partition_count: StrictInt = 32

# Warn about append-only behavior (once per instance)

if not hasattr(self, '_append_warning_shown'):

import logging

logger = logging.getLogger(__name__)

logger.warning(

"Iceberg online store uses append-only writes. "

"Run periodic compaction to prevent unbounded storage growth. "

"See https://docs.feast.dev/reference/online-stores/iceberg#compaction"

)

self._append_warning_shown = True

except Exception as e:

# Only ignore if namespace already exists; let other errors propagate

if "already exists" not in str(e).lower():

raise

# Tuple: (event_ts, created_ts, features)

str, Tuple[Optional[datetime], Optional[datetime], Optional[Dict[str, ValueProto]]]

] = {key: (None, None, None) for key in entity_key_bins.keys()}

created_ts = arrow_table["created_ts"][i].as_py()

current_event_ts, current_created_ts, _ = results[entity_key_hex]

# Use created_ts as tiebreaker when event_ts is equal (deterministic)

is_newer = (

current_event_ts is None or

event_ts > current_event_ts or

(event_ts == current_event_ts and created_ts is not None and

(current_created_ts is None or created_ts > current_created_ts))

)

if is_newer:

created_ts,

# Return in original entity_keys order (extract only event_ts and features, not created_ts)

return [(event_ts, features) for event_ts, created_ts, features in

[results[ek_hex] for ek_hex in entity_key_bins.keys()]]

status: resolved

priority: p1

issue_id: "001"

tags: [code-review, security, sql-injection, offline-store]

dependencies: []

resolution: fixed

fixed_in_commit: HEAD

The Iceberg offline store accepts entity DataFrames as SQL strings and directly interpolates them into DuckDB queries without sanitization. This creates a critical SQL injection vulnerability that could allow arbitrary SQL execution.

**Why it matters:** An attacker who can control the entity_df parameter could execute arbitrary SQL commands, potentially accessing sensitive data, modifying data, or accessing the file system through DuckDB's file functions.

**Location:** `sdk/python/feast/infra/offline_stores/contrib/iceberg_offline_store/iceberg.py:158`

**Vulnerable Code:**

else:

# Handle SQL string if provided

con.execute(f"CREATE VIEW entity_df AS {entity_df}")

**Severity:** CRITICAL - Full SQL injection possible if user input reaches this parameter

**Exploitability:** High if entity_df is user-controlled (e.g., from API endpoints, feature store configurations)

**Evidence from security-sentinel agent:**

- Direct f-string interpolation without validation

- No prepared statement mechanism used

- No check that SQL is SELECT-only

- DuckDB file functions accessible via SQL injection

**Pros:**

- Eliminates vulnerability completely

- Forces type safety

- Aligns with other offline stores

**Cons:**

- Breaking change for users passing SQL strings

- May require migration effort

**Effort:** Small

**Risk:** Low

**Implementation:**

if not isinstance(entity_df, pd.DataFrame):

raise ValueError(

"IcebergOfflineStore only accepts pandas DataFrames for entity_df. "

"SQL strings are not supported for security reasons."

)

**Pros:**

- Maintains backward compatibility

- Validates SQL is SELECT-only

**Cons:**

- Complex implementation

- May miss edge cases

- Performance overhead

**Effort:** Medium

**Risk:** Medium

**Implementation:**

import sqlparse

def validate_safe_sql(sql: str) -> bool:

"""Validate SQL is a safe SELECT statement."""

parsed = sqlparse.parse(sql)

if len(parsed) != 1:

return False

stmt = parsed[0]

if stmt.get_type() != 'SELECT':

return False

# Additional checks for CTEs, subqueries, etc.

return True

if isinstance(entity_df, str):

if not validate_safe_sql(entity_df):

raise ValueError("Only SELECT statements are allowed for entity_df")

con.execute(f"CREATE VIEW entity_df AS {entity_df}")

**Pros:**

- Industry best practice

- Prevents all injection types

**Cons:**

- DuckDB's Python API has limited prepared statement support for DDL

- May not be feasible for CREATE VIEW statements

**Effort:** Medium-Large

**Risk:** High (API limitations)

**Solution 1** is recommended: Require DataFrame-only input for security-sensitive deployments.

Add deprecation warning for SQL string support in current version, remove in next major version.

**Affected Files:**

- `sdk/python/feast/infra/offline_stores/contrib/iceberg_offline_store/iceberg.py:158`

**Affected Methods:**

- `IcebergOfflineStore.get_historical_features()`

**Related Code:**

- All SQL query construction in the offline store should be audited

- [x] SQL string input either removed or properly validated

- [ ] Security test added demonstrating injection is prevented

- [ ] Documentation updated to reflect security constraints

- [x] All tests pass with DataFrame-only input

**2026-01-16:** Issue identified during comprehensive security review by security-sentinel agent

**2026-01-16:** FIXED - Removed SQL string support entirely (lines 160-165). Now raises ValueError if entity_df is not a pandas DataFrame.

- Security review: `/home/tommyk/.claude/plans/mellow-petting-kettle.md`

- OWASP SQL Injection: https://owasp.org/www-community/attacks/SQL_Injection

- Similar fix in Snowflake store: (reference if exists)