Merge branch '2.11' into backport-10712-to-2.11

DataDog · Sep 23, 2024 · 452fe4a · 452fe4a
2 parents 2a82dfc + 9251b07
commit 452fe4a
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 0 deletions.
diff --git a/ddtrace/appsec/_iast/_taint_tracking/_native.cpp b/ddtrace/appsec/_iast/_taint_tracking/_native.cpp
@@ -72,6 +72,12 @@ PYBIND11_MODULE(_native, m)
     }
 
     initializer = make_unique<Initializer>();
+    // Create an atexit callback to clean up the Initializer before the interpreter finishes
+    auto atexit_register = py::module_::import("atexit").attr("register");
+    atexit_register(py::cpp_function([]() {
+        initializer->reset_context();
+        initializer.reset();
+    }));
     initializer->create_context();
 
     m.doc() = "Native Python module";

diff --git a/ddtrace/llmobs/_trace_processor.py b/ddtrace/llmobs/_trace_processor.py
@@ -129,6 +129,7 @@ def _llmobs_tags(span: Span, ml_app: str, session_id: Optional[str] = None) -> L
             "source": "integration",
             "ml_app": ml_app,
             "ddtrace.version": ddtrace.__version__,
+            "language": "python",
             "error": span.error,
         }
         err_type = span.get_tag(ERROR_TYPE)

diff --git a/releasenotes/notes/initializer-atexit-4c10671e585ac3e7.yaml b/releasenotes/notes/initializer-atexit-4c10671e585ac3e7.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Code Security: ensure the ``Initializer`` object is always reset and freed before the Python runtime.
+
diff --git a/tests/llmobs/_utils.py b/tests/llmobs/_utils.py
@@ -27,6 +27,7 @@ def _expected_llmobs_tags(span, error=None, tags=None, session_id=None):
         "source:integration",
         "ml_app:{}".format(tags.get("ml_app", "unnamed-ml-app")),
         "ddtrace.version:{}".format(ddtrace.__version__),
+        "language:python",
     ]
     if error:
         expected_tags.append("error:1")