fix(appsec): normalize DBAPI queries for SQLi RASP

[florentinl]

Description

This PR is stacked on #19918. Review the normalization commit eedae00c1b; the parent commit contains the async-driver DBAPI event coverage from that PR.

Normalize database queries once at the traced cursor boundary before using them as span resources or publishing the typed dbapi.query event. This lets SQL injection detection and blocking inspect:

• str and bytes queries;
• psycopg 2 and 3 composables such as SQL and Composed;
• Python 3.14 template-string queries accepted by psycopg 3.3.

The original query object is still passed to the database adapter. Adapter-specific rendering uses the adapter's supported API and fails open: if rendering raises, tracing continues with the original resource and the driver call is unaffected. Event publication is skipped when there are no listeners.

Testing

• scripts/lint checks
• scripts/lint typing -- ddtrace/contrib/_events/dbapi.py ddtrace/contrib/dbapi.py ddtrace/contrib/dbapi_async.py ddtrace/contrib/internal/aiomysql/patch.py ddtrace/contrib/internal/aiopg/connection.py ddtrace/contrib/internal/asyncpg/patch.py ddtrace/contrib/internal/psycopg/cursor.py ddtrace/contrib/internal/psycopg/patch.py
• Python 3.14 generic DBAPI sync and async suites: 61 passed
• Python 3.14 psycopg 3.3 suite: 71 passed, including composables, async cursors, and template strings
• Python 3.14 psycopg2-only suite: 51 passed
• Latest asyncpg focused cursor, COPY, bytes, and blocking cases: 6 passed
• AppSec bytes/tokenizer handoff: 1 passed
• Focused aiopg and aiomysql normalization cases: passed

Risks

The main risk is adapter-specific rendering changing query handling. The rendered value is used only for the span resource and typed security event; the adapter always receives the original object. Rendering failures are logged at debug level and do not affect application execution.

Additional Notes

• Base branch: florentin.labelle/appsec/async-dbapi-sqli
• Parent PR: feat(appsec): support SQLi RASP for async database drivers #19918
• Includes a customer-facing release note.
• The AppSec and APM integration guides were reviewed; no integration reference update was needed because this extends the existing cursor normalization hook rather than introducing a new integration pattern.

[cit-pr-commenter-54b7da]

Codeowners resolved as

Resolved from the full PR diff against florentin.labelle/appsec/async-dbapi-sqli using the target branch CODEOWNERS file.
CODEOWNERS team requests not listed below are not required by the current file set.

ddtrace/contrib/_events/dbapi.py                                        @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/dbapi.py                                                @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/dbapi_async.py                                          @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/aiomysql/patch.py                              @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/aiopg/connection.py                            @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/asyncpg/patch.py                               @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/psycopg/cursor.py                              @DataDog/apm-core-python @DataDog/apm-idm-python
ddtrace/contrib/internal/psycopg/patch.py                               @DataDog/apm-core-python @DataDog/apm-idm-python
releasenotes/notes/asm-dbapi-query-normalization-cdc548988f47c744.yaml  @DataDog/apm-python
tests/appsec/appsec/test_exploit_prevention.py                          @DataDog/asm-python
tests/contrib/aiomysql/test_aiomysql.py                                 @DataDog/apm-core-python @DataDog/apm-idm-python
tests/contrib/aiopg/test.py                                             @DataDog/apm-core-python @DataDog/apm-idm-python
tests/contrib/asyncpg/test_asyncpg.py                                   @DataDog/apm-core-python @DataDog/apm-idm-python
tests/contrib/dbapi/test_dbapi.py                                       @DataDog/apm-core-python @DataDog/apm-idm-python
tests/contrib/dbapi_async/test_dbapi_async.py                           @DataDog/apm-core-python @DataDog/apm-idm-python
tests/contrib/psycopg/test_psycopg.py                                   @DataDog/apm-core-python @DataDog/apm-idm-python
tests/contrib/psycopg/test_psycopg_async.py                             @DataDog/apm-core-python @DataDog/apm-idm-python
tests/contrib/psycopg2/test_psycopg.py                                  @DataDog/apm-core-python @DataDog/apm-idm-python

[cit-pr-commenter-54b7da]

Circular import analysis

⚠️ Existing circular imports

There are 3 circular imports that already exist on the base branch and have not been changed by this PR.

ddtrace.llmobs -> ddtrace.llmobs._evaluators -> ddtrace.llmobs._evaluators.format -> ddtrace.llmobs._experiment -> ddtrace.llmobs
ddtrace.errortracking._handled_exceptions.bytecode_injector -> ddtrace.errortracking._handled_exceptions.callbacks -> ddtrace.errortracking._handled_exceptions.collector -> ddtrace.errortracking._handled_exceptions.bytecode_reporting -> ddtrace.errortracking._handled_exceptions.bytecode_injector
ddtrace.appsec._asm_request_context -> ddtrace.appsec._iast._iast_request_context_base -> ddtrace.appsec._iast._iast_env -> ddtrace.appsec._iast.reporter -> ddtrace.appsec._exploit_prevention.stack_traces -> ddtrace.appsec._asm_request_context

[cit-pr-commenter-54b7da]

Dependency direction analysis

⚠️ Existing dependency direction violations

There are 240 dependency direction violations that already exist on the base branch and have not been changed by this PR.

Show existing violations (showing 5 of 240 highest severity)

ddtrace.internal.tracemethods -×-> ddtrace.trace  (internal-core -> product:tracing, score=135)
ddtrace.debugging._exception.replay -×-> ddtrace.trace  (product:debugging -> product:tracing, score=133)
ddtrace.llmobs._integrations.litellm -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=133)
ddtrace.llmobs._integrations.anthropic -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=133)
ddtrace.appsec._contrib.django -×-> ddtrace.trace  (product:appsec -> product:tracing, score=133)

To see all violations, download the layers-base.json and layers-pr.json artifacts from this CI job and run:

uv run --script scripts/import-analysis/layers.py compare layers-base.json layers-pr.json

[datadog-official]

 

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 7 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-py | build linux serverless: [amd64, cp315-cp315, v113741238-d2b8243-manylinux2014_x86_64, 1] — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-py | build linux serverless: [arm64, cp315-cp315, v113741357-d2b8243-manylinux2014_aarch64, 1] — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-py | contrib/django 1/6 — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

View all 7 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: eedae00 | Docs | View more details | Give us feedback!}