apache / apache/iceberg

Do not log Nessie catalog options map (tokens and secrets) when warehouse is unset

Open Beginner friendly
#17,804 0 comments 0 reactions 0 assignees View on GitHub
Security
Dominant language
Java
Stars
9.2k
Forks
3.5k
Avg merge
2d 11h
Merged PRs (30d)
132

Description

> After review, this is not considered a serious vulnerability that needs to be kept private. Operator logs are a trusted surface, but Iceberg does not need to print secrets to say that `warehouse` is missing. Filed publicly as log hygiene.

# Summary

When `warehouse` is not set, `NessieCatalog.warehouseLocation` logs the entire `catalogOptions` map at WARN, then throws. The comment notes that Spark’s `catalogAndIdentifier` can swallow the exception, so they log on purpose.

That map is the catalog `initialize` options. It commonly includes Nessie auth (`nessie.authentication.token`, client credentials) and FileIO keys (`s3.secret-access-key`, session tokens, …). The useful message is only that `warehouse` is not set.

Fix: log name + missing `warehouse` only, or redact keys matching token / secret / password / credential / authorization.

# Affected Maven coordinates

* `org.apache.iceberg:iceberg-nessie`

# Attacker prerequisites

* a Nessie catalog initialized without `warehouse`
* read access to process logs at WARN (driver logs, log aggregator)

# Impact

* Catalog and storage credentials that were only in the catalog config appear in logs
* Does not by itself grant table or Nessie access; it copies secrets to a second ACL (logging)

# Proof status

Source review only. The issue is visible directly from source.

# Key source references

* `org.apache.iceberg.nessie.NessieCatalog` (`warehouseLocation`, `LOG.warn` with `catalogOptions`)

# Related

* Spark `Spark3Util.catalogAndIdentifier` — the catch that motivated the WARN (does not need the options map in the log line)

Contributor guide

Open the contributing guide

Research direction

Start in org.apache.iceberg.nessie.NessieCatalog, focusing on warehouseLocation and the LOG.warn call reached when warehouse is unset. Confirm the WARN explains the missing warehouse without emitting catalogOptions or its token, secret, password, credential, or authorization values, then run the iceberg-nessie tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.