[
https://issues.apache.org/jira/browse/NIFI-5374?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16540990#comment-16540990
]
ASF subversion and git services commented on NIFI-5374:
-------------------------------------------------------
Commit b46033be306b2ce66c3316b2f4fec92b941307ac in nifi's branch
refs/heads/support/nifi-1.7.x from thenatog
[ https://git-wip-us.apache.org/repos/asf?p=nifi.git;h=b46033b ]
NIFI-5374 - Added ExceptionFilter which catches RequestRejectedException thrown
in the nifi-api Jersey code. These exceptions were not caught by the Jetty
error-page configuration because they're thrown before the endpoint/Jetty
routing is hit.
Added integration test for checking the ExceptionFilter catches malicious
string exceptions.
Made minor changes to PR 2840 for code style.
This closes #2840.
Co-authored-by: Andy LoPresto <[email protected]>
Signed-off-by: Andy LoPresto <[email protected]>
> Suppress stacktrace being returned to remote client when using NiFi REST API
> ----------------------------------------------------------------------------
>
> Key: NIFI-5374
> URL: https://issues.apache.org/jira/browse/NIFI-5374
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Core Framework
> Affects Versions: 1.7.0
> Reporter: Nathan Gough
> Assignee: Nathan Gough
> Priority: Minor
> Labels: filter, stacktrace, suppress
> Fix For: 1.8.0, 1.7.1
>
> Attachments: image001.png
>
>
> When a remote user attempts to use an endpoint with a malicious string, Jetty
> will return a full stacktrace of the error. This provides the remote user
> with excess information that can be used when attempting to manipulate a
> system.
> !image001.png!
> This stacktrace should be logged only to the nifi-app.log and the stacktrace
> suppressed before returning a 500 error to the user.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
