Antalya 26.3 Backport of #100283 - Validate Iceberg metadata file path for null bytes

[mkmkme]

Changelog category (leave one):

• Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Fix exception when Iceberg metadata file path setting contains a null byte (ClickHouse#100283 by @alexey-milovidov)

Documentation entry for user-facing changes

...

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All with Aarch64
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[github-actions]

Workflow [PR], commit [801ff1c]

[alsugiliazova]

Verification: PR #1775

PR-relevant test — GREEN

test_storage_iceberg_with_spark/test_metadata_file_path_security.py::test_metadata_file_path_security — 3/3 OK across all integration jobs that picked it up:

Job	Status
Integration tests (amd_asan, db disk, old analyzer, 4/6)	OK
Integration tests (amd_binary, 5/5)	OK
Integration tests (arm_binary, distributed plan, 2/4)	OK

The tightened null-byte assertions all pass — the new BAD_ARGUMENTS guard is exercised correctly.

CI overview (head commit)

• PR test workflow: 45 success / 49 skipped / 2 failure
• Regression workflow: 28 success / 68 skipped / 4 failure (chronic baseline)
• One pending action_required job (queue/auth)

PR test-workflow failures

Check	Verdict
Integration tests (arm_binary, distributed plan, 4/4) — 9 × test_database_iceberg_nessie_catalog/test.py::*	Pre-existing infra flake. All 9 Nessie-catalog cases fail together in 3 of 3 affected PRs each in last 30 days — Nessie container/setup failure, unrelated to the null-byte validation change.
Stress test (arm_asan, s3) — Possible deadlock on shutdown (see gdb.log)	Stress-test infra noise; shutdown deadlock symptom is common on antalya-26.3 stress jobs. Not test-level FAIL on a real product test.

Regression-workflow failures (chronic baseline on antalya-26.3)

Suite	Fails
Swarms (Aarch64 + Release)	227
Parquet (Aarch64 + Release)	34
S3Export partition (Aarch64 + Release)	20
S3Export part (Aarch64 + Release)	16

Same fingerprint as sibling antalya-26.3 PRs (1773, 1772, 1771, 1770, 1769, …). No new failure modes.

Caveat — partial frontport

This PR lands on antalya-26.3 while companion features from antalya-26.1 are still being frontported in parallel. Final re-verify recommended once the rest of the bundle lands.

Verdict

Safe to merge.

• PR diff is a 2-line defensive guard; the existing security test (with updated assertions) passes 100% (3/3) across all integration jobs.
• All other failing checks are pre-existing infra flakes (Nessie integration, stress shutdown deadlock) and the chronic antalya-26.3 regression baseline.

[alsugiliazova]

Audit: PR #1775 — Antalya 26.3 Backport of #100283 — Validate Iceberg metadata file path for null bytes

AI audit note: This review comment was generated by AI (Cursor agent, audit-review skill).

Confirmed defects

No confirmed defects in reviewed scope.