LuciferYang opened a new issue, #996:
URL: https://github.com/apache/iceberg-cpp/issues/996
## Summary
`ListTypeFromJson` in `src/iceberg/json_serde.cc` reads the element type
with the const `json[kElement]` accessor and never checks that the key exists.
For a list type object without `"element"`, nlohmann's const `operator[]` is
undefined behavior: with assertions enabled it aborts on `JSON_ASSERT(it !=
m_data.m_value.object->end())`, and under `NDEBUG` it dereferences the end
iterator.
## Reproduction
```cpp
auto json = R"({"type":"list","element-id":1,"element-required":true})"_json;
auto result = TypeFromJson(json);
// Debug build: Assertion failed: (it != m_data.m_value.object->end()),
function operator[], file json.hpp
```
## Impact
Every list type goes through `TypeFromJson`, so a schema with a list-typed
field that lacks `"element"` hits this whether the list is top level or nested
in a struct, map or list. `SchemaFromJson` reaches it when parsing table
metadata schemas, the `add-schema` table update, and the REST
`CreateTableRequest`. Per `SECURITY-THREAT-MODEL.md` catalog-supplied metadata
is trusted input, so this is a robustness issue rather than a security one.
## Proposed Fix
Read the key with `GetJsonValue<nlohmann::json>(json, kElement)`, the way
`MapTypeFromJson` reads `key` and `value`, so a missing key returns
`JsonParseError`.
Raised in
https://github.com/apache/iceberg-cpp/pull/982#pullrequestreview-5477946927.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
