fix(flow-php/telemetry): harden GitDetector against hostile repositories

src/bridge/phpunit/telemetry/src/Flow/Bridge/PHPUnit/Telemetry/TelemetryFactory.php

@@ -25,10 +25,15 @@
 use function Flow\Telemetry\DSL\batching_log_processor;
 use function Flow\Telemetry\DSL\batching_metric_processor;
 use function Flow\Telemetry\DSL\batching_span_processor;
+use function Flow\Telemetry\DSL\composer_detector;
+use function Flow\Telemetry\DSL\environment_detector;
 use function Flow\Telemetry\DSL\git_detector;
+use function Flow\Telemetry\DSL\host_detector;
 use function Flow\Telemetry\DSL\logger_provider;
 use function Flow\Telemetry\DSL\memory_context_storage;
 use function Flow\Telemetry\DSL\meter_provider;
+use function Flow\Telemetry\DSL\os_detector;
+use function Flow\Telemetry\DSL\process_detector;
 use function Flow\Telemetry\DSL\resource;
 use function Flow\Telemetry\DSL\resource_detector;
 use function Flow\Telemetry\DSL\telemetry;
@@ -39,9 +44,15 @@ final class TelemetryFactory
 {
     public static function create(Configuration $config): Telemetry
     {
-        $telemetryResource = resource_detector()
+        $telemetryResource = resource_detector([
+            os_detector(),
+            host_detector(),
+            process_detector(),
+            composer_detector(),
+            environment_detector(),
+            git_detector(),
+        ])
             ->detect()
-            ->merge(git_detector()->detect())
             ->merge(resource([
                 'service.name' => $config->serviceName,
                 'telemetry.sdk.name' => 'flow-php-phpunit-telemetry',

src/lib/telemetry/src/Flow/Telemetry/Resource/Detector/GitDetector.php

@@ -9,11 +9,17 @@
 use Flow\Telemetry\Resource\ResourceDetector;
 
 use function fclose;
+use function feof;
+use function fread;
+use function getenv;
 use function is_resource;
-use function is_string;
+use function microtime;
 use function proc_close;
 use function proc_open;
-use function stream_get_contents;
+use function proc_terminate;
+use function stream_select;
+use function stream_set_blocking;
+use function strlen;
 use function trim;
 
 /**
@@ -39,6 +45,10 @@
  */
 final readonly class GitDetector implements ResourceDetector
 {
+    private const MAX_OUTPUT_BYTES = 1_048_576;
+
+    private const TIMEOUT_SECONDS = 10.0;
+
     private RemoteUrlSanitizer $remoteUrlSanitizer;
 
     public function __construct(
@@ -108,8 +118,12 @@ private function runGit(array $arguments): ?string
             2 => ['pipe', 'w'],
         ];
 
+        $environment = getenv();
+        // Never let git block waiting for an interactive credential prompt.
+        $environment['GIT_TERMINAL_PROMPT'] = '0';
+
         $pipes = [];
-        $process = @proc_open($command, $descriptors, $pipes);
+        $process = @proc_open($command, $descriptors, $pipes, null, $environment);
 
         if (!is_resource($process)) {
             return null;
@@ -123,21 +137,83 @@ private function runGit(array $arguments): ?string
             fclose($stdin);
         }
 
-        $output = is_resource($stdout) ? stream_get_contents($stdout) : null;
+        foreach ([$stdout, $stderr] as $pipe) {
+            if (is_resource($pipe)) {
+                stream_set_blocking($pipe, false);
+            }
+        }
+
+        $output = '';
+        $deadline = microtime(true) + self::TIMEOUT_SECONDS;
+        $timedOut = false;
+
+        while (is_resource($stdout) || is_resource($stderr)) {
+            $remaining = $deadline - microtime(true);
+
+            if ($remaining <= 0) {
+                $timedOut = true;
+
+                break;
+            }
+
+            $read = [];
 
-        if (is_resource($stdout)) {
-            fclose($stdout);
+            if (is_resource($stdout)) {
+                $read[] = $stdout;
+            }
+
+            if (is_resource($stderr)) {
+                $read[] = $stderr;
+            }
+
+            $write = [];
+            $except = [];
+            $seconds = (int) $remaining;
+
+            if (
+                @stream_select($read, $write, $except, $seconds, (int) (($remaining - $seconds) * 1_000_000)) === false
+            ) {
+                break;
+            }
+
+            foreach ($read as $pipe) {
+                $chunk = fread($pipe, 8192);
+
+                // Drain stderr without retaining it; cap stdout so a hostile config cannot exhaust memory.
+                if (
+                    $chunk !== false
+                    && $chunk !== ''
+                    && $pipe === $stdout
+                    && strlen($output) < self::MAX_OUTPUT_BYTES
+                ) {
+                    $output .= $chunk;
+                }
+
+                if ($chunk === false || feof($pipe)) {
+                    fclose($pipe);
+
+                    if ($pipe === $stdout) {
+                        $stdout = null;
+                    } elseif ($pipe === $stderr) {
+                        $stderr = null;
+                    }
+                }
+            }
         }
 
-        // Drain and discard stderr so the child never blocks on a full pipe.
-        if (is_resource($stderr)) {
-            stream_get_contents($stderr);
-            fclose($stderr);
+        if ($timedOut) {
+            proc_terminate($process, 9);
+        }
+
+        foreach ([$stdout, $stderr] as $pipe) {
+            if (is_resource($pipe)) {
+                fclose($pipe);
+            }
         }
 
         proc_close($process);
 
-        if (!is_string($output)) {
+        if ($timedOut) {
             return null;
         }
 

src/lib/telemetry/src/Flow/Telemetry/Resource/Detector/RemoteUrlSanitizer.php

@@ -8,8 +8,10 @@
 use function parse_url;
 
 /**
- * Removes any embedded credentials (user:password@) from a remote URL so they
- * are never reported as a resource attribute.
+ * Reduces a remote URL to its scheme, host, optional port and path so that no
+ * secrets are ever reported as a resource attribute. Embedded credentials
+ * (user:password@) are removed, and any query string or fragment is dropped as
+ * either can carry an access token.
  *
  * SCP-like SSH remotes (e.g. "git@github.com:org/repo.git") carry no secret and
  * are returned untouched, as are URLs that cannot be parsed.
@@ -24,26 +26,12 @@ public function sanitize(string $url): string
             return $url;
         }
 
-        if (!isset($parts['user']) && !isset($parts['pass'])) {
-            return $url;
-        }
-
         $sanitized = $parts['scheme'] . '://' . $parts['host'];
 
         if (isset($parts['port'])) {
             $sanitized .= ':' . $parts['port'];
         }
 
-        $sanitized .= $parts['path'] ?? '';
-
-        if (isset($parts['query'])) {
-            $sanitized .= '?' . $parts['query'];
-        }
-
-        if (isset($parts['fragment'])) {
-            $sanitized .= '#' . $parts['fragment'];
-        }
-
-        return $sanitized;
+        return $sanitized . ($parts['path'] ?? '');
     }
 }