[BUG] Potential Unhandled exception in PolarisEntityResolver.java
- Dominant language
- Java
- Stars
- 2.1k
- Forks
- 522
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 137
Description
### Is this a possible security vulnerability?
- [X] This is NOT a possible security vulnerability
### Describe the bug
In the following code:
https://github.com/apache/polaris/blob/b0eb0250c9ea564dfd85b101707e12341d9a723e/polaris-core/src/main/java/org/apache/polaris/core/persistence/PolarisEntityResolver.java#L291
```java
for (PolarisEntityCore resolveEntity : toResolve) {
// get associate active record
PolarisEntityActiveRecord activeEntityRecord = activeRecordIt.next();
// if this entity has been dropped (null) or replaced (<> ids), then fail validation
if (activeEntityRecord == null || activeEntityRecord.getId() != resolveEntity.getId()) {
return false;
}
}
```
If there are no elements in `activeRecordIt`, calling `.next()` will throw an exception before reaching the `activeEntityRecord == null` check.
Should we add a `.hasNext()` check before calling `.next()`?
If this is indeed an issue, it seems like a trivial fix, and I’d be happy to address it.
https://github.com/apache/polaris/blob/b0eb0250c9ea564dfd85b101707e12341d9a723e/polaris-core/src/main/java/org/apache/polaris/core/persistence/PolarisEntityResolver.java#L291
` for (PolarisEntityCore resolveEntity : toResolve) {
// get associate active record
PolarisEntityActiveRecord activeEntityRecord = activeRecordIt.next();
// if this entity has been dropped (null) or replaced (<> ids), then fail validation
if (activeEntityRecord == null || activeEntityRecord.getId() != resolveEntity.getId()) {
return false;
}
}`
If there are no elements in activeRecordIt, then the .next() will throw an exception before reaching below.
` activeEntityRecord == null
`
Should we check for `.hasNext()` before calling `.next()`.
If it is indeed an issue, it seems to be an trivial fix and I am happy to do it. Please assign it to me.
### To Reproduce
_No response_
### Actual Behavior
_No response_
### Expected Behavior
_No response_
### Additional context
_No response_
### System information
_No response_
Contributor guide
Research direction
Start by reading PolarisEntityResolver.java around line 291 and inspect how activeRecordIt is populated and consumed. Verify the empty-iterator case and whether the existing validation behavior is preserved; done means the missing-record path no longer throws an unhandled exception.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, databases
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100