pitrou commented on code in PR #48870: URL: https://github.com/apache/arrow/pull/48870#discussion_r2769185664
########## docs/source/format/Security.rst: ########## @@ -0,0 +1,280 @@ +.. Licensed to the Apache Software Foundation (ASF) under one +.. or more contributor license agreements. See the NOTICE file +.. distributed with this work for additional information +.. regarding copyright ownership. The ASF licenses this file +.. to you under the Apache License, Version 2.0 (the +.. "License"); you may not use this file except in compliance +.. with the License. You may obtain a copy of the License at + +.. http://www.apache.org/licenses/LICENSE-2.0 + +.. Unless required by applicable law or agreed to in writing, +.. software distributed under the License is distributed on an +.. "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +.. KIND, either express or implied. See the License for the +.. specific language governing permissions and limitations +.. under the License. + +.. _format_security: + +*********************** +Security Considerations +*********************** + +This document describes potential security concerns with the various Arrow +specifications in contexts where data is ingested that cannot be fully trusted. + +In other words, this document pertains to data passed in a standardized serialized +form (such as a IPC stream), as opposed to an implementation-specific native +representation (such as ``arrow::Array`` in C++). + +.. note:: + Implementation-specific concerns, such as bad API usage, are out of scope + for this document. Please refer to the implementation's own documentation. + + +Who should read this +==================== + +You should read this document if you belong to either of these two categories: + +1. *users* of Arrow: that is, developers of third-party libraries or applications + that use some of the Arrow formats or protocols by calling into Arrow libraries + as defined below; + +2. *implementors* of Arrow libraries: that is, libraries that provide APIs + abstraction away from the details of the Arrow formats and protocols; such + libraries include the official Arrow implementations documented on + https://arrow.apache.org, but not only. Review Comment: I've tried to improve the wording a bit. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
