Hash Variant object keys in ExpressionUtil.sanitize (not only values)

[RussellSpitzer]

After review, this is not considered a serious vulnerability that needs to be kept private. Sanitized expressions are an operator metrics/log surface, but Variant object keys are query literals and should be hashed like other strings. Filed publicly as a sanitizer bug.

Summary

ExpressionUtil.sanitize is meant to redact predicate constants (hashed strings, digit-count for numbers, coarse dates). For Variant objects it formats keys as (hash-%s) with the original field name, then sanitizes the value. TestExpressionUtil currently expects that: keys look like (hash-event_name) while values look like (hash-79b17dd6).

Variant object keys are user data (they can hold the same secrets people put in string literals). Iceberg schema column names in the expression stay visible on purpose; these keys should not.

Consumers of the sanitized string include SnapshotScan ScanReport.filter (REST catalog metrics when v1/report-metrics is on) and any other ExpressionUtil.sanitize caller.

Fix: run object keys through sanitizeSimpleString (same as string values) and update the unit test.

Affected Maven coordinates

• org.apache.iceberg:iceberg-api

Attacker prerequisites

• a query (or bound expression) whose Variant literal uses sensitive strings as object keys
• read access to sanitized scan filters (metrics reporter / logs), not table data

Impact

• Predicate constants that people believed were hashed can appear in ScanReport / logs as Variant keys
• Does not grant table access; it is a sanitizer miss on an operator surface

Proof status

Source review. Visible in sanitizeVariantObject and the existing unit test expectations.

Key source references

• org.apache.iceberg.expressions.ExpressionUtil (sanitizeVariantObject, format (hash-%s) with field)
• org.apache.iceberg.expressions.TestExpressionUtil (Variant sanitize test)
• org.apache.iceberg.SnapshotScan (ExpressionUtil.sanitize into ScanReport)

Related

• apache/iceberg#11479 / PR #13137 added recursive Variant sanitizing. That ticket’s example kept object keys in the clear (hash-id) and hashed/coarsened values. This issue is a follow-up: keys are query data (like map-key literals on mp.key), not schema identifiers, and should go through sanitizeSimpleString. No open issue covers hashing the keys.