fix(iast): ssrf vulnerability redacts the url query parameters correctly

[avara1986]

Code Security: Ensure IAST SSRF vulnerability redacts the url query parameters correctly.

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

releasenotes/notes/iast-fix-ssrf-queryparam-redaction-78834d2fedfa6bdf.yaml  @DataDog/apm-python
ddtrace/appsec/_iast/_evidence_redaction/_sensitive_handler.py          @DataDog/asm-python
ddtrace/appsec/_iast/_evidence_redaction/url_sensitive_analyzer.py      @DataDog/asm-python
tests/appsec/iast/taint_sinks/test_command_injection_redacted.py        @DataDog/asm-python
tests/appsec/iast/taint_sinks/test_header_injection_redacted.py         @DataDog/asm-python
tests/appsec/iast/taint_sinks/test_sql_injection_redacted.py            @DataDog/asm-python
tests/appsec/iast/taint_sinks/test_ssrf_redacted.py                     @DataDog/asm-python

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-11-29 12:06:08

Comparing candidate commit 535f32b in PR branch avara1986/APPSEC-55770-ssrf_redaction_fix with baseline commit d4de162 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 208 metrics, 2 unstable metrics.

[github-actions]

The backport to 2.14 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.14 2.14
# Navigate to the new working tree
cd .worktrees/backport-2.14
# Create a new branch
git switch --create backport-11563-to-2.14
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 2a58b9081faea295502355b6f083cd0d9b0f1f98
# Push it to GitHub
git push --set-upstream origin backport-11563-to-2.14
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.14

Then, create a pull request where the base branch is 2.14 and the compare/head branch is backport-11563-to-2.14.

[github-actions]

The backport to 2.15 failed:

The process '/usr/bin/git' failed with exit code 1

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-2.15 2.15
# Navigate to the new working tree
cd .worktrees/backport-2.15
# Create a new branch
git switch --create backport-11563-to-2.15
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 2a58b9081faea295502355b6f083cd0d9b0f1f98
# Push it to GitHub
git push --set-upstream origin backport-11563-to-2.15
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-2.15

Then, create a pull request where the base branch is 2.15 and the compare/head branch is backport-11563-to-2.15.