[
https://issues.apache.org/jira/browse/NIFI-16135?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18098242#comment-18098242
]
ASF subversion and git services commented on NIFI-16135:
--------------------------------------------------------
Commit 14f095aebdc1656098c38c5ff926ba06d93f10f6 in nifi's branch
refs/heads/main from Matt Gilman
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=14f095aebdc ]
NIFI-16135 Sanitize URL-derived segments used to build nifi-api requests
(#11462)
Add safeApiPath and isSameOriginTarget shared utilities and apply them to
route/query-derived values in AccessPolicyService, DocumentationService, and
the content viewer, so untrusted deep-link input cannot redirect authenticated
requests or bypass the same-origin ref check.
> Harden UI handling of URL-derived values used to build nifi-api requests
> ------------------------------------------------------------------------
>
> Key: NIFI-16135
> URL: https://issues.apache.org/jira/browse/NIFI-16135
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core UI
> Reporter: Matt Gilman
> Assignee: Matt Gilman
> Priority: Major
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Some UI views build authenticated nifi-api requests using values taken from
> the
> browser URL (route parameters and query parameters). These values can be
> influenced by a crafted link opened by an authenticated user, but they are
> currently trusted as-is when constructing the request path.
> This affects:
> * The documentation views, which use URL-supplied component coordinates to
> request definition and step documentation.
> * The access policy views, which use URL-supplied action/resource values to
> request policy details.
> * The content viewer, which decides whether to load a query-supplied content
> reference using a simple string prefix check against the instance URI.
> Because these values are not validated, a crafted link could steer an
> authenticated request to an unintended location, and the content viewer's
> prefix check can be satisfied by a look-alike origin.
> Proposed improvement: treat URL-derived values as untrusted at the point they
> are turned into a request. Validate and encode them so they can only be used
> as
> their intended path segments, reject anything that isn't (failing closed so no
> request is made), and replace the content viewer's prefix check with a proper
> same-origin comparison. Legitimate values are identifiers and known resource
> names, so expected behavior is unchanged.
> Includes unit test coverage for the new validation and same-origin logic.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
