RussellSpitzer opened a new issue, #17836: URL: https://github.com/apache/iceberg/issues/17836
> After review, this is not considered a serious vulnerability that needs to be kept private. Sanitized expressions are an operator metrics/log surface, but Variant object keys are query literals and should be hashed like other strings. Filed publicly as a sanitizer bug. # Summary `ExpressionUtil.sanitize` is meant to redact predicate constants (hashed strings, digit-count for numbers, coarse dates). For Variant objects it formats keys as `(hash-%s)` **with the original field name**, then sanitizes the value. `TestExpressionUtil` currently expects that: keys look like `(hash-event_name)` while values look like `(hash-79b17dd6)`. Variant object keys are user data (they can hold the same secrets people put in string literals). Iceberg schema column names in the expression stay visible on purpose; these keys should not. Consumers of the sanitized string include `SnapshotScan` `ScanReport.filter` (REST catalog metrics when `v1/report-metrics` is on) and any other `ExpressionUtil.sanitize` caller. Fix: run object keys through `sanitizeSimpleString` (same as string values) and update the unit test. # Affected Maven coordinates * `org.apache.iceberg:iceberg-api` # Attacker prerequisites * a query (or bound expression) whose Variant literal uses sensitive strings as object keys * read access to sanitized scan filters (metrics reporter / logs), not table data # Impact * Predicate constants that people believed were hashed can appear in ScanReport / logs as Variant keys * Does not grant table access; it is a sanitizer miss on an operator surface # Proof status Source review. Visible in `sanitizeVariantObject` and the existing unit test expectations. # Key source references * `org.apache.iceberg.expressions.ExpressionUtil` (`sanitizeVariantObject`, format `(hash-%s)` with `field`) * `org.apache.iceberg.expressions.TestExpressionUtil` (Variant sanitize test) * `org.apache.iceberg.SnapshotScan` (`ExpressionUtil.sanitize` into `ScanReport`) # Related * [apache/iceberg#11479](https://github.com/apache/iceberg/issues/11479) / [PR #13137](https://github.com/apache/iceberg/pull/13137) added recursive Variant sanitizing. That ticket’s example kept object keys in the clear (`hash-id`) and hashed/coarsened values. This issue is a follow-up: keys are query data (like map-key literals on `mp.key`), not schema identifiers, and should go through `sanitizeSimpleString`. No open issue covers hashing the keys. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
