Repository navigation
ImportTable creates a table under a name CreateTable refuses #771
Description
Problem
ImportTable creates its table from TableCreationParameters without the request checks CreateTable makes. handle_import_table (crates/engine/src/import_export.rs) calls ctx.storage.create_table directly, and CreateTable runs validate_create_table first (crates/engine/src/create_table.rs line 53). So ImportTable creates tables under names that CreateTable refuses, including names that hold control characters.
Measured
2 November 2026. Each ImportTable request carries TableCreationParameters with pk (S) as the HASH key and PAY_PER_REQUEST, and only the table name changes.
Amazon DynamoDB, us-east-1, S3BucketSource naming a bucket that does not exist, each request twice with identical answers. No table was created:
TableName |
Service answer |
|---|---|
ab |
ValidationException: TableName must be at least 3 characters long and at most 255 characters long |
bad name |
ValidationException: 1 validation error detected: Value 'bad name' at 'tableCreationParameters.tableName' failed to satisfy constraint: Member must satisfy regular expression pattern: [a-zA-Z0-9_.-]+ |
bad, LF, name |
the same form as bad name, with the line feed in the value |
ExtendDB (a sqlite-memory dev-mode build of main with the first revision of #705's logging change, which touches no validation; FileSource naming a one-item DYNAMODB_JSON file under the account's import directory): all three imports answered ImportStatus COMPLETED, and ListTables then listed ab, bad name and the name with the line feed. CreateTable with each of the three names answered ValidationException: 1 validation error detected: Value '<name>' at 'tableName' failed to satisfy constraint.
Expected
ImportTable refuses a TableCreationParameters that CreateTable would refuse, before it reads the source file or creates anything, with the service's messages above for the table name. The other TableCreationParameters fields (key schema, attribute definitions, billing mode, indexes) go through the same checks; those answers were not measured on the service for ImportTable.
Related: the access log line that ImportTable writes before creating the table carried the name raw, so a name with a line feed split it; #705's fix records it as an escaped field. The warning import: skipping item with invalid keys logs the key validation error, which names a KeySchema attribute from the request, as a Display field (read from the code, not measured).
Activity
LeeroyHannigan commentedon Nov 3, 2026
ImportTable skips the rest of CreateTable's validation too, not only the table name. On main a
TableCreationParametersglobal secondary index withProvisionedThroughputof{ReadCapacityUnits: -3, WriteCapacityUnits: 5}on a PROVISIONED import is stored and reported as -3, where CreateTable refuses the same index. #474 clears an imported index'sWarmThroughput, which had the same gap ({ReadUnitsPerSecond: -7, WriteUnitsPerSecond: 0}was stored and reported), socreate_table_input_from_paramsin crates/engine/src/import_export.rs now carries nothing ImportTable cannot check. Runningvalidate_create_tableon that create input before the table is created would cover the name, the index throughput and whatever CreateTable checks next.