Extends RFC-1103 ``_dd.appsec.normalized_route`` to Flask, mirroring the
FastAPI/Starlette (#17920) and Django (#18209) implementations.

- ``ddtrace/appsec/_api_security/_normalized_route.py``: adds
  ``normalize_route_flask`` with a fast path (single-converter params, no
  catch-all) and a slow path covering multi-param-in-segment, ``<path:name>``
  catch-all, ``any(...)`` converters, and static URL-encoding.
- ``ddtrace/appsec/_handlers.py``: adds ``"flask"`` to
  ``_NORMALIZED_ROUTE_BY_INTEGRATION``; resolves the DispatcherMiddleware
  mount prefix from ``flask.resource.full`` so sub-app routes include their
  full assembled path.
- Test app (flat + subapp): adds ``/multi-param/<first>.<last>/`` and
  ``/files/<path:file_path>`` routes.
- ``tests/appsec/contrib_appsec/utils.py``: removes Flask from
  ``xfail_interface`` on the two normalized-route tests.
- Unit tests: 50 new parametrized cases for ``normalize_route_flask``,
  fast-path eligibility, and invalid-input rejection.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>

Extends RFC-1103 ``_dd.appsec.normalized_route`` to Flask, mirroring the
FastAPI/Starlette (#17920) and Django (#18209) implementations.

- ``ddtrace/appsec/_api_security/_normalized_route.py``: adds
  ``normalize_route_flask`` with a fast path (single-converter params, no
  catch-all) and a slow path covering multi-param-in-segment, ``<path:name>``
  catch-all, ``any(...)`` converters, and static URL-encoding.
- ``ddtrace/appsec/_handlers.py``: adds ``"flask"`` to
  ``_NORMALIZED_ROUTE_BY_INTEGRATION``; resolves the DispatcherMiddleware
  mount prefix from ``flask.resource.full`` so sub-app routes include their
  full assembled path.
- Test app (flat + subapp): adds ``/multi-param/<first>.<last>/`` and
  ``/files/<path:file_path>`` routes.
- ``tests/appsec/contrib_appsec/utils.py``: removes Flask from
  ``xfail_interface`` on the two normalized-route tests.
- Unit tests: 50 new parametrized cases for ``normalize_route_flask``,
  fast-path eligibility, and invalid-input rejection.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>

Extends RFC-1103 ``_dd.appsec.normalized_route`` to Flask, mirroring the
FastAPI/Starlette (#17920) and Django (#18209) implementations.

- ``ddtrace/appsec/_api_security/_normalized_route.py``: adds
  ``normalize_route_flask`` with a fast path (single-converter params, no
  catch-all) and a slow path covering multi-param-in-segment, ``<path:name>``
  catch-all, ``any(...)`` converters, and static URL-encoding.
- ``ddtrace/appsec/_handlers.py``: adds ``"flask"`` to
  ``_NORMALIZED_ROUTE_BY_INTEGRATION``; resolves the DispatcherMiddleware
  mount prefix from ``flask.resource.full`` so sub-app routes include their
  full assembled path.
- Test app (flat + subapp): adds ``/multi-param/<first>.<last>/`` and
  ``/files/<path:file_path>`` routes.
- ``tests/appsec/contrib_appsec/utils.py``: removes Flask from
  ``xfail_interface`` on the two normalized-route tests.
- Unit tests: 50 new parametrized cases for ``normalize_route_flask``,
  fast-path eligibility, and invalid-input rejection.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <[email protected]>

APPSEC-65477

## Description

Extends RFC-1103 `_dd.appsec.normalized_route` to Flask, following the FastAPI/Starlette (#17920) and Django (#18209) implementations.

- **Normalizer** (`ddtrace/appsec/_api_security/_normalized_route.py`): `normalize_route_flask()` with fast path (single-converter params) and slow path (multi-param segments, `<path:name>` catch-all, `any()` converters, static URL-encoding).
- **Handler** (`ddtrace/appsec/_handlers.py`): adds `"flask"` to `_NORMALIZED_ROUTE_BY_INTEGRATION`; resolves `DispatcherMiddleware` mount prefix from `FLASK_RESOURCE_FULL` so sub-app routes include their full assembled path.

