apache / apache/polaris

[BUG] Potential Unhandled exception in PolarisEntityResolver.java

Open
#327 4 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
2.1k
Forks
522
Avg merge
1d 22h
Merged PRs (30d)
137

Description

### Is this a possible security vulnerability?

- [X] This is NOT a possible security vulnerability

### Describe the bug

In the following code:

https://github.com/apache/polaris/blob/b0eb0250c9ea564dfd85b101707e12341d9a723e/polaris-core/src/main/java/org/apache/polaris/core/persistence/PolarisEntityResolver.java#L291

```java
for (PolarisEntityCore resolveEntity : toResolve) {
// get associate active record
PolarisEntityActiveRecord activeEntityRecord = activeRecordIt.next();

// if this entity has been dropped (null) or replaced (<> ids), then fail validation
if (activeEntityRecord == null || activeEntityRecord.getId() != resolveEntity.getId()) {
return false;
}
}
```

If there are no elements in `activeRecordIt`, calling `.next()` will throw an exception before reaching the `activeEntityRecord == null` check.

Should we add a `.hasNext()` check before calling `.next()`?

If this is indeed an issue, it seems like a trivial fix, and I’d be happy to address it.

https://github.com/apache/polaris/blob/b0eb0250c9ea564dfd85b101707e12341d9a723e/polaris-core/src/main/java/org/apache/polaris/core/persistence/PolarisEntityResolver.java#L291

` for (PolarisEntityCore resolveEntity : toResolve) {
// get associate active record
PolarisEntityActiveRecord activeEntityRecord = activeRecordIt.next();

// if this entity has been dropped (null) or replaced (<> ids), then fail validation
if (activeEntityRecord == null || activeEntityRecord.getId() != resolveEntity.getId()) {
return false;
}
}`

If there are no elements in activeRecordIt, then the .next() will throw an exception before reaching below.
` activeEntityRecord == null
`
Should we check for `.hasNext()` before calling `.next()`.

If it is indeed an issue, it seems to be an trivial fix and I am happy to do it. Please assign it to me.

### To Reproduce

_No response_

### Actual Behavior

_No response_

### Expected Behavior

_No response_

### Additional context

_No response_

### System information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by reading PolarisEntityResolver.java around line 291 and inspect how activeRecordIt is populated and consumed. Verify the empty-iterator case and whether the existing validation behavior is preserved; done means the missing-record path no longer throws an unhandled exception.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, databases
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.