Do not read empty namespaces from catalog

[ianton-ru]

Changelog category (leave one):

• Bug Fix (user-visible misbehavior in an official stable release)

Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):

Fix infinite recursion with empty namespace in Iceberg catalog

Documentation entry for user-facing changes

Solved #1382

CI/CD Options

Exclude tests:

• Fast test
• Integration Tests
• Stateless tests
• Stateful tests
• Performance tests
• All with ASAN
• All with TSAN
• All with MSAN
• All with UBSAN
• All with Coverage
• All with Aarch64
• All Regression
• Disable CI Cache

Regression jobs to run:

• Fast suites (mostly <1h)
• Aggregate Functions (2h)
• Alter (1.5h)
• Benchmark (30m)
• ClickHouse Keeper (1h)
• Iceberg (2h)
• LDAP (1h)
• Parquet (1.5h)
• RBAC (1.5h)
• SSL Server (1h)
• S3 (2h)
• S3 Export (2h)
• Swarms (30m)
• Tiered Storage (2h)

[ianton-ru]

@codex review

[github-actions]

Workflow [PR], commit [80340e7]

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alsugiliazova]

Verification report: Altinity/ClickHouse PR #1762

Conclusion

CI red on head, but every failure is either a pre-existing flake or a regression-suite scenario already broken at baseline on antalya-26.3. No PR-caused regression found.

Caveat — partial frontport (same as the rest of the 26.3 cohort). Companion antalya-26.1 frontports are still missing on antalya-26.3; chronic regression failures here are branch-level missing-dependency symptoms.

---

The change

// src/Databases/DataLake/RestCatalog.cpp:646
chassert(current_namespace.starts_with(base_namespace));

+/// Protection from subnamepsaces with empty names
+if (current_namespace == base_namespace)
+{
+    LOG_WARNING(log, "Namespace {} has a subnamespace with empty name. This is an error in catalog implementation.", base_namespace);
+    continue;
+}
+
if (stop_condition && stop_condition(current_namespace))
    break;

A defensive guard in RestCatalog::getNamespacesRecursive: when an external REST catalog returns a subnamespace whose name is empty (so current_namespace == base_namespace after concatenation), the loop now logs a WARNING and skips it instead of recursing infinitely / faulting downstream.

CI on head 80340e7e — failures

PR test workflow (3 failed checks, 47 success)

Check	Test FAIL	Class
Integration tests (amd_asan, db disk, old analyzer, 4/6)	test_replicated_database::test_sync_replica	Pre-existing flake — 84 / 37 PRs / 90d
Stateless tests (arm_asan, targeted)	01171_mv_select_insert_isolation_long	Pre-existing flake — 46 / 20 PRs / 90d
Stress test (amd_debug)	Unknown error (job-level)	Pre-existing instability on antalya-26.3

Regression workflow (8 failed checks)

Check	Top failing tests on PR-1762 builds	Baseline (antalya-26.3)	Class
Swarms (Release + Aarch64)	chronic swarm join / cluster discovery / node failure scenarios	30–44% on every PR	Pre-existing broken
S3Export (partition) (Release + Aarch64)	sanity / *	~50%	Pre-existing broken
S3Export (part) (Release + Aarch64)	/s3 suite-level	flaky	Pre-existing flaky
Parquet (Release + Aarch64)	postgresql/mysql round-trip	~36%	Pre-existing flaky

(Iceberg suites are green for this run — the typical missing-dep signal is absent here.)

---

Related to PR diff?

The change touches only RestCatalog::getNamespacesRecursive. None of the failing suites test malformed-namespace handling.

Failing test	Diff overlap	Related?
test_replicated_database::test_sync_replica, 01171_mv_select_insert_isolation_long, Stress Unknown error	none	No
swarms / *, parquet / *, s3_export_partition / *, s3_export_part / *	none — these don't exercise RestCatalog namespace listing at all	No

No failing test intersects this PR's code path.

---

Recommendations

1. Add a test for the fix before merge. A small integration test in tests/integration/test_database_iceberg/ (or wherever RestCatalog is best exercised) that points the binary at a fake REST endpoint returning an empty-named subnamespace, and asserts (a) no infinite recursion / crash, (b) LOG_WARNING is emitted, (c) the empty subnamespace is skipped, would close the coverage gap. Otherwise this fix lands without anyone — CI or otherwise — ever exercising the new branch.
2. CI is otherwise safe to merge on. All red checks are pre-existing baseline noise on antalya-26.3; none are PR-caused.
3. Re-verify after the companion 26.1 → 26.3 frontports land — same list as the prior 26.3 verification reports.

---

Local checkout

cd /Users/alsugilyazova/workspace/altinity-clickhouse/ClickHouse
gh pr checkout 1762 --repo Altinity/ClickHouse
# HEAD: 80340e7e5c2b65554101ec70ed1b9a493dc6f9b0

[alsugiliazova]

Audit: PR #1762 — Do not read empty namespaces from catalog

AI audit note: This review comment was generated by AI (Cursor agent, audit-review skill).

Audit update for PR #1762 (empty-namespace guard in RestCatalog::getNamespacesRecursive)

Confirmed defects

No confirmed defects in reviewed scope.