test(appsec): bound tracer shutdown in test app endpoints DD_U55XLN

The /shutdown endpoints called tracer.shutdown() with no timeout (django) or
with the same 10s the client uses (flask). Under a gunicorn gevent worker the
flush can block the hub the writer needs, so the request read-timed-out and the
test failed with the server still alive and the port still bound.

Bound both flushes to 5s, below the client's 10s timeout.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: christophe-papazian

tests/appsec/app.py

@@ -337,7 +337,8 @@ def iast_code_injection_vulnerability():
 
 @app.route("/shutdown", methods=["GET"])
 def shutdown_view():
-    tracer.shutdown(timeout=10)
+    # Below the caller's 10s timeout, so the flush gives up before the request does.
+    tracer.shutdown(timeout=5)
     sys.exit(0)
 
 

tests/appsec/integrations/django_tests/django_app/urls.py

@@ -15,7 +15,8 @@
 
 def shutdown(request):
     # Endpoint used to flush traces to the agent when doing snapshots.
-    tracer.shutdown()
+    # Bounded: the default waits forever, and under gevent the flush can block the writer's hub.
+    tracer.shutdown(timeout=5)
     return HttpResponse(status=200)