Hash Variant object keys in ExpressionUtil.sanitize (not only values)

Start in org.apache.iceberg.expressions.ExpressionUtil at sanitizeVariantObject and inspect how object keys are formatted versus values. Update the Variant sanitization test in org.apache.iceberg.expressions.TestExpressionUtil, then run that unit test. Done means sensitive Variant object keys are sanitized like string values while schema column names remain visible.

After review, this is not considered a serious vulnerability that needs to be kept private. Sanitized expressions are an operator metrics/log surface, but Variant object keys are query literals and should be hashed like other strings. Filed publicly as a sanitizer bug.

Summary

ExpressionUtil.sanitize is meant to redact predicate constants (hashed strings, digit-count for numbers, coarse dates). For Variant objects it formats keys as (hash-%s) with the original field name, then sanitizes the value. TestExpressionUtil currently expects that: keys look like (hash-event_name) while values look like (hash-79b17dd6).

Variant object keys are user data (they can hold the same secrets people put in string literals). Iceberg schema column names in the expression stay visible on purpose; these keys should not.

Consumers of the sanitized string include SnapshotScan ScanReport.filter (REST catalog metrics when v1/report-metrics is on) and any other ExpressionUtil.sanitize caller.

Fix: run object keys through sanitizeSimpleString (same as string values) and update the unit test.

Affected Maven coordinates

• org.apache.iceberg:iceberg-api

Attacker prerequisites

• a query (or bound expression) whose Variant literal uses sensitive strings as object keys
• read access to sanitized scan filters (metrics reporter / logs), not table data

Impact

• Predicate constants that people believed were hashed can appear in ScanReport / logs as Variant keys
• Does not grant table access; it is a sanitizer miss on an operator surface

Proof status

Source review. Visible in sanitizeVariantObject and the existing unit test expectations.

Key source references

• org.apache.iceberg.expressions.ExpressionUtil (sanitizeVariantObject, format (hash-%s) with field)
• org.apache.iceberg.expressions.TestExpressionUtil (Variant sanitize test)
• org.apache.iceberg.SnapshotScan (ExpressionUtil.sanitize into ScanReport)

Related

• apache/iceberg#11479 / PR #13137 added recursive Variant sanitizing. That ticket’s example kept object keys in the clear (hash-id) and hashed/coarsened values. This issue is a follow-up: keys are query data (like map-key literals on mp.key), not schema identifiers, and should go through sanitizeSimpleString. No open issue covers hashing the keys.