chore(iast): create a context guard for pausing Python errors

[juanjux]

Description

Create a new PythonErrorGuard RAII object (defined in Utils/PythonErrorGuard.h) that will pause and store the current error on creation and restore it when it goes out of context, allowing to import or call Python functions. It also has members for getting the error and traceback as std::string or py::str.

Example usage:

#include "Utils/PythonErrorGuard.h"

void some_func() 
{
    // operations that could set an error
    {
        PythonErrorGuard error_guard; // The error is stored and removed here
        auto split = safe_import("os.path", "split"); // We can now call Python stuff
        auto res = split("/foo/bar/naz");

        // Bonus: print the errors.
        if (error_guard.has_error()) {
            py::print(error_guard.error_as_pystr());
            py::print(error_guard.traceback_as_pystr());
            cerr << error_guard.error_as_stdstring() << endl;
            cerr << error_guard.traceback_as_stdstring() << endl;
        }
    } --> Out of context, the error is restored.
}

Bonus: a memleak on the first exception error handler of iast_taint_log_error should be fixed now.

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

ddtrace/appsec/_iast/_taint_tracking/Utils/PythonErrorGuard.cpp         @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Utils/PythonErrorGuard.h           @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Aspects/Helpers.cpp                @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Aspects/Helpers.h                  @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Utils/GenericUtils.cpp             @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Utils/GenericUtils.h               @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/tests/test_helpers.cpp             @DataDog/asm-python

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-09-23 19:55:47

Comparing candidate commit aabbf9c in PR branch juanjux/APPSEC-54990-python-error-guard-native with baseline commit 5546c23 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 356 metrics, 48 unstable metrics.

[avara1986]

LGTM!