fix(httplib): finish the span when a RASP block raises through the wrapper

[avara1986]

Summary

Jira: APPSEC-70027

Exploit Prevention blocks an outgoing request by raising BlockingException, which derives from BaseException so that no intermediate handler can swallow a blocking decision. _wrap_request and _wrap_putrequest guard the wrapped call with except Exception:

    try:
        return func_to_call(*args, **kwargs)
    except Exception:
        span = getattr(instance, "_datadog_span", None)
        ...

The block goes straight past that handler. The span has already been created and activated by tracer.trace() and attached to the connection, so it is never finished: it is never flushed, it stays current for the rest of the thread's life, and every later span on that thread is parented to it.

Measured with the integration and appsec both patched, blocking from HTTPConnection.request:

span created: True   span finished: False   still current: True
Shutting down tracer with 1 spans. These spans will not be sent to Datadog: name=http.client.request

Order dependence

Reachable on main today, but only in one patch order:

patch order	main
httplib contrib patched first	clean, no span created
appsec patched first	leaked

When appsec patches the attribute after the integration, its wrapt wrapper sits outside _wrap_request and the block raises before the span exists. When appsec patches first, the integration wraps appsec's wrapper and the block happens inside the span.

Why now

The AppSec RASP migration to WrappingContext (#19989, APPSEC-69878) removes the order that avoids this. A wrapping context lives in the target's own bytecode, so it is always innermost and the block always raises inside the span. #19989 depends on this landing first. Found by Codex review on that PR, split out here because it is a pre-existing bug in shared integration code rather than part of the migration.

Fix

Catch BaseException around the wrapped call in both wrappers and re-raise. That is what the rest of the tracer already does for span cleanup — redis_utils, valkey_utils, elasticsearch, asgi, pyramid, tornado and tracer.py. _wrap_getresponse already used try/finally and was unaffected.

Testing

Two tests in tests/contrib/httplib/test_httplib.py raise a real BlockingException from inside the wrapped call, so they need no network and no appsec setup:

• test_span_is_finished_when_the_request_raises_a_base_exception
• test_span_is_finished_when_putrequest_raises_a_base_exception

Both assert the span is finished and no span is left current. Mutation-checked — reverting to except Exception fails both.

contrib::httplib green on py3.12. scripts/lint fmt clean.

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

🤖 Generated with Claude Code

[cit-pr-commenter-54b7da]

Codeowners resolved as

Resolved from the full PR diff against main using the target branch CODEOWNERS file.
CODEOWNERS team requests not listed below are not required by the current file set.

No remaining files require a CODEOWNERS review.

[cit-pr-commenter-54b7da]

Circular import analysis

⚠️ Existing circular imports

There are 3 circular imports that already exist on the base branch and have not been changed by this PR.

ddtrace.llmobs -> ddtrace.llmobs._evaluators -> ddtrace.llmobs._evaluators.format -> ddtrace.llmobs._experiment -> ddtrace.llmobs
ddtrace.errortracking._handled_exceptions.bytecode_injector -> ddtrace.errortracking._handled_exceptions.callbacks -> ddtrace.errortracking._handled_exceptions.collector -> ddtrace.errortracking._handled_exceptions.bytecode_reporting -> ddtrace.errortracking._handled_exceptions.bytecode_injector
ddtrace.appsec._asm_request_context -> ddtrace.appsec._iast._iast_request_context_base -> ddtrace.appsec._iast._iast_env -> ddtrace.appsec._iast.reporter -> ddtrace.appsec._exploit_prevention.stack_traces -> ddtrace.appsec._asm_request_context

[cit-pr-commenter-54b7da]

Dependency direction analysis

⚠️ Existing dependency direction violations

There are 230 dependency direction violations that already exist on the base branch and have not been changed by this PR.

Show existing violations (showing 5 of 230 highest severity)

ddtrace.internal.tracemethods -×-> ddtrace.trace  (internal-core -> product:tracing, score=134)
ddtrace.llmobs._integrations.openai_agents -×-> ddtrace.trace  (product:llmobs -> product:tracing, score=132)
ddtrace.debugging._signal.model -×-> ddtrace.trace  (product:debugging -> product:tracing, score=132)
ddtrace.internal.opentelemetry.span -×-> ddtrace.trace  (product:opentelemetry -> product:tracing, score=132)
ddtrace.aiguard._api_client -×-> ddtrace.trace  (product:aiguard -> product:tracing, score=132)

To see all violations, download the layers-base.json and layers-pr.json artifacts from this CI job and run:

uv run --script scripts/import-analysis/layers.py compare layers-base.json layers-pr.json

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bf12a2503d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".