refactor(appsec): move LFI RASP protection to a dedicated filesystem contrib module

[florentinl]

Summary

• Moves LFI RASP protection out of _common_module_patches.py into a dedicated ddtrace/appsec/_contrib/filesystem/ module using the Subscriber/event pattern.
• Consolidates the shared _must_block helper into ddtrace/appsec/_rasp.py.
• Fixes a stack-trace frame-cropping regression in _exploit_prevention/stack_traces.py introduced earlier in this branch.
• No public API or customer-visible behavior change. changelog/no-changelog applies.

[datadog-datadog-prod-us1-2]

 

⚠️ Warnings

🚦 9 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-py | build linux serverless: [amd64, cp315-cp315, v126532274-233089d-musllinux_1_2_x86_64, 1]     

DataDog/apm-reliability/dd-trace-py | build linux serverless: [arm64, cp315-cp315, v113741357-d2b8243-manylinux2014_aarch64, 1]     

DataDog/apm-reliability/dd-trace-py | build linux: [amd64, cp315-cp315, v113741238-d2b8243-manylinux2014_x86_64]     

View all 9 failed jobs.

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d8eab22 | Docs | Datadog PR Page | Give us feedback!}

[cit-pr-commenter-54b7da]

Circular import analysis

⚠️ Existing circular imports

There are 5 circular imports that already exist on the base branch and have not been changed by this PR.

ddtrace.contrib.internal.pytorch._distributed -> ddtrace.contrib.internal.pytorch._rank_root -> ddtrace.contrib.internal.pytorch._distributed
ddtrace.contrib.internal.django.patch -> ddtrace.contrib.internal.django.response -> ddtrace.contrib.internal.django.patch
ddtrace.errortracking._handled_exceptions.bytecode_injector -> ddtrace.errortracking._handled_exceptions.callbacks -> ddtrace.errortracking._handled_exceptions.collector -> ddtrace.errortracking._handled_exceptions.bytecode_reporting -> ddtrace.errortracking._handled_exceptions.bytecode_injector
ddtrace.llmobs -> ddtrace.llmobs._evaluators -> ddtrace.llmobs._evaluators.format -> ddtrace.llmobs._experiment -> ddtrace.llmobs
ddtrace.appsec._asm_request_context -> ddtrace.appsec._iast._iast_request_context_base -> ddtrace.appsec._iast._iast_env -> ddtrace.appsec._iast.reporter -> ddtrace.appsec._exploit_prevention.stack_traces -> ddtrace.appsec._asm_request_context

[cit-pr-commenter-54b7da]

Dependency direction analysis

📈 Existing violations got worse

1 pre-existing violation(s) increased in severity (e.g. their target became more depended-on, or got pulled into an import cycle), though the edge itself isn't new:

ddtrace.internal.settings.asm -×-> ddtrace.appsec._constants  (internal-core -> product:appsec, score=52, +2 vs base)

⚠️ Existing dependency direction violations

There are 255 dependency direction violations that already exist on the base branch and have not been changed by this PR.

Show existing violations (showing 5 of 255 highest severity)

ddtrace.internal.tracemethods -×-> ddtrace.trace  (internal-core -> product:tracing, score=134)
ddtrace.aiguard._api_client -×-> ddtrace.trace  (product:aiguard -> product:tracing, score=132)
ddtrace.llmobs._integrations.bedrock -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=132)
ddtrace.llmobs._integrations.anthropic -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=132)
ddtrace.llmobs._integrations.langchain -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=132)

To see all violations, download the layers-base.json and layers-pr.json artifacts from this CI job and run:

uv run --script scripts/import-analysis/layers.py compare layers-base.json layers-pr.json

[cit-pr-commenter-54b7da]

Codeowners resolved as

Resolved from the full PR diff against main using the target branch CODEOWNERS file.
CODEOWNERS team requests not listed below are not required by the current file set.

ddtrace/appsec/_common_module_patches.py                                @DataDog/asm-python
ddtrace/appsec/_contrib/filesystem/__init__.py                          @DataDog/asm-python
ddtrace/appsec/_contrib/filesystem/events.py                            @DataDog/asm-python
ddtrace/appsec/_contrib/filesystem/patch.py                             @DataDog/asm-python
ddtrace/appsec/_contrib/filesystem/subscribers.py                       @DataDog/asm-python
ddtrace/appsec/_contrib/httpx/subscribers.py                            @DataDog/asm-python
ddtrace/appsec/_exploit_prevention/stack_traces.py                      @DataDog/asm-python
ddtrace/appsec/_listeners.py                                            @DataDog/asm-python
ddtrace/appsec/_patch_utils.py                                          @DataDog/asm-python
ddtrace/appsec/_rasp.py                                                 @DataDog/asm-python
tests/appsec/appsec/test_exploit_prevention.py                          @DataDog/asm-python
tests/appsec/appsec/test_filesystem.py                                  @DataDog/asm-python

[pr-commenter]

Benchmarks

Benchmark execution time: 2026-08-14 15:01:08

Comparing candidate commit d8eab22 in PR branch florentin.labelle/move-lfi-to-dedicated-contrib with baseline commit a24b7b3 in branch main.

Found 0 performance improvements and 1 performance regressions! Performance is the same for 83 metrics, 0 unstable metrics.

scenario:iastaspectsospath-ospathbasename_aspect

• 🟥 execution_time [+74.799µs; +81.469µs] or [+18.242%; +19.869%]