Implementation classes named in table properties are imported and instantiated without a type check

Open
#3,932 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
python
Domain
security

Research direction

Start with _import_file_io in pyiceberg/io/init.py, _import_location_provider in pyiceberg/table/locations.py, and _import_retry_strategy in pyiceberg/io/pyarrow.py. Trace how each property is resolved and invoked, then verify that only subclasses of FileIO, LocationProvider, or S3RetryStrategy are accepted before instantiation; done means all three paths reject unrelated importable classes.

Written by the indexing model from the issue text.

Description

bug

Three properties name a class that PyIceberg imports and calls:

Property Resolved by Called as
py-io-impl _import_file_io (pyiceberg/io/__init__.py) class_(properties)
write.py-location-provider.impl _import_location_provider (pyiceberg/table/locations.py) class_(table_location, table_properties)
s3.retry-strategy-impl _import_retry_strategy (pyiceberg/io/pyarrow.py) class_()

Each follows the same pattern:

module = importlib.import_module(module_name)
class_ = getattr(module, class_name)
return class_(...)

None of the three checks that the resolved object is the type it is about to be used as — there is no issubclass against FileIO, LocationProvider, or S3RetryStrategy. Any importable dotted name resolves and is called, with the property map passed as an argument in two of the three cases.

All three properties are read from the merged table property map, so their values can originate in a table's metadata rather than in the operator's catalog configuration.

Issue investigation generated via claude, reviewed by Sung, Kevin, Fokko.

Dominant language
Python
Stars
1.1k
Forks
589
Avg merge
2d 4h
Merged PRs (30d)
72

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from apache/iceberg-python

All issues in apache/iceberg-python

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.