## Testing

- 56 new unit test cases for `normalize_route_flask` (fast path, slow path, invalid inputs, DM assembly, edge cases).
- Integration tests un-xfailed for Flask on `test_normalized_route` and `test_normalized_route_disabled_when_api_security_off`.
- Covers both flat-app (Blueprint) and subapp (DispatcherMiddleware) interface variants.

## Risks

None — all production code is in `ddtrace/appsec/`. No changes to integration code or public API.

## Additional Notes

Non-terminal `<path:...>` routes (e.g. `/<path:wiki>/edit`, valid in Werkzeug) return `None` — omit rather than guess, per RFC-1103 rule 5 which mandates catch-alls be terminal.

Co-authored-by: christophe.papazian <[email protected]>

## Description

Extends RFC-1103 `_dd.appsec.normalized_route` to Tornado, following the FastAPI/Starlette (#17920), Django (#18209), and Flask (#18343) implementations.

Tornado's ddtrace integration produces `http.route` strings with `%s` as a placeholder for every capturing group (via `_regex_to_route`). The new normalizer maps those placeholders to parameter names sourced from `path_params`: a dict for named groups (`(?P<name>...)`), a list for positional groups, or `{}` for static routes. Optional trailing-slash patterns (`/?`) are treated as not declaring a trailing slash per RFC-1103 rule 1, consistent with the Django `^asm/?$` → `/asm` convention.

**Changes:**

- **`_normalized_route.py`** — adds `_normalize_route_tornado_cached` (LRU-cached, keyed on route + param-names tuple) and `normalize_route_tornado` (public entry point). Handles `%s` placeholder mapping, `/?` stripping, multi-param-in-segment combining with `+` (rule 5), and static-segment URL-encoding (rule 3).
- **`_handlers.py`** — registers `"tornado": normalize_route_tornado` in `_NORMALIZED_ROUTE_BY_INTEGRATION`.
- **`tornado_app/app.py`** — converts the `/asm/` route from positional to named capturing groups so `path_params` arrives as a dict with proper parameter names; adds `MultiParamHandler` (`/multi-param/`) and `FilesHandler` (`/files/`) for integration test coverage.
- **`test_tornado.py`** — overrides `test_normalized_route` and `test_normalized_route_disabled_when_api_security_off` with Tornado-specific expected values (no trailing slash for `/?` routes); expands `ENDPOINT_DISCOVERY_EXPECTED_PATHS`.
- **`test_normalized_route.py`** — 27 new unit tests for `normalize_route_tornado` covering all code paths.
- **`utils.py`** — documents why Tornado is skipped in `test_normalized_route_survives_request_span_name_override` (span name is hard-coded via `schematize_url_operation`).

## Testing

- 27 unit tests in `tests/appsec/appsec/api_security/test_normalized_route.py` covering named groups, positional groups, multi-param combining (`+`), `/?` stripping, explicit trailing-slash preservation, URL-encoding, mismatch detection, and `lru_cache` identity.
- Integration tests in `test_tornado.py` exercise the full request path: named-group params (`/asm/{param_int}/{param_str}`), multi-param-in-segment (`/multi-param/{first+last}`), catch-all (`/files/{file_path}`), root (`/`), ASM-disabled gate, and API-Security-disabled gate.
- `test_normalized_route_disabled_when_api_security_off` verifies the tag is absent when API Security is off while ASM is on.

## Risks

None — all production code is confined to `ddtrace/appsec/`. No changes to integration code or public API. The `/asm/` route change (positional → named groups) is backward-compatible: Tornado passes named groups as keyword arguments that match the existing handler signature.

## Additional Notes

Tornado routes using positional groups (no `(?P<name>...)`) produce auto-numbered placeholders (`{param1}`, `{param2}`, …). Users who want named parameters in `_dd.appsec.normalized_route` should use named capturing groups in their route patterns.

Co-authored-by: christophe.papazian <[email protected]>