/decouple_appsec_from_tracer

christophe-papazian commented Feb 4, 2025 •

edited

Loading

Uh oh!

pr-commenter Bot commented Feb 4, 2025 •

edited

Loading

Uh oh!

github-actions Bot commented Feb 4, 2025 •

edited

Loading

Uh oh!

datadog-dd-trace-py-rkomorn Bot commented Feb 4, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Check failure

Copilot Autofix

github-actions Bot commented Feb 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

christophe-papazian commented Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Checklist

Reviewer Checklist

Uh oh!

pr-commenter Bot commented Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Uh oh!

github-actions Bot commented Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datadog-dd-trace-py-rkomorn Bot commented Feb 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Datadog Report

Uh oh!

Uh oh!

Uh oh!

Check failure

Copilot Autofix

github-actions Bot commented Feb 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

christophe-papazian commented Feb 4, 2025 •

edited

Loading

pr-commenter Bot commented Feb 4, 2025 •

edited

Loading

github-actions Bot commented Feb 4, 2025 •

edited

Loading

datadog-dd-trace-py-rkomorn Bot commented Feb 4, 2025 •

edited

Loading