mcgilman opened a new pull request, #11462: URL: https://github.com/apache/nifi/pull/11462
Add safeApiPath and isSameOriginTarget shared utilities and apply them to route/query-derived values in AccessPolicyService, DocumentationService, and the content viewer, so untrusted deep-link input cannot redirect authenticated requests or bypass the same-origin ref check. # Summary [NIFI-16135](https://issues.apache.org/jira/browse/NIFI-16135) Hardens the UI's handling of values that originate from the browser URL (route parameters and query parameters) before they are used to build authenticated `nifi-api` requests. These values can be influenced by a crafted link opened by an authenticated user but were previously trusted as-is when constructing the request path. This adds two small shared utilities in `libs/shared` and applies them at the points where URL-derived values reach a request: - `safeApiPath(...segments)` — validates each value as a single, atomic path segment (rejecting path separators, `..` traversal sequences including pre-encoded forms such as `%2e%2e`/`%2f`, control characters, empty and non-decodable values) and percent-encodes it. On an invalid segment it throws, so the caller fails closed and no request is issued. Legitimate values (identifiers and enumerated resource names) are unchanged, so existing URL shapes are preserved. - `isSameOriginTarget(candidate, base, { requireBasePathPrefix })` — canonicalizes both values and compares origins with a segment-boundary-aware path check, replacing a bypassable `startsWith` prefix check. Applied to: - `DocumentationService` — component/step documentation requests built from route-supplied definition coordinates. - `AccessPolicyService` — policy requests built from route-supplied action/resource/identifier values. Affected methods are wrapped in `defer(...)` so a rejection surfaces on the observable error channel that callers already handle. - `ContentViewerComponent` — the query-supplied content `ref` guard now uses a same-origin comparison instead of a string prefix match. Unit tests cover the new validation and same-origin logic, including traversal, pre-encoded traversal, control-character, look-alike-origin, and path-boundary cases. # Tracking Please complete the following tracking steps prior to pull request creation. ### Issue Tracking - [x] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created ### Pull Request Tracking - [x] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-00000` - [x] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-00000` ### Pull Request Formatting - [x] Pull Request based on current revision of the `main` branch - [x] Pull Request refers to a feature branch with one commit containing changes # Verification Please indicate the verification steps performed prior to pull request creation. ### Build - [x] Build completed using `mvn clean install -P contrib-check` - [ ] JDK 21 - [ ] JDK 25 ### Licensing - [x] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html) - [x] New dependencies are documented in applicable `LICENSE` and `NOTICE` files ### Documentation - [x] Documentation formatting appears as expected in rendered files -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
