fix: avoid potential hang as it blocks on process.getInputStream().readAllBytes() before timeout checking

Author: soul2zimate

src/main/java/io/github/guacsec/trustifyda/providers/CargoProvider.java

@@ -45,7 +45,10 @@
 import java.util.HashSet;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ExecutionException;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
 import java.util.logging.Logger;
 import org.tomlj.Toml;
 import org.tomlj.TomlParseResult;
@@ -341,23 +344,53 @@ private CargoMetadata executeCargoMetadata() throws IOException, InterruptedExce
             .directory(workingDir.toFile())
             .start();
 
-    String output;
-    try (InputStream is = process.getInputStream()) {
-      output = new String(is.readAllBytes(), StandardCharsets.UTF_8);
-    }
+    // Use CompletableFuture to read output streams concurrently to avoid two potential deadlocks:
+    // 1. buffer deadlock (process blocks on write when output buffers fill up while Java waits for
+    // process completion)
+    // 2. stalled process deadlock (readAllBytes() hangs forever when cargo process stalls
+    // completely
+    // with no timeout protection)
+    CompletableFuture<String> outputFuture =
+        CompletableFuture.supplyAsync(
+            () -> {
+              try (InputStream is = process.getInputStream()) {
+                return new String(is.readAllBytes(), StandardCharsets.UTF_8);
+              } catch (IOException e) {
+                return "";
+              }
+            });
+
+    CompletableFuture<String> errorFuture =
+        CompletableFuture.supplyAsync(
+            () -> {
+              try (InputStream is = process.getErrorStream()) {
+                return new String(is.readAllBytes(), StandardCharsets.UTF_8);
+              } catch (IOException e) {
+                return "";
+              }
+            });
 
     boolean finished = process.waitFor(TIMEOUT, TimeUnit.SECONDS);
 
+    if (!finished) {
+      process.destroyForcibly();
+      throw new InterruptedException("cargo metadata timed out after " + TIMEOUT + " seconds");
+    }
+
+    String output;
+    String errorOutput;
+    try {
+      output = outputFuture.get(TIMEOUT, TimeUnit.SECONDS);
+      errorOutput = errorFuture.get(TIMEOUT, TimeUnit.SECONDS);
+    } catch (ExecutionException | TimeoutException e) {
+      log.warning("Failed to read process output: " + e.getMessage());
+      return null;
+    }
+
+    // Safe to call exitValue() - we confirmed the process finished
     int exitCode = process.exitValue();
 
     if (exitCode != 0) {
-      String errorOutput = "";
-      try (InputStream errorStream = process.getErrorStream()) {
-        errorOutput = new String(errorStream.readAllBytes(), StandardCharsets.UTF_8);
-      } catch (IOException e) {
-        log.warning("Failed to read error stream: " + e.getMessage());
-      }
-
       String errorMessage = "cargo metadata failed with exit code: " + exitCode;
       if (!errorOutput.isEmpty()) {
         errorMessage += ". Error: " + errorOutput.trim();
@@ -373,11 +406,6 @@ private CargoMetadata executeCargoMetadata() throws IOException, InterruptedExce
       return null;
     }
 
-    if (!finished) {
-      process.destroyForcibly();
-      throw new InterruptedException("cargo metadata timed out after " + TIMEOUT + " seconds");
-    }
-
     try {
       CargoMetadata metadata = MAPPER.readValue(output, CargoMetadata.class);
       if (debugLoggingIsNeeded()) {
@@ -552,12 +580,14 @@ private DependencyInfo getPackageInfo(String packageId, Map<String, CargoPackage
   public CargoProvider(Path manifest) {
     super(Type.CARGO, manifest);
     this.cargoExecutable = Operations.getExecutable("cargo", "--version");
-    if (cargoExecutable != null) {
-      log.info("Found cargo executable: " + cargoExecutable);
-    } else {
-      log.warning("Cargo executable not found - dependency analysis will not work");
+    if (debugLoggingIsNeeded()) {
+      if (cargoExecutable != null) {
+        log.info("Found cargo executable: " + cargoExecutable);
+      } else {
+        log.warning("Cargo executable not found - dependency analysis will not work");
+      }
+      log.info("Initialized RustProvider for manifest: " + manifest);
     }
-    log.info("Initialized RustProvider for manifest: " + manifest);
   }
 
   @Override