LuciferYang opened a new issue, #12657:
URL: https://github.com/apache/gravitino/issues/12657
### Version
main branch
### Describe what's wrong
`PartitionStatisticsUpdateDTO.validate()` checks only that `partitionName`
is not blank and that the `statistics` map is not empty. Its sibling
`StatisticsUpdateRequest.validate()` also walks the map and rejects a blank
statistic name and a null statistic value, so the two statistics update
endpoints disagree on the same request body.
The deserializer cannot catch it either. Jackson's `MapDeserializer` does
not invoke the `contentUsing` deserializer for a `VALUE_NULL` content token: it
takes `getNullValue()` and puts null into the map. So the `node != null &&
!node.isNull()` guard at the top of `JsonUtils.getStatisticValue` never sees a
top-level null, and `validate()` is the only place that can reject one. On the
partition route nothing does.
A nested null such as `{"custom-k": [1, null]}` is already rejected on both
routes, because the parsed tree does contain a `NullNode` there. That is what
makes the top-level gap easy to miss.
### Error message and/or stacktrace
No error. The request returns HTTP 200 and the null value reaches the
dispatcher.
### How to reproduce
```
PUT /metalakes/{metalake}/objects/table/{fullName}/statistics/partitions
{"updates": [{"partitionName": "p1", "statistics": {"custom-k": null}}]}
```
Returns 200. `PartitionStatisticsUpdateRequest.validate()` passes, and
`StatisticOperations.updatePartitionStatistics` only walks
`statistics().keySet()` to check the `custom-` prefix, so the value is never
examined.
The same shape on the object-level endpoint returns 400:
```
PUT /metalakes/{metalake}/objects/table/{fullName}/statistics
{"updates": {"custom-k": null}}
```
The 200 is measured, not inferred: a Jersey test driving the endpoint with
that body asserts `expected: <400> but was: <200>` against current main.
### Additional context
`PartitionStatisticsUpdateDTO.of()` is also the path `clients/client-java`
uses to build the request (`MetadataObjectPartitionStatisticsOperations`), so a
Java caller gets no validation before the request goes out.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
