shoemoney opened a new pull request, #11592: URL: https://github.com/apache/nifi/pull/11592
JNDI Provider URL allowlist bypass via substring check. Bug: JndiJmsConnectionFactoryProperties.isSchemeAllowed uses allowedScheme.contains(scheme). Any substring of an allowed scheme passes, for example s:// passes because ssl.contains(s) is true, and fi:// passes via file.contains(fi). Fix: Replace contains with equalsIgnoreCase for exact case-insensitive match. One line change at line 195. Evidence: * Manual verification shows s:// and fi:// correctly rejected after fix, while valid schemes ssl, tcp, file, etc still pass. * Existing tests pass: JndiJmsConnectionFactoryProviderTest, 7 tests, 0 failures before and after. * Blast radius: 1 file, 1 line changed, no formatter changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
