smengcl commented on PR #11631: URL: https://github.com/apache/ozone/pull/11631#issuecomment-6329690825
> Could we extend this fix to `S3MultipartUploadCommitPartRequest` as well? The commit request reads `keyArgs.getMultipartNumber()` without checking that it is positive. For the split parts-table schema, `OmMultipartPartInfo.from(...)` then throws `IllegalArgumentException` for 0 or negative part numbers, while the handler only catches `IOException | InvalidPathException`. This appears to leave the same unchecked-exception path in commit-part processing, including its FSO subclass. > > The create-time check does not protect this separate request: a caller can create a valid multipart part and then submit its commit with a different, invalid part number. The legacy schema also appears to accept the invalid part number rather than returning `INVALID_PART`. > > Please add explicit `OMException(INVALID_PART)` validation before processing the commit, with regression coverage for part numbers 0 and -1 across the legacy and split parts-table schemas and both bucket-layout paths. This observation is based on source tracing; I have not reproduced it with a test yet. Thanks. Done -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
