Skip to content

fix(iast): invalid f-string type conversions exception in format_value_aspect #13156

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Apr 11, 2025

Conversation

avara1986
Copy link
Member

@avara1986 avara1986 commented Apr 10, 2025

This fixes a bug with f-strings when IAST is enabled: when building an invalid string that should raise an "Unknown format code X" exception, the error wasn't being triggered in certain cases. like

 f"{text:05d}"

Should raise a ValueError("Unknown format code 'd' for object of type 'str'")

Checklist

  • PR author has checked that all the criteria below are met
  • The PR description includes an overview of the change
  • The PR description articulates the motivation for the change
  • The change includes tests OR the PR description describes a testing strategy
  • The PR description notes risks associated with the change, if any
  • Newly-added code is easy to change
  • The change follows the library release note guidelines
  • The change includes or references documentation updates if necessary
  • Backport labels are set (if applicable)

Reviewer Checklist

  • Reviewer has checked that all the criteria below are met
  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Newly-added code is easy to change
  • Release note makes sense to a user of the library
  • If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

Copy link
Contributor

github-actions bot commented Apr 10, 2025

CODEOWNERS have been resolved as:

releasenotes/notes/iast-fstring-exception-d460a37b6e44f972.yaml         @DataDog/apm-python
ddtrace/appsec/_iast/_taint_tracking/aspects.py                         @DataDog/asm-python
tests/appsec/iast/aspects/test_str_py3.py                               @DataDog/asm-python

@avara1986 avara1986 changed the title fix(iast): excluded exception on invalid f-string fix(iast): Handle invalid f-string type conversions exception in format_value_aspect Apr 10, 2025
Copy link
Contributor

github-actions bot commented Apr 10, 2025

Bootstrap import analysis

Comparison of import times between this PR and base.

Summary

The average import time from this PR is: 237 ± 4 ms.

The average import time from base is: 240 ± 5 ms.

The import time difference between this PR and base is: -3.0 ± 0.2 ms.

Import time breakdown

The following import paths have shrunk:

ddtrace.auto 2.025 ms (0.86%)
ddtrace.bootstrap.sitecustomize 1.358 ms (0.57%)
ddtrace.bootstrap.preload 1.358 ms (0.57%)
ddtrace.internal.products 1.358 ms (0.57%)
ddtrace.internal.remoteconfig.client 0.652 ms (0.28%)
ddtrace 0.667 ms (0.28%)

@avara1986 avara1986 changed the title fix(iast): Handle invalid f-string type conversions exception in format_value_aspect fix(iast): invalid f-string type conversions exception in format_value_aspect Apr 10, 2025
@pr-commenter
Copy link

pr-commenter bot commented Apr 10, 2025

Benchmarks

Benchmark execution time: 2025-04-10 18:12:46

Comparing candidate commit fef883b in PR branch avara1986/fstring_exception with baseline commit 9d2d4e6 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 496 metrics, 2 unstable metrics.

@avara1986 avara1986 marked this pull request as ready for review April 10, 2025 14:26
@avara1986 avara1986 requested review from a team as code owners April 10, 2025 14:26
@avara1986 avara1986 added the ASM Application Security Monitoring label Apr 10, 2025
@avara1986 avara1986 merged commit f807b8e into main Apr 11, 2025
392 checks passed
@avara1986 avara1986 deleted the avara1986/fstring_exception branch April 11, 2025 11:18
github-actions bot pushed a commit that referenced this pull request Apr 11, 2025
…e_aspect (#13156)

This fixes a bug with f-strings when IAST is enabled: when building an
invalid string that should raise an "Unknown format code X" exception,
the error wasn't being triggered in certain cases. like
```
 f"{text:05d}"
```
Should raise a ValueError("Unknown format code 'd' for object of type
'str'")

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Co-authored-by: Munir Abdinur <[email protected]>
(cherry picked from commit f807b8e)
github-actions bot pushed a commit that referenced this pull request Apr 11, 2025
…e_aspect (#13156)

This fixes a bug with f-strings when IAST is enabled: when building an
invalid string that should raise an "Unknown format code X" exception,
the error wasn't being triggered in certain cases. like
```
 f"{text:05d}"
```
Should raise a ValueError("Unknown format code 'd' for object of type
'str'")

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Co-authored-by: Munir Abdinur <[email protected]>
(cherry picked from commit f807b8e)
github-actions bot pushed a commit that referenced this pull request Apr 11, 2025
…e_aspect (#13156)

This fixes a bug with f-strings when IAST is enabled: when building an
invalid string that should raise an "Unknown format code X" exception,
the error wasn't being triggered in certain cases. like
```
 f"{text:05d}"
```
Should raise a ValueError("Unknown format code 'd' for object of type
'str'")

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Co-authored-by: Munir Abdinur <[email protected]>
(cherry picked from commit f807b8e)
avara1986 added a commit that referenced this pull request Apr 21, 2025
…e_aspect [backport 3.4] (#13173)

Backport f807b8e from #13156 to 3.4.

This fixes a bug with f-strings when IAST is enabled: when building an
invalid string that should raise an "Unknown format code X" exception,
the error wasn't being triggered in certain cases. like
```
 f"{text:05d}"
```
Should raise a ValueError("Unknown format code 'd' for object of type
'str'")

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Co-authored-by: Alberto Vara <[email protected]>
avara1986 added a commit that referenced this pull request May 12, 2025
…e_aspect [backport 2.21] (#13171)

Backport f807b8e from #13156 to 2.21.

This fixes a bug with f-strings when IAST is enabled: when building an
invalid string that should raise an "Unknown format code X" exception,
the error wasn't being triggered in certain cases. like
```
 f"{text:05d}"
```
Should raise a ValueError("Unknown format code 'd' for object of type
'str'")

## Checklist
- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist
- [x] Reviewer has checked that all the criteria below are met 
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Co-authored-by: Alberto Vara <[email protected]>
Co-authored-by: Munir Abdinur <[email protected]>
Co-authored-by: erikayasuda <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants