Fix SSRF violations in Django test views #14673
Conversation
![datadog-datadog-prod-us1[bot]](https://avatars.githubusercontent.com/u/365230?s=80&v=4){kind=small}
|
Bits AI Dev Agent Status: ✅ Done Status History (8 entries)You can ask for changes by mentioning @DataDog in a comment. |
|
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| # label unvalidated_redirect_safe_source_header | ||
| return redirect("http://localhost:8080/" + value) | ||
| safe_value = quote(value, safe="") | ||
| return redirect(f"http://localhost:8080/{safe_value}") |
Check warning
Code scanning / CodeQL
URL redirection from remote source Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI about 1 month ago
To address the vulnerability, we must ensure that any redirect target constructed from user-controlled HTTP headers is properly sanitized. In this case, we are already applying quote(value, safe="") to percent-encode all potentially unsafe characters in the header value, preventing breaking out of the path component or tampering with the redirect URL structure.
However, there are two improvements that can further reinforce security and robustness:
- Only perform the redirect if a value was actually supplied (i.e.,
valueis not empty). Ifvalueis missing or empty, default to redirecting to a safe, well-known local path (e.g.,/). - Optionally, restrict the allowed values to a set of pre-authorized path components or patterns, if applicable. If not, ensure that empty or dangerous values are not used.
Given the test semantics provided and the instruction to percent-encode the header-derived path component, we should update the function to check if a value is present before performing the redirect. If not, use / as a safe fallback.
File/region/lines to change:
tests/appsec/integrations/django_tests/django_app/views.py, lines 547-560 (unvalidated_redirect_safe_source_cookieandunvalidated_redirect_safe_source_headerfunctions).
Required imports/methods:
- No new imports are necessary, as
quoteis already imported. - No changes to method signatures or structure are necessary, just strengthen value checks.
| @@ -555,8 +555,11 @@ | ||
| # The user has provided the following additional instructions about how you should make this change: | ||
| # Percent-encode header-derived path components before constructing redirect URLs. | ||
| # label unvalidated_redirect_safe_source_header | ||
| safe_value = quote(value, safe="") | ||
| return redirect(f"http://localhost:8080/{safe_value}") | ||
| if value: | ||
| safe_value = quote(value, safe="") | ||
| return redirect(f"http://localhost:8080/{safe_value}") | ||
| # Fallback to a safe path if the header is missing or empty | ||
| return redirect("/") | ||
|
|
||
|
|
||
| def unvalidated_redirect_path_multiple_sources(request): |
Bootstrap import analysisComparison of import times between this PR and base. SummaryThe average import time from this PR is: 267 ± 2 ms. The average import time from base is: 270 ± 5 ms. The import time difference between this PR and base is: -3.0 ± 0.2 ms. Import time breakdownThe following import paths have shrunk:
|
Performance SLOsComparing candidate dd/prevent-ssrf-validate-encode-redirect-targets (448e559) with baseline main (f98e713) 📈 Performance Regressions (2 suites)📈 iastaspects - 118/118✅ add_aspectTime: ✅ 0.411µs (SLO: <10.000µs 📉 -95.9%) vs baseline: +0.4% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% ✅ add_inplace_aspectTime: ✅ 0.410µs (SLO: <10.000µs 📉 -95.9%) vs baseline: -0.6% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.1% ✅ add_inplace_noaspectTime: ✅ 0.316µs (SLO: <10.000µs 📉 -96.8%) vs baseline: ~same Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% ✅ add_noaspectTime: ✅ 0.277µs (SLO: <10.000µs 📉 -97.2%) vs baseline: -1.1% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ bytearray_aspectTime: ✅ 1.333µs (SLO: <10.000µs 📉 -86.7%) vs baseline: +0.2% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ bytearray_extend_aspectTime: ✅ 1.448µs (SLO: <10.000µs 📉 -85.5%) vs baseline: -0.3% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8% ✅ bytearray_extend_noaspectTime: ✅ 0.614µs (SLO: <10.000µs 📉 -93.9%) vs baseline: +0.4% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ bytearray_noaspectTime: ✅ 0.478µs (SLO: <10.000µs 📉 -95.2%) vs baseline: -1.2% Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ bytes_aspectTime: ✅ 1.303µs (SLO: <10.000µs 📉 -87.0%) vs baseline: +0.5% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.6% ✅ bytes_noaspectTime: ✅ 0.492µs (SLO: <10.000µs 📉 -95.1%) vs baseline: +0.9% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% ✅ bytesio_aspectTime: ✅ 1.323µs (SLO: <10.000µs 📉 -86.8%) vs baseline: +0.4% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ bytesio_noaspectTime: ✅ 0.494µs (SLO: <10.000µs 📉 -95.1%) vs baseline: +0.6% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7% ✅ capitalize_aspectTime: ✅ 0.732µs (SLO: <10.000µs 📉 -92.7%) vs baseline: -0.3% Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +5.1% ✅ capitalize_noaspectTime: ✅ 0.437µs (SLO: <10.000µs 📉 -95.6%) vs baseline: ~same Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +5.1% ✅ casefold_aspectTime: ✅ 0.733µs (SLO: <10.000µs 📉 -92.7%) vs baseline: -0.7% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ casefold_noaspectTime: ✅ 0.370µs (SLO: <10.000µs 📉 -96.3%) vs baseline: +0.8% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ decode_aspectTime: ✅ 0.723µs (SLO: <10.000µs 📉 -92.8%) vs baseline: +0.1% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ decode_noaspectTime: ✅ 0.423µs (SLO: <10.000µs 📉 -95.8%) vs baseline: +1.5% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ encode_aspectTime: ✅ 0.713µs (SLO: <10.000µs 📉 -92.9%) vs baseline: +0.4% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +5.0% ✅ encode_noaspectTime: ✅ 0.403µs (SLO: <10.000µs 📉 -96.0%) vs baseline: +1.0% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ format_aspectTime: ✅ 3.437µs (SLO: <10.000µs 📉 -65.6%) vs baseline: -0.1% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% ✅ format_map_aspectTime: ✅ 3.664µs (SLO: <10.000µs 📉 -63.4%) vs baseline: +0.4% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ format_map_noaspectTime: ✅ 0.780µs (SLO: <10.000µs 📉 -92.2%) vs baseline: +1.0% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ format_noaspectTime: ✅ 0.591µs (SLO: <10.000µs 📉 -94.1%) vs baseline: +0.1% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.8% ✅ index_aspectTime: ✅ 0.352µs (SLO: <10.000µs 📉 -96.5%) vs baseline: -1.8% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.7% ✅ index_noaspectTime: ✅ 0.276µs (SLO: <10.000µs 📉 -97.2%) vs baseline: -0.4% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.7% ✅ join_aspectTime: ✅ 1.366µs (SLO: <10.000µs 📉 -86.3%) vs baseline: +0.3% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8% ✅ join_noaspectTime: ✅ 0.497µs (SLO: <10.000µs 📉 -95.0%) vs baseline: +0.7% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ ljust_aspectTime: ✅ 2.630µs (SLO: <20.000µs 📉 -86.9%) vs baseline: +1.5% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% ✅ ljust_noaspectTime: ✅ 0.403µs (SLO: <10.000µs 📉 -96.0%) vs baseline: -1.6% Memory: ✅ 37.591MB (SLO: <39.000MB -3.6%) vs baseline: +4.6% ✅ lower_aspectTime: ✅ 2.222µs (SLO: <10.000µs 📉 -77.8%) vs baseline: -0.4% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.8% ✅ lower_noaspectTime: ✅ 0.366µs (SLO: <10.000µs 📉 -96.3%) vs baseline: -0.2% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ lstrip_aspectTime: ✅ 2.248µs (SLO: <20.000µs 📉 -88.8%) vs baseline: -1.1% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ lstrip_noaspectTime: ✅ 0.385µs (SLO: <10.000µs 📉 -96.1%) vs baseline: +0.7% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ modulo_aspectTime: ✅ 0.999µs (SLO: <10.000µs 📉 -90.0%) vs baseline: -0.6% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.6% ✅ modulo_aspect_for_bytearray_bytearrayTime: ✅ 1.522µs (SLO: <10.000µs 📉 -84.8%) vs baseline: -0.9% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ modulo_aspect_for_bytesTime: ✅ 0.979µs (SLO: <10.000µs 📉 -90.2%) vs baseline: +0.4% Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ modulo_aspect_for_bytes_bytearrayTime: ✅ 1.213µs (SLO: <10.000µs 📉 -87.9%) vs baseline: +0.3% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.8% ✅ modulo_noaspectTime: ✅ 0.627µs (SLO: <10.000µs 📉 -93.7%) vs baseline: -1.2% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ replace_aspectTime: ✅ 5.400µs (SLO: <10.000µs 📉 -46.0%) vs baseline: 📈 +10.7% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ replace_noaspectTime: ✅ 0.457µs (SLO: <10.000µs 📉 -95.4%) vs baseline: -0.3% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.8% ✅ repr_aspectTime: ✅ 0.910µs (SLO: <10.000µs 📉 -90.9%) vs baseline: ~same Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ repr_noaspectTime: ✅ 0.416µs (SLO: <10.000µs 📉 -95.8%) vs baseline: -0.8% Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +5.1% ✅ rstrip_aspectTime: ✅ 1.953µs (SLO: <20.000µs 📉 -90.2%) vs baseline: -0.8% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.6% ✅ rstrip_noaspectTime: ✅ 0.381µs (SLO: <10.000µs 📉 -96.2%) vs baseline: +0.3% Memory: ✅ 37.749MB (SLO: <39.000MB -3.2%) vs baseline: +5.1% ✅ slice_aspectTime: ✅ 0.495µs (SLO: <10.000µs 📉 -95.0%) vs baseline: +0.4% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +5.0% ✅ slice_noaspectTime: ✅ 0.450µs (SLO: <10.000µs 📉 -95.5%) vs baseline: +0.9% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ stringio_aspectTime: ✅ 1.548µs (SLO: <10.000µs 📉 -84.5%) vs baseline: -0.6% Memory: ✅ 37.729MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ stringio_noaspectTime: ✅ 0.719µs (SLO: <10.000µs 📉 -92.8%) vs baseline: ~same Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ strip_aspectTime: ✅ 2.254µs (SLO: <20.000µs 📉 -88.7%) vs baseline: ~same Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% ✅ strip_noaspectTime: ✅ 0.388µs (SLO: <10.000µs 📉 -96.1%) vs baseline: +1.3% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.9% ✅ swapcase_aspectTime: ✅ 2.430µs (SLO: <10.000µs 📉 -75.7%) vs baseline: +0.3% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.9% ✅ swapcase_noaspectTime: ✅ 0.534µs (SLO: <10.000µs 📉 -94.7%) vs baseline: -0.8% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.6% ✅ title_aspectTime: ✅ 2.337µs (SLO: <10.000µs 📉 -76.6%) vs baseline: -1.0% Memory: ✅ 37.631MB (SLO: <39.000MB -3.5%) vs baseline: +4.7% ✅ title_noaspectTime: ✅ 0.501µs (SLO: <10.000µs 📉 -95.0%) vs baseline: -0.5% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.6% ✅ translate_aspectTime: ✅ 3.255µs (SLO: <10.000µs 📉 -67.5%) vs baseline: -0.3% Memory: ✅ 37.709MB (SLO: <39.000MB -3.3%) vs baseline: +4.9% ✅ translate_noaspectTime: ✅ 1.053µs (SLO: <10.000µs 📉 -89.5%) vs baseline: +1.1% Memory: ✅ 37.690MB (SLO: <39.000MB -3.4%) vs baseline: +5.0% ✅ upper_aspectTime: ✅ 2.209µs (SLO: <10.000µs 📉 -77.9%) vs baseline: -0.8% Memory: ✅ 37.650MB (SLO: <39.000MB -3.5%) vs baseline: +4.7% ✅ upper_noaspectTime: ✅ 0.369µs (SLO: <10.000µs 📉 -96.3%) vs baseline: -0.4% Memory: ✅ 37.670MB (SLO: <39.000MB -3.4%) vs baseline: +4.7% 📈 telemetryaddmetric - 30/30✅ 1-count-metric-1-timesTime: ✅ 3.185µs (SLO: <20.000µs 📉 -84.1%) vs baseline: +2.7% Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.9% ✅ 1-count-metrics-100-timesTime: ✅ 216.798µs (SLO: <250.000µs 📉 -13.3%) vs baseline: +2.3% Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +5.1% ✅ 1-distribution-metric-1-timesTime: ✅ 3.285µs (SLO: <20.000µs 📉 -83.6%) vs baseline: 📈 +12.6% Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +4.9% ✅ 1-distribution-metrics-100-timesTime: ✅ 195.036µs (SLO: <220.000µs 📉 -11.3%) vs baseline: +2.6% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.6% ✅ 1-gauge-metric-1-timesTime: ✅ 2.088µs (SLO: <20.000µs 📉 -89.6%) vs baseline: +1.2% Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +4.9% ✅ 1-gauge-metrics-100-timesTime: ✅ 125.186µs (SLO: <150.000µs 📉 -16.5%) vs baseline: +0.3% Memory: ✅ 32.067MB (SLO: <34.000MB -5.7%) vs baseline: +4.7% ✅ 1-rate-metric-1-timesTime: ✅ 3.235µs (SLO: <20.000µs 📉 -83.8%) vs baseline: +4.4% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.5% ✅ 1-rate-metrics-100-timesTime: ✅ 215.248µs (SLO: <250.000µs 📉 -13.9%) vs baseline: +1.8% Memory: ✅ 32.086MB (SLO: <34.000MB -5.6%) vs baseline: +4.9% ✅ 100-count-metrics-100-timesTime: ✅ 21.831ms (SLO: <23.500ms -7.1%) vs baseline: +1.7% Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +4.8% ✅ 100-distribution-metrics-100-timesTime: ✅ 1.991ms (SLO: <2.250ms 📉 -11.5%) vs baseline: ~same Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +5.0% ✅ 100-gauge-metrics-100-timesTime: ✅ 1.283ms (SLO: <1.550ms 📉 -17.2%) vs baseline: +0.5% Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.7% ✅ 100-rate-metrics-100-timesTime: ✅ 2.229ms (SLO: <2.550ms 📉 -12.6%) vs baseline: +2.0% Memory: ✅ 32.185MB (SLO: <34.000MB -5.3%) vs baseline: +5.3% ✅ flush-1-metricTime: ✅ 4.555µs (SLO: <20.000µs 📉 -77.2%) vs baseline: +9.8% Memory: ✅ 32.185MB (SLO: <34.000MB -5.3%) vs baseline: +5.1% ✅ flush-100-metricsTime: ✅ 180.352µs (SLO: <250.000µs 📉 -27.9%) vs baseline: -0.9% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.6% ✅ flush-1000-metricsTime: ✅ 2.199ms (SLO: <2.500ms 📉 -12.0%) vs baseline: +0.4% Memory: ✅ 32.971MB (SLO: <34.500MB -4.4%) vs baseline: +5.2% 🟡 Near SLO Breach (3 suites)🟡 djangosimple - 28/28✅ appsecTime: ✅ 20.477ms (SLO: <22.300ms -8.2%) vs baseline: -0.3% Memory: ✅ 65.174MB (SLO: <67.000MB -2.7%) vs baseline: +4.8% ✅ exception-replay-enabledTime: ✅ 1.346ms (SLO: <1.450ms -7.2%) vs baseline: -0.7% Memory: ✅ 64.231MB (SLO: <67.000MB -4.1%) vs baseline: +4.7% ✅ iastTime: ✅ 20.513ms (SLO: <22.250ms -7.8%) vs baseline: ~same Memory: ✅ 65.269MB (SLO: <67.000MB -2.6%) vs baseline: +4.9% ✅ profilerTime: ✅ 15.254ms (SLO: <16.550ms -7.8%) vs baseline: ~same Memory: ✅ 53.281MB (SLO: <54.500MB -2.2%) vs baseline: +4.6% ✅ span-code-originTime: ✅ 26.198ms (SLO: <28.200ms -7.1%) vs baseline: ~same Memory: ✅ 67.436MB (SLO: <69.500MB -3.0%) vs baseline: +4.7% ✅ tracerTime: ✅ 20.452ms (SLO: <21.750ms -6.0%) vs baseline: -0.6% Memory: ✅ 65.284MB (SLO: <67.000MB -2.6%) vs baseline: +4.9% ✅ tracer-and-profilerTime: ✅ 22.035ms (SLO: <23.500ms -6.2%) vs baseline: -0.1% Memory: ✅ 66.375MB (SLO: <67.500MB 🟡 -1.7%) vs baseline: +4.9% ✅ tracer-dont-create-db-spansTime: ✅ 19.313ms (SLO: <21.500ms 📉 -10.2%) vs baseline: -0.3% Memory: ✅ 65.212MB (SLO: <66.000MB 🟡 -1.2%) vs baseline: +4.8% ✅ tracer-minimalTime: ✅ 16.608ms (SLO: <17.500ms -5.1%) vs baseline: -0.2% Memory: ✅ 65.077MB (SLO: <66.000MB 🟡 -1.4%) vs baseline: +5.0% ✅ tracer-nativeTime: ✅ 20.471ms (SLO: <21.750ms -5.9%) vs baseline: -0.2% Memory: ✅ 71.113MB (SLO: <72.500MB 🟡 -1.9%) vs baseline: +4.9% ✅ tracer-no-cachesTime: ✅ 18.454ms (SLO: <19.650ms -6.1%) vs baseline: -0.2% Memory: ✅ 65.226MB (SLO: <67.000MB -2.6%) vs baseline: +4.8% ✅ tracer-no-databasesTime: ✅ 18.802ms (SLO: <20.100ms -6.5%) vs baseline: ~same Memory: ✅ 64.861MB (SLO: <67.000MB -3.2%) vs baseline: +4.8% ✅ tracer-no-middlewareTime: ✅ 20.217ms (SLO: <21.500ms -6.0%) vs baseline: -0.2% Memory: ✅ 65.254MB (SLO: <67.000MB -2.6%) vs baseline: +4.9% ✅ tracer-no-templatesTime: ✅ 20.303ms (SLO: <22.000ms -7.7%) vs baseline: +0.3% Memory: ✅ 65.264MB (SLO: <67.000MB -2.6%) vs baseline: +4.9% 🟡 errortrackingdjangosimple - 6/6✅ errortracking-enabled-allTime: ✅ 18.009ms (SLO: <19.850ms -9.3%) vs baseline: ~same Memory: ✅ 65.086MB (SLO: <66.500MB -2.1%) vs baseline: +4.8% ✅ errortracking-enabled-userTime: ✅ 18.060ms (SLO: <19.400ms -6.9%) vs baseline: +0.3% Memory: ✅ 65.172MB (SLO: <66.500MB 🟡 -2.0%) vs baseline: +4.9% ✅ tracer-enabledTime: ✅ 18.037ms (SLO: <19.450ms -7.3%) vs baseline: +0.2% Memory: ✅ 64.920MB (SLO: <66.500MB -2.4%) vs baseline: +4.8% 🟡 otelspan - 22/22✅ add-eventTime: ✅ 45.275ms (SLO: <47.150ms -4.0%) vs baseline: -0.2% Memory: ✅ 45.056MB (SLO: <47.000MB -4.1%) vs baseline: +4.9% ✅ add-metricsTime: ✅ 320.365ms (SLO: <344.800ms -7.1%) vs baseline: -0.1% Memory: ✅ 553.353MB (SLO: <562.000MB 🟡 -1.5%) vs baseline: +4.9% ✅ add-tagsTime: ✅ 292.773ms (SLO: <314.000ms -6.8%) vs baseline: +0.4% Memory: ✅ 554.516MB (SLO: <563.500MB 🟡 -1.6%) vs baseline: +4.8% ✅ get-contextTime: ✅ 82.644ms (SLO: <92.350ms 📉 -10.5%) vs baseline: -0.3% Memory: ✅ 40.189MB (SLO: <46.500MB 📉 -13.6%) vs baseline: +5.0% ✅ is-recordingTime: ✅ 42.932ms (SLO: <44.500ms -3.5%) vs baseline: -0.3% Memory: ✅ 44.452MB (SLO: <47.500MB -6.4%) vs baseline: +4.9% ✅ record-exceptionTime: ✅ 61.669ms (SLO: <67.650ms -8.8%) vs baseline: ~same Memory: ✅ 40.444MB (SLO: <47.000MB 📉 -13.9%) vs baseline: +4.9% ✅ set-statusTime: ✅ 48.896ms (SLO: <50.400ms -3.0%) vs baseline: +0.2% Memory: ✅ 44.504MB (SLO: <47.000MB -5.3%) vs baseline: +4.9% ✅ startTime: ✅ 42.137ms (SLO: <43.450ms -3.0%) vs baseline: ~same Memory: ✅ 44.454MB (SLO: <47.000MB -5.4%) vs baseline: +5.1% ✅ start-finishTime: ✅ 83.228ms (SLO: <88.000ms -5.4%) vs baseline: +0.4% Memory: ✅ 34.485MB (SLO: <46.500MB 📉 -25.8%) vs baseline: +4.6% ✅ start-finish-telemetryTime: ✅ 84.811ms (SLO: <89.000ms -4.7%) vs baseline: +0.5% Memory: ✅ 34.583MB (SLO: <46.500MB 📉 -25.6%) vs baseline: +5.0% ✅ update-nameTime: ✅ 45.134ms (SLO: <45.150ms 🟡 ~same) vs baseline: +2.4% Memory: ✅ 44.682MB (SLO: <47.000MB -4.9%) vs baseline: +4.8%
|
PR by Bits for Dev Agent Session identified by campaign Campaign for python-flask/ssrf-requests Sep. 03 2025 created by Tanishq Dubey.
You can ask for changes by mentioning @DataDog in a comment.
Feedback (especially what can be better) welcome in #code-gen-feedback!
Description
Address static analysis violations (python-flask/ssrf-requests) by sanitizing and validating redirect targets in Django test views. Changes:
Motivation: prevent SSRF/open-redirect by avoiding unsanitized request data in redirects.
Testing
Risks
Low. Behavior change: previously invalid/foreign hosts could be redirected to; now they fall back to "/". Changes are limited to test application code.
Additional Notes