fix(tracer): improve error handling for subprocess instrumentation

[avara1986]

This PR improves error handling for subprocess instrumentation. This PR fixes #13208

Restructured error handling: Moved subprocess calls outside of try-except blocks so legitimate errors are properly propagated:

# After (CORRECT - preserves errors)
@trace_utils.with_traced_module  
def _traced_subprocess_init(module, pin, wrapped, instance, args, kwargs):
    if not should_instrument:
        return wrapped(*args, **kwargs)
    
    try:
        # Only tracing logic in try-catch, not the subprocess call
        # ... instrumentation code ...
    except Exception:
        log.debug("Could not trace subprocess execution", exc_info=True)
    
    return wrapped(*args, **kwargs)  # ← Always called, errors propagate correctly

• Insufficient error handling tests: Limited coverage of error conditions across different subprocess and os functions
• Parameterized tests across different configuration scenarios:
  • ASM enabled/disabled combinations
  • IAST enabled/disabled combinations
  • WAF bypass configurations

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

releasenotes/notes/fix-subprocess-error-c90edf09a8ca57f3.yaml           @DataDog/apm-python
ddtrace/contrib/internal/subprocess/patch.py                            @DataDog/asm-python
ddtrace/settings/asm.py                                                 @DataDog/asm-python
tests/contrib/subprocess/test_subprocess.py                             @DataDog/asm-python

[github-actions]

Bootstrap import analysis

Comparison of import times between this PR and base.

Summary

The average import time from this PR is: 282 ± 5 ms.

The average import time from base is: 292 ± 3 ms.

The import time difference between this PR and base is: -9.9 ± 0.2 ms.

Import time breakdown

The following import paths have shrunk:

ddtrace.auto 6.287 ms (2.23%)

ddtrace.bootstrap.sitecustomize 3.639 ms (1.29%)

ddtrace.bootstrap.preload 2.982 ms (1.06%)

ddtrace.internal.remoteconfig.client 0.808 ms (0.29%)

ddtrace.internal.products 0.277 ms (0.10%)

importlib.metadata 0.277 ms (0.10%)

zipfile 0.224 ms (0.08%)

zipfile._path 0.183 ms (0.06%)

multiprocessing.sharedctypes 0.213 ms (0.08%)

multiprocessing.heap 0.213 ms (0.08%)

mmap 0.213 ms (0.08%)

ddtrace.settings.profiling 0.154 ms (0.05%)

ddtrace.vendor.psutil 0.103 ms (0.04%)

ddtrace.vendor.psutil._pslinux 0.042 ms (0.01%)

ddtrace.vendor.psutil._psutil_linux 0.022 ms (0.01%)

glob 0.020 ms (0.01%)

ddtrace.internal.symbol_db.remoteconfig 0.133 ms (0.05%)

ddtrace.internal.symbol_db.symbols 0.077 ms (0.03%)

ddtrace.settings.crashtracker 0.053 ms (0.02%)

ddtrace.internal.datadog.profiling.crashtracker 0.053 ms (0.02%)

ddtrace.internal.datadog.profiling.crashtracker._crashtracker 0.053 ms (0.02%)

ddtrace.internal.remoteconfig._connectors 0.039 ms (0.01%)

ctypes 0.039 ms (0.01%)

_ctypes 0.039 ms (0.01%)

ddtrace.debugging._import 0.038 ms (0.01%)

ddtrace.debugging._function.discovery 0.038 ms (0.01%)

ddtrace.internal.flare.flare 0.032 ms (0.01%)

logging.handlers 0.032 ms (0.01%)

ddtrace.internal.remoteconfig.worker 0.032 ms (0.01%)

ddtrace.settings.dynamic_instrumentation 0.026 ms (0.01%)

ddtrace.appsec._common_module_patches 0.191 ms (0.07%)

ddtrace.appsec._metrics 0.191 ms (0.07%)

ddtrace._trace.trace_handlers 0.171 ms (0.06%)

ddtrace._trace._inferred_proxy 0.075 ms (0.03%)

ddtrace.propagation.http 0.075 ms (0.03%)

ddtrace.contrib.trace_utils 0.031 ms (0.01%)

ddtrace.contrib.internal.trace_utils 0.031 ms (0.01%)

ddtrace.contrib.internal.subprocess.constants 0.024 ms (0.01%)

ddtrace 2.648 ms (0.94%)

ddtrace._logger 1.041 ms (0.37%)

ddtrace.internal.telemetry 1.041 ms (0.37%)

ddtrace.internal.telemetry.writer 0.581 ms (0.21%)

http.client 0.403 ms (0.14%)

email.parser 0.207 ms (0.07%)

email.feedparser 0.207 ms (0.07%)

email._policybase 0.207 ms (0.07%)

email.header 0.171 ms (0.06%)

email.charset 0.171 ms (0.06%)

email.utils 0.036 ms (0.01%)

email._parseaddr 0.036 ms (0.01%)

calendar 0.036 ms (0.01%)

ssl 0.147 ms (0.05%)

