Chris LuandGitHub 36c97344ef s3: confine a Lance catalog table location to the caller's own bucket (#10901) ...

The Lance namespace gateway took the request-body location field, trimmed a
trailing slash, and passed it straight to the marker sink. That location feeds
TableDataDirFromMetadataLocation, which joins it under /buckets and collapses
any ../ segments, and writeMarker's CreateEntry then auto-creates every missing
parent. A caller could point the location at another tenant's bucket, or escape
/buckets entirely, and plant a fixed-name marker (recursively creating the
parents) or hide a victim's live table with .lance-deregistered.

Confine the declared location the way the Iceberg gateway already does: require
an s3:// URI whose bucket is the caller's own and whose path carries no
traversal segment, on both the declare and register handlers.

2026-08-23 11:49:52 -07:00

..

errors.go

…

handlers_namespace.go

…

handlers_table.go

s3: confine a Lance catalog table location to the caller's own bucket (#10901)

2026-08-23 11:49:52 -07:00

handlers_test.go

s3: confine a Lance catalog table location to the caller's own bucket (#10901)

2026-08-23 11:49:52 -07:00

identifier_test.go

…

identifier.go

…

markers.go

…

server.go

…

storage.go

s3: confine a Lance catalog table location to the caller's own bucket (#10901)

2026-08-23 11:49:52 -07:00

types.go

…