fix(iast): None as module_path at astpatch_module [backport 2.7]

ddtrace/appsec/_iast/_ast/ast_patching.py

@@ -131,9 +131,15 @@ def _remove_flask_run(text):  # type (str) -> str
 
 def astpatch_module(module: ModuleType, remove_flask_run: bool = False) -> Tuple[str, str]:
     module_name = module.__name__
-    module_path = str(origin(module))
+
+    module_origin = origin(module)
+    if module_origin is None:
+        log.debug("astpatch_source couldn't find the module: %s", module_name)
+        return "", ""
+
+    module_path = str(module_origin)
     try:
-        if os.stat(module_path).st_size == 0:
+        if module_origin.stat().st_size == 0:
             # Don't patch empty files like __init__.py
             log.debug("empty file: %s", module_path)
             return "", ""

releasenotes/notes/fix-ast-patching-none-module_path-4f66c1e35169d5e4.yaml

@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    Code Security: Fixes an issue where the AST patching process fails when the origin of a module is reported as None, raising a ``FileNotFoundError``.

tests/appsec/iast/_ast/test_ast_patching.py

@@ -1,5 +1,8 @@
 #!/usr/bin/env python3
+import logging
+
 import astunparse
+import mock
 import pytest
 
 from ddtrace.appsec._iast._ast.ast_patching import _in_python_stdlib_or_third_party
@@ -146,3 +149,9 @@ def test_module_should_iast_patch():
 )
 def test_module_in_python_stdlib_or_third_party(module_name, result):
     assert _in_python_stdlib_or_third_party(module_name) == result
+
+
+def test_module_path_none(caplog):
+    with caplog.at_level(logging.DEBUG), mock.patch("ddtrace.internal.module.Path.resolve", side_effect=AttributeError):
+        assert ("", "") == astpatch_module(__import__("tests.appsec.iast.fixtures.ast.str.class_str", fromlist=[None]))
+        assert "astpatch_source couldn't find the module: tests.appsec.iast.fixtures.ast.str.class_str" in caplog.text