This is an automated email from the ASF dual-hosted git repository.
pvillard31 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/nifi.git
The following commit(s) were added to refs/heads/main by this push:
new a7d7c53576a NIFI-16368 Improve validation for Parameter Context ID
values (#11695)
a7d7c53576a is described below
commit a7d7c53576aef13d751653b6d7818ae8669c2ee3
Author: David Handermann <[email protected]>
AuthorDate: Fri Sep 18 13:36:17 2026 -0500
NIFI-16368 Improve validation for Parameter Context ID values (#11695)
---
.../nifi/web/api/ParameterContextResource.java | 37 ++++++++++------------
.../nifi/web/api/ParameterContextResourceTest.java | 34 ++++++++++++++++++--
2 files changed, 48 insertions(+), 23 deletions(-)
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
index 5409fbb8c53..1f196283c96 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/main/java/org/apache/nifi/web/api/ParameterContextResource.java
@@ -355,19 +355,13 @@ public class ParameterContextResource extends
AbstractParameterResource {
public Response updateParameterContext(
@PathParam("id") String contextId,
@Parameter(description = "The updated Parameter Context", required
= true) final ParameterContextEntity requestEntity) {
-
- // Validate request
- if (requestEntity.getId() == null) {
- throw new IllegalArgumentException("The ID of the Parameter
Context must be specified");
- }
- if (!requestEntity.getId().equals(contextId)) {
- throw new IllegalArgumentException("The ID of the Parameter
Context must match the ID specified in the URL's path");
- }
+ verifyParameterContextId(contextId, requestEntity.getId());
final ParameterContextDTO updateDto = requestEntity.getComponent();
if (updateDto == null) {
throw new IllegalArgumentException("The Parameter Context must be
supplied");
}
+ verifyParameterContextId(contextId, updateDto.getId());
final RevisionDTO revisionDto = requestEntity.getRevision();
if (revisionDto == null) {
@@ -387,7 +381,7 @@ public class ParameterContextResource extends
AbstractParameterResource {
final NiFiUser user = NiFiUserUtils.getNiFiUser();
final Set<AffectedComponentEntity> affectedComponents =
serviceFacade.getComponentsAffectedByParameterContextUpdate(Collections.singletonList(updateDto));
- final Revision requestRevision =
getRevision(requestEntity.getRevision(), updateDto.getId());
+ final Revision requestRevision =
getRevision(requestEntity.getRevision(), contextId);
return withWriteLock(
serviceFacade,
requestEntity,
@@ -397,7 +391,7 @@ public class ParameterContextResource extends
AbstractParameterResource {
(rev, entity) -> {
final ParameterContextEntity updatedEntity =
serviceFacade.updateParameterContext(rev, entity.getComponent());
-
updatedEntity.setUri(generateResourceUri("parameter-contexts", entity.getId()));
+
updatedEntity.setUri(generateResourceUri("parameter-contexts", contextId));
return generateOkResponse(updatedEntity).build();
}
);
@@ -728,13 +722,7 @@ public class ParameterContextResource extends
AbstractParameterResource {
throw new IllegalArgumentException("Parameter Context must be
specified");
}
- if (contextDto.getId() == null) {
- throw new IllegalArgumentException("Parameter Context's ID must be
specified");
- }
- if (!contextDto.getId().equals(contextId)) {
- throw new IllegalArgumentException("ID of Parameter Context in
message body does not match Parameter Context ID supplied in URI");
- }
-
+ verifyParameterContextId(contextId, contextDto.getId());
validateParameterNames(contextDto);
validateAssetReferences(contextDto);
@@ -871,6 +859,15 @@ public class ParameterContextResource extends
AbstractParameterResource {
}
}
+ private void verifyParameterContextId(final String pathId, final String
requestId) {
+ if (requestId == null) {
+ throw new IllegalArgumentException("The ID of the Parameter
Context must be specified");
+ }
+ if (!requestId.equals(pathId)) {
+ throw new IllegalArgumentException("The ID of the Parameter
Context must match the ID specified in the URL path");
+ }
+ }
+
private void validateParameterNames(final ParameterContextDTO
parameterContextDto) {
if (parameterContextDto.getParameters() != null) {
for (final ParameterEntity entity :
parameterContextDto.getParameters()) {
@@ -1071,9 +1068,7 @@ public class ParameterContextResource extends
AbstractParameterResource {
if (requestDto.getParameterContext() == null) {
throw new IllegalArgumentException("Parameter Context must be
specified");
}
