Merge commit from fork

CHANGELOG.md

@@ -82,6 +82,7 @@ This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.htm
 - Fix race condition in `FixedSizeReservoir` in `go.opentelemetry.io/otel/sdk/metric/exemplar` by reverting #7447. (#8249)
 - Fix counting of spans and logs in self-observability metrics in `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc`, `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp`, `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc`, and `go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp`. (#8254)
 - Drop conflicting scope attributes named `name`, `version`, or `schema_url` from metric labels in `go.opentelemetry.io/otel/exporters/prometheus`, preserving the dedicated `otel_scope_name`, `otel_scope_version`, and `otel_scope_schema_url` labels. (#8264)
+- Close schema files opened by `ParseFile` in `go.opentelemetry.io/otel/schema/v1.0` and `go.opentelemetry.io/otel/schema/v1.1`. ([GHSA-995v-fvrw-c78m](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-995v-fvrw-c78m))
 
 <!-- Released section -->
 <!-- Don't change this section unless doing release -->

schema/v1.0/parser.go

@@ -26,6 +26,7 @@ func ParseFile(schemaFilePath string) (*ast.Schema, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer file.Close()
 	return Parse(file)
 }
 

schema/v1.0/parser_test.go

@@ -5,9 +5,12 @@ package schema
 
 import (
 	"bytes"
+	"os"
+	"runtime/debug"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"go.opentelemetry.io/otel/schema/v1.0/ast"
 	"go.opentelemetry.io/otel/schema/v1.0/types"
@@ -149,6 +152,29 @@ func TestParseSchemaFile(t *testing.T) {
 	)
 }
 
+func TestParseFileClosesFile(t *testing.T) {
+	oldGCPercent := debug.SetGCPercent(-1)
+	defer debug.SetGCPercent(oldGCPercent)
+
+	before := openFileDescriptors(t)
+	_, err := ParseFile("testdata/valid-example.yaml")
+	require.NoError(t, err)
+	after := openFileDescriptors(t)
+
+	assert.LessOrEqual(t, after, before, "ParseFile leaked file descriptors: before=%d after=%d", before, after)
+}
+
+func openFileDescriptors(t *testing.T) int {
+	t.Helper()
+
+	entries, err := os.ReadDir("/proc/self/fd")
+	if err != nil {
+		t.Skipf("cannot inspect file descriptors: %v", err)
+	}
+
+	return len(entries)
+}
+
 func TestFailParseSchemaFile(t *testing.T) {
 	ts, err := ParseFile("testdata/unsupported-file-format.yaml")
 	assert.Error(t, err)

schema/v1.1/parser.go

@@ -26,6 +26,7 @@ func ParseFile(schemaFilePath string) (*ast.Schema, error) {
 	if err != nil {
 		return nil, err
 	}
+	defer file.Close()
 	return Parse(file)
 }
 

schema/v1.1/parser_test.go

@@ -4,9 +4,12 @@
 package schema
 
 import (
+	"os"
+	"runtime/debug"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	ast10 "go.opentelemetry.io/otel/schema/v1.0/ast"
 	types10 "go.opentelemetry.io/otel/schema/v1.0/types"
@@ -160,6 +163,29 @@ func TestParseSchemaFile(t *testing.T) {
 	)
 }
 
+func TestParseFileClosesFile(t *testing.T) {
+	oldGCPercent := debug.SetGCPercent(-1)
+	defer debug.SetGCPercent(oldGCPercent)
+
+	before := openFileDescriptors(t)
+	_, err := ParseFile("testdata/valid-example.yaml")
+	require.NoError(t, err)
+	after := openFileDescriptors(t)
+
+	assert.LessOrEqual(t, after, before, "ParseFile leaked file descriptors: before=%d after=%d", before, after)
+}
+
+func openFileDescriptors(t *testing.T) int {
+	t.Helper()
+
+	entries, err := os.ReadDir("/proc/self/fd")
+	if err != nil {
+		t.Skipf("cannot inspect file descriptors: %v", err)
+	}
+
+	return len(entries)
+}
+
 func TestFailParseFileUnsupportedFileFormat(t *testing.T) {
 	ts, err := ParseFile("testdata/unsupported-file-format.yaml")
 	assert.ErrorContains(t, err, "unsupported schema file format minor version number")