chore(iast): reduce ssrf false positives

[avara1986]

This PR improves the accuracy of SSRF (Server-Side Request Forgery) vulnerability detection in the IAST module by reducing false positives, particularly when dealing with URL fragments.

URL Part	Tainted?	Safe Builder?	Encoded?	Report SSRF?
Protocol/Host/Port	Yes	N/A	N/A	Yes (HIGH)
Path	Yes	Yes	Yes	No
Path	Yes	No	No	Yes (MEDIUM)
Query	Yes	Yes	N/A	No
Query	Yes	No	N/A	Yes (MEDIUM)
Fragment	Yes	N/A	N/A	No

Key Changes

• Enhanced SSRF detection logic to properly handle URL fragments (#)
• Added validation to ignore cases where tainted data only appears in URL fragments
• Added test cases to verify fragment handling behavior

Motivation

URL fragments (parts after #) are client-side only and not sent to the server, making them irrelevant for SSRF vulnerabilities. The current implementation was generating false positives when tainted data appeared only in URL fragments, leading to unnecessary alerts.

Testing Strategy

• Added new test cases in tests/appsec/iast/taint_sinks/test_ssrf.py
• Verified behavior with Django integration tests
• Tested various URL fragment scenarios:
  • Tainted data in fragments only
  • Tainted data in both query params and fragments
  • Multiple fragments with tainted data

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

ddtrace/appsec/_iast/_patch_modules.py                                  @DataDog/asm-python
ddtrace/appsec/_iast/secure_marks/validators.py                         @DataDog/asm-python
ddtrace/appsec/_iast/taint_sinks/ssrf.py                                @DataDog/asm-python
tests/appsec/iast/taint_sinks/test_ssrf.py                              @DataDog/asm-python
tests/appsec/integrations/django_tests/conftest.py                      @DataDog/asm-python
tests/appsec/integrations/django_tests/django_app/urls.py               @DataDog/asm-python
tests/appsec/integrations/django_tests/django_app/views.py              @DataDog/asm-python
tests/appsec/integrations/django_tests/test_iast_django.py              @DataDog/asm-python

[github-actions]

Bootstrap import analysis

Comparison of import times between this PR and base.

Summary

The average import time from this PR is: 242 ± 5 ms.

The average import time from base is: 243 ± 3 ms.

The import time difference between this PR and base is: -0.9 ± 0.2 ms.

Import time breakdown

The following import paths have shrunk:

ddtrace.auto 1.869 ms (0.77%)

ddtrace.bootstrap.sitecustomize 1.218 ms (0.50%)

ddtrace.bootstrap.preload 1.218 ms (0.50%)

ddtrace.internal.remoteconfig.client 0.617 ms (0.25%)

ddtrace 0.651 ms (0.27%)

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-06-02 07:57:13

Comparing candidate commit b23335c in PR branch avara1986/APPSEC-57162-ssrf_false_positive with baseline commit 1605451 in branch main.

Found 0 performance improvements and 4 performance regressions! Performance is the same for 499 metrics, 5 unstable metrics.

scenario:iastaspects-swapcase_aspect

• 🟥 execution_time [+176.571ns; +215.939ns] or [+7.205%; +8.812%]

scenario:iastaspectsospath-ospathnormcase_aspect

• 🟥 execution_time [+375.511ns; +445.298ns] or [+10.883%; +12.906%]

scenario:iastaspectsospath-ospathsplitdrive_aspect

• 🟥 execution_time [+377.225ns; +431.521ns] or [+10.374%; +11.867%]

scenario:iastaspectsospath-ospathsplitext_aspect

• 🟥 execution_time [+440.870ns; +581.497ns] or [+9.817%; +12.949%]