_ssl 0.065 ms (0.02%)

ddtrace.internal.telemetry.metrics_namespaces 0.042 ms (0.01%)

ddtrace.internal.telemetry.data 0.038 ms (0.01%)

ddtrace.internal.packages 0.038 ms (0.01%)

_sysconfigdata__linux_x86_64-linux-gnu 0.038 ms (0.01%)

ddtrace.settings._telemetry 0.029 ms (0.01%)

ddtrace.settings._inferred_base_service 0.029 ms (0.01%)

ddtrace.internal.runtime 0.028 ms (0.01%)

uuid 0.028 ms (0.01%)

ddtrace.settings._agent 0.460 ms (0.16%)

ddtrace.settings 0.235 ms (0.08%)

ddtrace.settings.http 0.184 ms (0.07%)

ddtrace.internal.utils.cache 0.184 ms (0.07%)

inspect 0.184 ms (0.07%)

ddtrace.settings.integration 0.051 ms (0.02%)

ddtrace.vendor.debtcollector 0.051 ms (0.02%)

ddtrace.vendor.debtcollector.moves 0.030 ms (0.01%)

ddtrace.vendor 0.021 ms (0.01%)

ddtrace.internal.module 0.021 ms (0.01%)

ddtrace.internal.wrapping.context 0.021 ms (0.01%)

ddtrace.internal.utils.inspection 0.021 ms (0.01%)

socket 0.146 ms (0.05%)

_socket 0.056 ms (0.02%)

array 0.027 ms (0.01%)

ddtrace.settings._core 0.079 ms (0.03%)

envier 0.051 ms (0.02%)

envier.env 0.051 ms (0.02%)

ddtrace.internal.native 0.028 ms (0.01%)

ddtrace.internal.native._native 0.028 ms (0.01%)

ddtrace.trace 0.337 ms (0.12%)

ddtrace._trace.filters 0.209 ms (0.07%)

ddtrace._trace.processor 0.209 ms (0.07%)

ddtrace._trace.sampler 0.138 ms (0.05%)

ddtrace._trace.span 0.138 ms (0.05%)

ddtrace.internal.sampling 0.044 ms (0.02%)

ddtrace.internal.rate_limiter 0.026 ms (0.01%)

ddtrace._trace.sampling_rule 0.018 ms (0.01%)

ddtrace.internal._rand 0.030 ms (0.01%)

ddtrace._trace._span_pointer 0.027 ms (0.01%)

ddtrace.internal.dogstatsd 0.043 ms (0.02%)

ddtrace.vendor.dogstatsd 0.043 ms (0.02%)

ddtrace.vendor.dogstatsd.base 0.043 ms (0.02%)

ddtrace.internal.writer 0.027 ms (0.01%)

ddtrace.internal.writer.writer 0.027 ms (0.01%)

gzip 0.027 ms (0.01%)

ddtrace._trace.tracer 0.061 ms (0.02%)

ddtrace.internal.processor.endpoint_call_counter 0.029 ms (0.01%)

ddtrace.internal._unpatched 0.247 ms (0.09%)

subprocess 0.144 ms (0.05%)

contextlib 0.144 ms (0.05%)

json 0.077 ms (0.03%)

json.decoder 0.077 ms (0.03%)

re 0.077 ms (0.03%)

enum 0.077 ms (0.03%)

types 0.040 ms (0.01%)

threading 0.026 ms (0.01%)

ddtrace.settings._config 0.220 ms (0.08%)

ddtrace.internal.gitmetadata 0.201 ms (0.07%)

ddtrace.ext.ci 0.180 ms (0.06%)

ddtrace.ext.git 0.180 ms (0.06%)

tempfile 0.180 ms (0.06%)

ddtrace.internal._file_queue 0.018 ms (0.01%)

ddtrace._monkey 0.134 ms (0.05%)

ddtrace.appsec._listeners 0.075 ms (0.03%)

ddtrace.internal.core 0.075 ms (0.03%)

ddtrace.internal.core.event_hub 0.048 ms (0.02%)

ddtrace.settings.asm 0.031 ms (0.01%)

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-06-11 19:57:18

Comparing candidate commit bb89b2d in PR branch avara1986/APPSEC-57924-subprocess_wrapper with baseline commit 9292dbd in branch main.

Found 0 performance improvements and 2 performance regressions! Performance is the same for 564 metrics, 6 unstable metrics.

scenario:iastaspectsospath-ospathjoin_aspect

• 🟥 execution_time [+947.030ns; +1026.158ns] or [+15.430%; +16.720%]

scenario:iastaspectsospath-ospathnormcase_aspect

• 🟥 execution_time [+359.749ns; +443.853ns] or [+10.413%; +12.848%]