APPSEC-65478

Description

Extends RFC-1103 _dd.appsec.normalized_route to Tornado, following the FastAPI/Starlette (#17920), Django (#18209), and Flask (#18343) implementations.

Tornado's ddtrace integration produces http.route strings with %s as a placeholder for every capturing group (via _regex_to_route). The new normalizer maps those placeholders to parameter names sourced from path_params: a dict for named groups ((?P<name>...)), a list for positional groups, or {} for static routes. Optional trailing-slash patterns (/?) are treated as not declaring a trailing slash per RFC-1103 rule 1, consistent with the Django ^asm/?$ → /asm convention.

Changes:

• _normalized_route.py — adds _normalize_route_tornado_cached (LRU-cached, keyed on route + param-names tuple) and normalize_route_tornado (public entry point). Handles %s placeholder mapping, /? stripping, multi-param-in-segment combining with + (rule 5), and static-segment URL-encoding (rule 3).
• _handlers.py — registers "tornado": normalize_route_tornado in _NORMALIZED_ROUTE_BY_INTEGRATION.
• tornado_app/app.py — converts the /asm/ route from positional to named capturing groups so path_params arrives as a dict with proper parameter names; adds MultiParamHandler (/multi-param/) and FilesHandler (/files/) for integration test coverage.
• test_tornado.py — overrides test_normalized_route and test_normalized_route_disabled_when_api_security_off with Tornado-specific expected values (no trailing slash for /? routes); expands ENDPOINT_DISCOVERY_EXPECTED_PATHS.
• test_normalized_route.py — 27 new unit tests for normalize_route_tornado covering all code paths.
• utils.py — documents why Tornado is skipped in test_normalized_route_survives_request_span_name_override (span name is hard-coded via schematize_url_operation).

Testing

• 27 unit tests in tests/appsec/appsec/api_security/test_normalized_route.py covering named groups, positional groups, multi-param combining (+), /? stripping, explicit trailing-slash preservation, URL-encoding, mismatch detection, and lru_cache identity.
• Integration tests in test_tornado.py exercise the full request path: named-group params (/asm/{param_int}/{param_str}), multi-param-in-segment (/multi-param/{first+last}), catch-all (/files/{file_path}), root (/), ASM-disabled gate, and API-Security-disabled gate.
• test_normalized_route_disabled_when_api_security_off verifies the tag is absent when API Security is off while ASM is on.

Risks

None — all production code is confined to ddtrace/appsec/. No changes to integration code or public API. The /asm/ route change (positional → named groups) is backward-compatible: Tornado passes named groups as keyword arguments that match the existing handler signature.

Additional Notes

Tornado routes using positional groups (no (?P<name>...)) produce auto-numbered placeholders ({param1}, {param2}, …). Users who want named parameters in _dd.appsec.normalized_route should use named capturing groups in their route patterns.