Skip to content

Conversation

@shashbha14
Copy link
Contributor

@shashbha14 shashbha14 commented Feb 12, 2026

This PR adds a short “Security considerations for untrusted IPC data” section
to the Python IPC docs. It:

  • Explains that you should explicitly validate RecordBatches/Tables when
    reading IPC data from untrusted or semi‑trusted sources.
  • Points to RecordBatch.validate() and Table.validate() as the relevant
    validation helpers.
  • Shows small code snippets using these methods with pa.ipc.open_stream
    and pa.ipc.open_file.

It doesn’t try to answer the broader questions in #49241 (updates to
format/Security.rst or adding an always_validate option), but it should
still make the validation APIs more discoverable for PyArrow users.

@github-actions
Copy link

Thanks for opening a pull request!

If this is not a minor PR. Could you open an issue for this pull request on GitHub? https://github.com/apache/arrow/issues/new/choose

Opening GitHub issues ahead of time contributes to the Openness of the Apache Arrow project.

Then could you also rename the pull request title in the following format?

GH-${GITHUB_ISSUE_ID}: [${COMPONENT}] ${SUMMARY}

or

MINOR: [${COMPONENT}] ${SUMMARY}

See also:

Copy link
Member

@raulcd raulcd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am unsure this really tackles the issue that was raised. The issue has two parts one about the new security guidelines:
https://github.com/apache/arrow/blob/68d13685b4e3914ff2b36eeca606ae428b8e3485/docs/source/format/Security.rst
and two a question on whether a new flag on the IPCReadOptions like always_validate makes sense or not.
This PR is not tackling any of those concerns.

@github-actions github-actions bot added awaiting changes Awaiting changes and removed awaiting review Awaiting review labels Feb 12, 2026
@shashbha14 shashbha14 changed the title Clarify IPC security docs with validation API examples MINOR: [Docs] Mention validate() helpers in Python IPC docs Feb 12, 2026
@shashbha14
Copy link
Contributor Author

Thanks for the review and clarification.You’re right, this PR doesn’t address the Security.rst text or the
always_validate flag question. I’ve updated the title/description so this
is just a small Python IPC docs improvement instead of trying to close
#49241. I’m happy to leave the main issue open for the broader discussion and any
changes you’d like to make on the Security page itself.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants