fix(iast): fix import loop (#12095)

Co-authored-by: Brett Langdon <[email protected]>

Author: gnufede

ddtrace/appsec/_iast/_ast/ast_patching.py

@@ -17,6 +17,7 @@
 from ddtrace.appsec._python_info.stdlib import _stdlib_for_python_version
 from ddtrace.internal.logger import get_logger
 from ddtrace.internal.module import origin
+from ddtrace.internal.packages import get_package_distributions
 from ddtrace.internal.utils.formats import asbool
 
 from .visitor import AstVisitor
@@ -462,8 +463,6 @@ def _is_first_party(module_name: str):
         return False
 
     if not _IMPORTLIB_PACKAGES:
-        from ddtrace.internal.packages import get_package_distributions
-
         _IMPORTLIB_PACKAGES = set(get_package_distributions())
 
     return module_name.split(".")[0] not in _IMPORTLIB_PACKAGES

ddtrace/internal/packages.py

@@ -45,7 +45,7 @@ def get_distributions():
     return pkgs
 
 
-@callonce
+@cached(maxsize=1)
 def get_package_distributions() -> t.Mapping[str, t.List[str]]:
     """a mapping of importable package names to their distribution name(s)"""
     try:

releasenotes/notes/fix-asm-package-distributions-import-loop-11693f2a26032774.yaml

@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    Code security (IAST): This fix resolves an issue where the usage of `callonce` decorator could trigger an import loop