Do not log Nessie catalog options map (tokens and secrets) when warehouse is unset
- Dominant language
- Java
- Stars
- 9.2k
- Forks
- 3.5k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 132
Description
> After review, this is not considered a serious vulnerability that needs to be kept private. Operator logs are a trusted surface, but Iceberg does not need to print secrets to say that `warehouse` is missing. Filed publicly as log hygiene.
# Summary
When `warehouse` is not set, `NessieCatalog.warehouseLocation` logs the entire `catalogOptions` map at WARN, then throws. The comment notes that Spark’s `catalogAndIdentifier` can swallow the exception, so they log on purpose.
That map is the catalog `initialize` options. It commonly includes Nessie auth (`nessie.authentication.token`, client credentials) and FileIO keys (`s3.secret-access-key`, session tokens, …). The useful message is only that `warehouse` is not set.
Fix: log name + missing `warehouse` only, or redact keys matching token / secret / password / credential / authorization.
# Affected Maven coordinates
* `org.apache.iceberg:iceberg-nessie`
# Attacker prerequisites
* a Nessie catalog initialized without `warehouse`
* read access to process logs at WARN (driver logs, log aggregator)
# Impact
* Catalog and storage credentials that were only in the catalog config appear in logs
* Does not by itself grant table or Nessie access; it copies secrets to a second ACL (logging)
# Proof status
Source review only. The issue is visible directly from source.
# Key source references
* `org.apache.iceberg.nessie.NessieCatalog` (`warehouseLocation`, `LOG.warn` with `catalogOptions`)
# Related
* Spark `Spark3Util.catalogAndIdentifier` — the catch that motivated the WARN (does not need the options map in the log line)
Contributor guide
Research direction
Start in org.apache.iceberg.nessie.NessieCatalog, focusing on warehouseLocation and the LOG.warn call reached when warehouse is unset. Confirm the WARN explains the missing warehouse without emitting catalogOptions or its token, secret, password, credential, or authorization values, then run the iceberg-nessie tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 78/100