You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@arrow.apache.org by "pitrou (via GitHub)" <gi...@apache.org> on 2026/02/05 14:55:02 UTC
[I] [C++] Allow disabling extension type deserialization when reading IPC [arrow]
pitrou opened a new issue, #49155:
URL: https://github.com/apache/arrow/issues/49155
### Describe the enhancement requested
Certain users of the IPC format may want to entirely prohibit deserialization of extension types, or adopt a selective whitelist approach when loading extension types.
This may come up useful when there is a concern that some third-party extension types may have latent robusteness issues in their deserialization code.
### Component(s)
C++
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@arrow.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [C++] Allow disabling extension type deserialization when reading IPC [arrow]
Posted by "AliRana30 (via GitHub)" <gi...@apache.org>.
AliRana30 commented on issue #49155:
URL: https://github.com/apache/arrow/issues/49155#issuecomment-3854636174
@pitrou I will create a PR for this soon!!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [C++] Allow disabling extension type deserialization when reading IPC [arrow]
Posted by "paleolimbot (via GitHub)" <gi...@apache.org>.
paleolimbot commented on issue #49155:
URL: https://github.com/apache/arrow/issues/49155#issuecomment-3855723656
This seems like a reasonable option. It may also be overkill, but providing a specific `ExtensionRegistry` instance would allow, for example, taking advantage of canonical extension types provided by Arrow C++ without having to worry that these extension types were unregistered and re-registered with potentially unsecure (non Arrow C++) implementations. I am not sure an allowed list would be more secure for any relevant case (because of the ability to reregister an extension).
The C Data interface and Parquet reader (by way of the IPC reader) are the two other places where field metadata is automatically transformed that may be worth including in this change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [C++] Allow disabling extension type deserialization when reading IPC [arrow]
Posted by "AliRana30 (via GitHub)" <gi...@apache.org>.
AliRana30 commented on issue #49155:
URL: https://github.com/apache/arrow/issues/49155#issuecomment-3854883611
Apology for wrong PR and commits.
I will wait for maintainers opinion before creating the new PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [C++] Allow disabling extension type deserialization when reading IPC [arrow]
Posted by "pitrou (via GitHub)" <gi...@apache.org>.
pitrou commented on issue #49155:
URL: https://github.com/apache/arrow/issues/49155#issuecomment-3854800525
@AliRana30 I think that the API should be discussed first. I see two main possibilities:
1. a boolean flag (such as `bool recreate_extensions = true`)
2. an allowlist of allowed extension names (for example a `std::optional<std::vector<std::string>> allowed_extensions`)
We could be more sophisticated and allow passing a function predicate, but that sounds overkill.
Thoughts @WillAyd @alamb @paleolimbot
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [C++] Allow disabling extension type deserialization when reading IPC [arrow]
Posted by "lidavidm (via GitHub)" <gi...@apache.org>.
lidavidm commented on issue #49155:
URL: https://github.com/apache/arrow/issues/49155#issuecomment-3856870297
Yeah, allowing a registry would be preferable to avoid relying on global state.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@arrow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org