fix(tracing): disallow the propagation of negative trace IDs [backport 1.13] (#6135)

Backport 3380b10 from #6133 to 1.13.

This pull request fixes the symptom reported in
#6125 by ensuring that
ddtrace does not set negative values in the trace ID propagation header.
Whatever underlying issue is causing the trace ID to be negative still
exists despite this change.

Co-authored-by: Emmett Butler <[email protected]>

Author: github-actions[bot]

ddtrace/propagation/http.py

@@ -217,7 +217,7 @@ def _extract(headers):
         except ValueError:
             trace_id = 0
 
-        if trace_id == 0 or trace_id > _MAX_UINT_64BITS:
+        if trace_id <= 0 or trace_id > _MAX_UINT_64BITS:
             log.warning(
                 "Invalid trace id: %r. `x-datadog-trace-id` must be greater than zero and less than 2**64", trace_id_str
             )

releasenotes/notes/negative-trace-id-813bd867c1c8553e.yaml

@@ -0,0 +1,5 @@
+---
+fixes:
+  - |
+    tracing: This fix resolves an issue where negative trace ID values were allowed to propagate via Datadog
+    distributed tracing HTTP headers.

tests/tracer/test_propagation.py

@@ -1075,6 +1075,17 @@ def test_extract_tracecontext(headers, expected_context):
             "dd_origin": "synthetics",
         },
     ),
+    (
+        "invalid_datadog_negative_trace_id",
+        [PROPAGATION_STYLE_DATADOG],
+        {
+            HTTP_HEADER_TRACE_ID: "-1",
+            HTTP_HEADER_PARENT_ID: "5678",
+            HTTP_HEADER_SAMPLING_PRIORITY: "1",
+            HTTP_HEADER_ORIGIN: "synthetics",
+        },
+        CONTEXT_EMPTY,
+    ),
     (
         "valid_datadog_explicit_style_wsgi",
         [PROPAGATION_STYLE_DATADOG],
@@ -1560,7 +1571,6 @@ def test_propagation_extract_env(name, styles, headers, expected_context, run_py
         env["DD_TRACE_PROPAGATION_STYLE"] = ",".join(styles)
     stdout, stderr, status, _ = run_python_code_in_subprocess(code=code, env=env)
     assert status == 0, (stdout, stderr)
-    assert stderr == b"", (stdout, stderr)
 
     result = json.loads(stdout.decode())
     assert result == expected_context