RussellSpitzer commented on issue #16484:
URL: https://github.com/apache/iceberg/issues/16484#issuecomment-4504232309
Not a security issue and actually defined in the API
```
/**
* Create an output stream for the specified location if the target object
does not exist in GCS
* at the time of invocation.
*
* @return output stream
*/
```
For this to be security issue we would need an Application using the library
where
1. Two clients of the application are allowed to write the same object key
2. The application would also choose the same key for both clients based on
their request
For reference our metadata.json paths are generated with a UUID.randomUUID()
so it would be basically impossible for this to happen for metadata corruption.
The "if not exists" is a best effort thing and the real way the library
protects against this is by using unique path names.
So even in the circumstance where someone was relying on this to be "atomic"
(which the doc says is not the case), this shouldn't be an issue for any
library users.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
