fix(aap): properly manage large async request bodies

[christophe-papazian]

Properly manage large request bodies with fastapi for AAP.

• introduce DD_FASTAPI_ASYNC_BODY_TIMEOUT_SECONDS to async wait for each part of the request body. Default to 0.1 second
• Properly loop on all body chuncks.
• It's fixing failures on system tests test_truncation for fastapi
• updating slo mem limits for appsec tests, as we introduce a new import of asyncio module.

APPSEC-58266

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

releasenotes/notes/fastapi_body_extraction_for_aap-b6f53b4f03015319.yaml  @DataDog/apm-python
.gitlab/benchmarks/bp-runner.microbenchmarks.fail-on-breach.yml         @DataDog/python-guild @DataDog/apm-core-python
ddtrace/appsec/_handlers.py                                             @DataDog/asm-python
ddtrace/settings/asm.py                                                 @DataDog/asm-python
tests/telemetry/test_writer.py                                          @DataDog/apm-python

[github-actions]

Bootstrap import analysis

Comparison of import times between this PR and base.

Summary

The average import time from this PR is: 279 ± 3 ms.

The average import time from base is: 281 ± 3 ms.

The import time difference between this PR and base is: -2.4 ± 0.1 ms.

Import time breakdown

The following import paths have shrunk:

ddtrace.auto 2.035 ms (0.73%)

ddtrace.bootstrap.sitecustomize 1.355 ms (0.49%)

ddtrace.bootstrap.preload 1.355 ms (0.49%)

ddtrace.internal.remoteconfig.client 0.669 ms (0.24%)

ddtrace 0.680 ms (0.24%)

ddtrace.internal._unpatched 0.033 ms (0.01%)

json 0.033 ms (0.01%)

json.decoder 0.033 ms (0.01%)

re 0.033 ms (0.01%)

enum 0.033 ms (0.01%)

types 0.033 ms (0.01%)

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-07-10 08:32:45

Comparing candidate commit bb194ae in PR branch christophe-papazian/manage-large-body-with-fastapi with baseline commit b17d958 in branch main.

Found 0 performance improvements and 2 performance regressions! Performance is the same for 428 metrics, 2 unstable metrics.

scenario:iastaspectsospath-ospathsplitext_aspect

• 🟥 execution_time [+759.915ns; +823.046ns] or [+16.635%; +18.017%]

scenario:telemetryaddmetric-1-distribution-metric-1-times

• 🟥 execution_time [+348.613ns; +383.660ns] or [+11.839%; +13.029%]

[brettlangdon]

slo changes lgtm, not too eager with the increase 👍🏻