RussellSpitzer commented on issue #17802: URL: https://github.com/apache/iceberg/issues/17802#issuecomment-5444966056
After looking a bit more deeply into this, I don't think we have an internal consumer of this API that doesn't already control the bytes that would be passed to Class.forName. - KeyMetadataDecoder picks the Avro schema from a version byte from our defined encryption schemas - ManifestFiles.decode is only used from Flink's DeltaManifestsSerializer. That's information Flink already wrote - Kafka Connect's AvroUtil.decode is only used for control-topic events the sink itself produces. - Avro.ReadBuilder path uses InternalData with caller selected classes Given that I think we should just close this unless there is some other caller. I really don't think we have any exposure here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
