Don't use footer key for non-encrypted columns

apache · Jan 21, 2025 · 6dc80de · 6dc80de
1 parent 451460e
commit 6dc80de
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 11 deletions.
diff --git a/parquet/src/arrow/arrow_reader/mod.rs b/parquet/src/arrow/arrow_reader/mod.rs
@@ -716,18 +716,22 @@ impl<T: ChunkReader + 'static> Iterator for ReaderPageIterator<T> {
                 .schema_descr()
                 .column(self.column_idx);
 
-            let file_decryptor = self
-                .metadata
-                .file_decryptor()
-                .clone()
-                .unwrap()
-                .get_column_decryptor(column_name.name().as_bytes());
-            let data_decryptor = Arc::new(file_decryptor.clone());
-            let metadata_decryptor = Arc::new(file_decryptor.clone());
+            if self.metadata.file_decryptor().as_ref().unwrap().is_column_encrypted(column_name.name().as_bytes()) {
+                let file_decryptor = self
+                    .metadata
+                    .file_decryptor()
+                    .clone()
+                    .unwrap()
+                    .get_column_decryptor(column_name.name().as_bytes());
+                let data_decryptor = Arc::new(file_decryptor.clone());
+                let metadata_decryptor = Arc::new(file_decryptor.clone());
 
-            let crypto_context =
-                CryptoContext::new(rg_idx, self.column_idx, data_decryptor, metadata_decryptor);
-            Some(Arc::new(crypto_context))
+                let crypto_context =
+                    CryptoContext::new(rg_idx, self.column_idx, data_decryptor, metadata_decryptor);
+                Some(Arc::new(crypto_context))
+            } else {
+                None
+            }
         } else {
             None
         };

diff --git a/parquet/src/encryption/ciphers.rs b/parquet/src/encryption/ciphers.rs
@@ -377,6 +377,11 @@ impl FileDecryptor {
     pub(crate) fn has_footer_key(&self) -> bool {
         self.decryption_properties.has_footer_key()
     }
+
+    pub(crate) fn is_column_encrypted(&self, column_name: &[u8]) -> bool {
+        // Column is encrypted if either uniform encryption is used or an encryption key is set for the column
+        self.decryption_properties.column_keys.is_none() || self.has_column_key(column_name)
+    }
 }
 
 #[derive(Debug, Clone)]