Merge remote-tracking branch 'origin/main' into brettlangdon/macro.wheels

Author: brettlangdon

ddtrace/appsec/_common_module_patches.py

@@ -222,7 +222,7 @@ def wrapped_open_ED4CF71136E15EBF(original_open_callable, instance, args, kwargs
                     # api10 response handler for regular reponses
                     if response.__class__.__name__ == "HTTPResponse":
                         addresses = {
-                            "DOWN_RES_STATUS": response.status,
+                            "DOWN_RES_STATUS": str(response.status),
                             "DOWN_RES_HEADERS": _build_headers(response.getheaders()),
                         }
                         if use_body:
@@ -242,7 +242,7 @@ def wrapped_open_ED4CF71136E15EBF(original_open_callable, instance, args, kwargs
                             response_headers = None
                         if status_code is not None or response_headers is not None:
                             call_waf_callback(
-                                {"DOWN_RES_STATUS": status_code, "DOWN_RES_HEADERS": response_headers},
+                                {"DOWN_RES_STATUS": str(status_code), "DOWN_RES_HEADERS": response_headers},
                                 rule_type=EXPLOIT_PREVENTION.TYPE.SSRF,
                             )
                     raise

releasenotes/notes/api10_status_code-deb7bbc4c0c2a68e.yaml

@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    AAP: make sure the status code for downstream requests is properly sent to libddwaf.