pkg/util/debugutil: introduce debug.Stack() wrapper

Until now, all stack traces were treated as untyped strings and hence
redacted. Stack traces don't need to be redacted. Because they don't
contain any PII.

This commit introduces a new function, Stack(), in the debugutil package
as a replacement for the standard debug.Stack(). The new function wraps
the stack trace contents in a []byte-aliased type "SafeStack" that
implements the SafeValue interface, ensuring it is not redacted. This
function can be used as a drop-in replacement for debug.Stack().

Part of: CRDB-15292
Epic: CRDB-37533
Release note: None

pkg/BUILD.bazel

@@ -692,6 +692,7 @@ ALL_TESTS = [
     "//pkg/util/ctxgroup:ctxgroup_test",
     "//pkg/util/ctxlog:ctxlog_test",
     "//pkg/util/ctxutil:ctxutil_test",
+    "//pkg/util/debugutil:debugutil_test",
     "//pkg/util/duration:duration_test",
     "//pkg/util/encoding/csv:csv_test",
     "//pkg/util/encoding:encoding_test",
@@ -2459,6 +2460,7 @@ GO_TARGETS = [
     "//pkg/util/ctxutil:ctxutil",
     "//pkg/util/ctxutil:ctxutil_test",
     "//pkg/util/debugutil:debugutil",
+    "//pkg/util/debugutil:debugutil_test",
     "//pkg/util/duration:duration",
     "//pkg/util/duration:duration_test",
     "//pkg/util/encoding/csv:csv",

pkg/testutils/lint/passes/redactcheck/redactcheck.go

@@ -264,6 +264,9 @@ func runAnalyzer(pass *analysis.Pass) (interface{}, error) {
 					"github.com/cockroachdb/redact/internal/redact": {
 						"safeWrapper": {},
 					},
+					"github.com/cockroachdb/cockroach/pkg/util/debugutil": {
+						"SafeStack": {},
+					},
 				}
 				ty := recv[0].Type
 				reportFailure := func() {

pkg/util/debugutil/BUILD.bazel

@@ -1,9 +1,23 @@
-load("@io_bazel_rules_go//go:def.bzl", "go_library")
+load("@io_bazel_rules_go//go:def.bzl", "go_library", "go_test")
 
 go_library(
     name = "debugutil",
     srcs = ["debugutil.go"],
     importpath = "github.com/cockroachdb/cockroach/pkg/util/debugutil",
     visibility = ["//visibility:public"],
-    deps = ["@com_github_elastic_gosigar//:gosigar"],
+    deps = [
+        "@com_github_cockroachdb_redact//:redact",
+        "@com_github_cockroachdb_redact//interfaces",
+        "@com_github_elastic_gosigar//:gosigar",
+    ],
+)
+
+go_test(
+    name = "debugutil_test",
+    srcs = ["debugutil_test.go"],
+    embed = [":debugutil"],
+    deps = [
+        "@com_github_cockroachdb_redact//:redact",
+        "@com_github_stretchr_testify//require",
+    ],
 )

pkg/util/debugutil/debugutil.go

@@ -8,6 +8,7 @@ package debugutil
 import (
 	"os"
 	"path/filepath"
+	"runtime/debug"
 	"sync/atomic"
 
 	"github.com/elastic/gosigar"
@@ -43,3 +44,18 @@ func init() {
 		return false
 	}(os.Getppid()))
 }
+
+type SafeStack []byte
+
+func (s SafeStack) SafeValue() {}
+
+// Stack wraps the output of debug.Stack() with redact.Safe() to avoid
+// unnecessary redaction.
+//
+// WARNING: Calling this function grabs system-level locks and could cause high
+// system CPU usage resulting in the Go runtime to lock up if called too
+// frequently, even if called only in error-handling pathways. Use sporadically
+// and only when necessary.
+func Stack() SafeStack {
+	return SafeStack(debug.Stack())
+}

pkg/util/debugutil/debugutil_test.go

@@ -0,0 +1,24 @@
+// Copyright 2023 The Cockroach Authors.
+//
+// Use of this software is governed by the CockroachDB Software License
+// included in the /LICENSE file.
+
+package debugutil
+
+import (
+	"testing"
+
+	"github.com/cockroachdb/redact"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStack(t *testing.T) {
+	var buf redact.StringBuilder
+	buf.Print(Stack())
+	buf.Printf("%s", Stack())
+	buf.Printf("%v", Stack())
+	out := buf.RedactableString()
+
+	require.NotContains(t, out, "‹")
+	require.NotContains(t, out, "›")
+}