[
https://issues.apache.org/jira/browse/NIFI-10375?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17584290#comment-17584290
]
ASF subversion and git services commented on NIFI-10375:
--------------------------------------------------------
Commit 6b424c3fd3636a17681502a87ea8bdc9c60dcbf8 in nifi's branch
refs/heads/main from Mark Payne
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=6b424c3fd3 ]
NIFI-10375: If a class is not allowed in the AllowListClassLoader by classname,
check the class's module and allow through anything in the java. or jdk.
modules.
NIFI-10375: Addressed review feedback: removed loading of classes from JMODs in
the StatelessBootstrap because it only was relevant if using JDK. Instead, just
inspect the module as we do when using the JRE. Also addressed issue of allow
NoClassDefFoundError fly when we should use ClassNotFoundException
This closes #6317.
Signed-off-by: Peter Turcsanyi <[email protected]>
> Stateless NiFi requires JDK to run on Java 9+. It shouldn't.
> ------------------------------------------------------------
>
> Key: NIFI-10375
> URL: https://issues.apache.org/jira/browse/NIFI-10375
> Project: Apache NiFi
> Issue Type: Bug
> Components: NiFi Stateless
> Affects Versions: 1.17.0, 1.16.1, 1.16.2, 1.16.3
> Reporter: Mark Payne
> Assignee: Mark Payne
> Priority: Major
> Fix For: 1.18.0
>
> Time Spent: 1h 40m
> Remaining Estimate: 0h
>
> If run with Java 9+, the AllowListClassLoader that is used by NiFi Stateless
> requires that the JDK be in use, not just a JRE. This is because it looks for
> presence of .jar and .jmod files in the $JAVA_HOME directory but the jmod
> files are only present in the JDK.
> When attempting to load a class, if it's not in the Allowed List, it should
> check the class's module and allow through anything in the {{java.}} and
> {{jdk.}} modules. This allows a more compatible way of detecting that a given
> class is part of Java and therefore needs to be made available, versus a part
> of the third party application that is calling Stateless.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
