apache/iceberg

`remove_orphan_files` scopes `file_list_view` with raw string prefix matching

Open

#16,493 建立於 2026年5月20日

在 GitHub 查看
 (4 留言) (0 反應) (0 負責人)Java (5,146 star) (1,915 fork)batch import
buggood first issue

描述

This issue was reported to the private Apache Iceberg security mailing list. The submitter is being kept anonymous because the report was sent to a private list. After review, the issue is not considered a serious vulnerability that needs to be kept private, so it is being filed publicly here for tracking and resolution.

Note: this submission was generated by AI. Please review its claims and source references carefully before acting on them.

Summary

Spark scopes file_list_view with raw string prefix matching, letting sibling paths fall inside orphan cleanup.

Affected Maven coordinates

  • versioned integration artifacts: org.apache.iceberg:iceberg-spark-3.4_*, org.apache.iceberg:iceberg-spark-3.5_*, org.apache.iceberg:iceberg-spark-4.0_2.13, org.apache.iceberg:iceberg-spark-4.1_2.13

Attacker prerequisites

  • control over a path, prefix, batch, or file list that sits adjacent to a legitimately scoped prefix
  • ability to trigger the credential-selection or cleanup path with that crafted input

Impact

  • A table location like s3://bucket/table also matches sibling prefixes such as s3://bucket/table-backup/....
  • If the caller supplies a crafted file_list_view, files outside the intended directory can be treated as in-scope and deleted.
  • This weakens scope checks even when the explicit location override is not used.

Proof status

Source review only. The issue is visible directly from source.

Key source references

  • org.apache.iceberg.spark.actions.DeleteOrphanFilesSparkAction

貢獻者指南

技術棧
javaspark
領域
backendsecurity
議題類型
bug
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
4
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-2 days
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
active
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
mostly clear
前置要求
Familiarity with Apache IcebergUnderstanding of Spark actionsKnowledge of S3 path semantics
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
10
研究方向
The issue is in `org.apache.iceberg.spark.actions.DeleteOrphanFilesSparkAction`, where `file list view` is scoped using raw string prefix matching, allowing sibling paths like `s3://bucket/table backup` to be matched incorrectly. To fix, implement proper path prefix checking (e.g., ensuring trailing slash or using a dedicated path matcher). Review the linked source and consider adding unit tests for edge cases with adjacent prefixes. No maintainer clarification needed as the vulnerability is well described.