Hazal Yilmaz created NIFI-15653:
-----------------------------------
Summary: DeleteSFTP fails security check when path flowfile
attribute is "." due to Path.normalize() returning empty string
Key: NIFI-15653
URL: https://issues.apache.org/jira/browse/NIFI-15653
Project: Apache NiFi
Issue Type: Bug
Affects Versions: 2.3.0
Environment: MiNiFi 2.3.0, OpenJDK 21 (headless), Rocky Linux 9
Reporter: Hazal Yilmaz
Attachments: Screenshot 2026-02-27 130053-1.png, Screenshot 2026-02-27
130116-1.png
{{DeleteSFTP}} routes to the {{failure}} relationship when the {{path}}
flowfile attribute is {{"."}} (a single dot), which is the value set by
{{ListSFTP}} when configured with {*}Remote Path = {{.}}{*}. {{ListSFTP}} and
{{FetchSFTP}} handle this value successfully; only {{DeleteSFTP}} fails, making
the behavior inconsistent across the SFTP processor family.
*Steps to Reproduce*
# Configure {{ListSFTP}} with Remote Path = {{.}}
# Connect {{ListSFTP → FetchSFTP → DeleteSFTP}} (completion strategy: Delete
File)
# Set {{DeleteSFTP}} Directory Path = {{${path}}}
# Run the flow — {{DeleteSFTP}} routes to failure
Error seen in logs
*{{ERROR - DeleteSFTP: Attempting to delete file at path 'testfile.txt' which
is not a direct child of the directory ""}}*
*Root Cause*
{{java.nio.file.Paths.normalize()}} collapses {{"."}} to {{""}} (empty string),
while {{getParent()}} on a single-component path returns {{{}null{}}}. The
security check compares these two values and fails because {{{}"" != null{}}},
causing the processor to incorrectly route to failure.
"Note: the path shown in the error message ({{{}test-delete-777{}}}) is the
normalized result of {{{}./test-delete-777{}}}, not just the filename — this is
what makes the parent comparison fail."
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
