Merge branch '2.11' into backport-10681-to-2.11

DataDog · Sep 20, 2024 · cf38dc8 · cf38dc8
2 parents f810426 + 44043c2
commit cf38dc8
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/ddtrace/appsec/_iast/_taint_tracking/_native.cpp b/ddtrace/appsec/_iast/_taint_tracking/_native.cpp
@@ -72,6 +72,12 @@ PYBIND11_MODULE(_native, m)
     }
 
     initializer = make_unique<Initializer>();
+    // Create an atexit callback to clean up the Initializer before the interpreter finishes
+    auto atexit_register = py::module_::import("atexit").attr("register");
+    atexit_register(py::cpp_function([]() {
+        initializer->reset_context();
+        initializer.reset();
+    }));
     initializer->create_context();
 
     m.doc() = "Native Python module";

diff --git a/releasenotes/notes/initializer-atexit-4c10671e585ac3e7.yaml b/releasenotes/notes/initializer-atexit-4c10671e585ac3e7.yaml
@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    Code Security: ensure the ``Initializer`` object is always reset and freed before the Python runtime.
+