Sönke Liebau created NIFI-16316:
-----------------------------------
Summary: SiteToSiteStatusReportingTask throws NullPointerException
when a connection status has no name
Key: NIFI-16316
URL: https://issues.apache.org/jira/browse/NIFI-16316
Project: Apache NiFi
Issue Type: Bug
Affects Versions: 2.11.0
Environment: Observed in NiFi 2.9.0 on kubernetes, but objectively not
related to the environment
Reporter: Sönke Liebau
Assignee: Sönke Liebau
h3. Description
`
[SiteToSiteStatusReportingTask|https://github.com/apache/nifi/blob/e8fd070f953e976cfb7841dddd81f199a597970a/nifi-extension-bundles/nifi-site-to-site-reporting-bundle/nifi-site-to-site-reporting-task/src/main/java/org/apache/nifi/reporting/SiteToSiteStatusReportingTask.java#L373]
` passes the component name into `Pattern.matcher(...)` unguarded. When the
controller status snapshot contains a component with a null name, every trigger
fails with:
java.lang.NullPointerException: Cannot invoke
"java.lang.CharSequence.length()" because "this.text" is null
A null name can occur for a connection, as `AbstractEventAccess.getGroupStatus`
derives `ConnectionStatus.name` from the connection name, falling back to the
joined relationship names with no final fallback if everything is unset. Hence,
a connection with a blank name and an empty relationship collection produces a
null status name.
This sounds super constructed, I know, but we actually hit this exact scenario
in a dev cluster, where connections were created via api for test purposes and
passed `"selectedRelationships": []`.
This value is mostly guarded against and should arguably not be applyable (I'll
open a follow up issue for that discussion), but
`[StandardVersionedComponentSynchronizer.updateConnection|https://github.com/apache/nifi/blob/25c8f625d6f31c0141557150c4e91c4e4fca4303/nifi-framework-bundle/nifi-framework/nifi-framework-components/src/main/java/org/apache/nifi/flow/synchronization/StandardVersionedComponentSynchronizer.java#L3624-L3626]
` sets this verbatim and allows this value through - instead of replacing it
with `Relationship.ANONYMOUS` as a connection creation does.
h3. Steps to reproduce
1. Create a process group containing an input port connected to a processor;
leave
the connection unnamed.
2. Download the flow definition; change the connection's `selectedRelationships`
from `[""]` to `[]`.
3. Replace the process group contents with the edited definition
(`PUT /process-groups/\{id}/flow-contents`).
4. Start a SiteToSiteStatusReportingTask → NPE on every trigger.
h3. Fix
1. `AbstractEventAccess`: add the missing fallback (connection identifier) so
`ConnectionStatus.name` is never null — this also protects other consumers of
the controller status (e.g. QueryNiFiReportingTask).
2. `SiteToSiteStatusReportingTask.componentMatchesFilters`: treat a null
component name as empty when matching, as defence in depth.
I'll open a PR for this shortly.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