- if (requestDto.getParameterContext().getId() == null) {
- throw new IllegalArgumentException("Parameter Context's ID must be
specified");
- }
+ verifyParameterContextId(contextId,
requestDto.getParameterContext().getId());
if (isReplicateRequest()) {
return replicate("POST", requestEntity);
@@ -1086,7 +1081,7 @@ public class ParameterContextResource extends
AbstractParameterResource {
requestEntity,
lookup -> {
authorizeReadWriteParameterContext(contextId);
-
authorizeReferencingComponents(requestEntity.getRequest().getParameterContext().getId(),
lookup, NiFiUserUtils.getNiFiUser());
+ authorizeReferencingComponents(contextId, lookup,
NiFiUserUtils.getNiFiUser());
},
() -> {
},
diff --git
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/ParameterContextResourceTest.java
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/ParameterContextResourceTest.java
index 2f89e986971..4f8c02786db 100644
---
a/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/ParameterContextResourceTest.java
+++
b/nifi-framework-bundle/nifi-framework/nifi-web/nifi-web-api/src/test/java/org/apache/nifi/web/api/ParameterContextResourceTest.java
@@ -29,10 +29,12 @@ import org.apache.nifi.web.api.dto.AffectedComponentDTO;
import org.apache.nifi.web.api.dto.DtoFactory;
import org.apache.nifi.web.api.dto.EntityFactory;
import org.apache.nifi.web.api.dto.ParameterContextDTO;
+import org.apache.nifi.web.api.dto.ParameterContextValidationRequestDTO;
import org.apache.nifi.web.api.dto.RevisionDTO;
import org.apache.nifi.web.api.entity.AffectedComponentEntity;
import org.apache.nifi.web.api.entity.ParameterContextEntity;
import org.apache.nifi.web.api.entity.ParameterContextReferenceEntity;
+import org.apache.nifi.web.api.entity.ParameterContextValidationRequestEntity;
import org.apache.nifi.web.security.token.NiFiAuthenticationToken;
import org.apache.nifi.web.util.ParameterUpdateManager;
import org.junit.jupiter.api.AfterEach;
@@ -49,6 +51,7 @@ import java.util.LinkedHashSet;
import java.util.List;
import java.util.Set;
+import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.eq;
import static org.mockito.Mockito.doAnswer;
@@ -62,7 +65,7 @@ import static org.mockito.Mockito.when;
class ParameterContextResourceTest {
private static final String TARGET_CONTEXT_ID = "target-context";
- private static final String CURRENT_INHERITED_CONTEXT_ID =
"current-inherited-context";
+ private static final String OTHER_CONTEXT_ID = "other-context";
private static final String REQUESTED_INHERITED_CONTEXT_ID =
"requested-inherited-context";
@Mock
@@ -145,12 +148,39 @@ class ParameterContextResourceTest {
verify(requestedInheritedContext).authorize(authorizer,
RequestAction.READ, user);
}
+ @Test
+ void testUpdateParameterContextRequiresComponentIdToMatchPath() {
+ final ParameterContextResource resource = new
ParameterContextResource();
+ final ParameterContextEntity requestEntity = new
ParameterContextEntity();
+ requestEntity.setRevision(new RevisionDTO());
+
requestEntity.setComponent(createParameterContextDto(OTHER_CONTEXT_ID));
+ requestEntity.setId(TARGET_CONTEXT_ID);
+
+ assertThrows(IllegalArgumentException.class, () ->
resource.updateParameterContext(TARGET_CONTEXT_ID, requestEntity));
+ }
+
+ @Test
+ void testSubmitValidationRequestRequiresParameterContextIdToMatchPath() {
+ final ParameterContextResource resource = new
ParameterContextResource();
+ final ParameterContextValidationRequestDTO requestDto = new
ParameterContextValidationRequestDTO();
+
requestDto.setParameterContext(createParameterContextDto(OTHER_CONTEXT_ID));
+
+ final ParameterContextValidationRequestEntity requestEntity = new
ParameterContextValidationRequestEntity();
+ requestEntity.setRequest(requestDto);
+
+ assertThrows(IllegalArgumentException.class, () ->
resource.submitValidationRequest(TARGET_CONTEXT_ID, requestEntity));
+ }
+
private static ParameterContextDTO createRequestParameterContextDto() {
+ return createParameterContextDto(TARGET_CONTEXT_ID);
+ }
+
+ private static ParameterContextDTO createParameterContextDto(final String
contextId) {
final ParameterContextReferenceEntity requestedInheritedReference =
new ParameterContextReferenceEntity();
requestedInheritedReference.setId(REQUESTED_INHERITED_CONTEXT_ID);
final ParameterContextDTO dto = new ParameterContextDTO();
- dto.setId(TARGET_CONTEXT_ID);
+ dto.setId(contextId);
dto.setParameters(Set.of());
dto.setInheritedParameterContexts(List.of(requestedInheritedReference));
return dto;
