Níno Martínez Wael created NIFI-16454:
-----------------------------------------
Summary: AllowListClassLoader throws and logs a
NullPointerException for every class in the unnamed module
Key: NIFI-16454
URL: https://issues.apache.org/jira/browse/NIFI-16454
Project: Apache NiFi
Issue Type: Bug
Components: NiFi Stateless
Affects Versions: 2.12.0
Reporter: Níno Martínez Wael
When NiFi Stateless is bootstrapped with a root class loader that sees classes
from the classpath (the default StatelessBootstrap.bootstrap(config) uses the
system class loader), every such class that is not in the allow-list goes
through AllowListClassLoader.isClassAllowed. For a class in the unnamed module,
Module.getName() returns null, and isModuleAllowed calls
moduleName.startsWith(prefix) on it:
{code}
java.lang.NullPointerException: Cannot invoke "String.startsWith(String)"
because "moduleName" is null
at
org.apache.nifi.stateless.bootstrap.AllowListClassLoader.isModuleAllowed(AllowListClassLoader.java:134)
at
org.apache.nifi.stateless.bootstrap.AllowListClassLoader.isClassAllowed(AllowListClassLoader.java:120)
at
org.apache.nifi.stateless.bootstrap.AllowListClassLoader.loadClass(AllowListClassLoader.java:71)
...
at
org.apache.nifi.stateless.config.PropertiesFileFlowDefinitionParser.<clinit>(PropertiesFileFlowDefinitionParser.java:73)
...
at
org.apache.nifi.stateless.bootstrap.StatelessBootstrap.parseDataflowDefinition(StatelessBootstrap.java:86)
{code}
The exception is caught and logged at DEBUG with the full stack trace ("Failed
to determine if class ... is part of the implicitly allowed modules"), and the
class is treated as not allowed. So the result is correct, but the log volume
is not: running Stateless from a JUnit test with Logback and no configuration
(root level DEBUG) produces one stack trace per classpath class, thousands for
Jackson alone during PropertiesFileFlowDefinitionParser initialisation, which
makes test runs look hung.
*Steps to reproduce*
# Put nifi-stateless-bootstrap 2.12.0 and its dependencies on a JUnit test
classpath with logback-classic and no logback-test.xml.
# Call StatelessBootstrap.bootstrap(config), then parseDataflowDefinition(...).
# One DEBUG line plus a NullPointerException stack trace is logged for each
classpath class, e.g. com.fasterxml.jackson.databind.ObjectMapper.
*Expected*
A class in the unnamed module is treated as "not in an allowed module" without
an exception; at most a short DEBUG line is logged.
*Suggested fix* (in isClassAllowed, before calling isModuleAllowed)
{code:java}
final String moduleName = (String) getName.invoke(module);
if (moduleName == null) {
return false; // unnamed module: classpath class, not implicitly allowed
}
{code}
*Environment*
NiFi Stateless 2.12.0, JDK 21, Maven Surefire 3.5.5, Logback 1.6.3.
*Workarounds*
* Set the logger org.apache.nifi.stateless to INFO or WARN.
* Pass a root class loader to StatelessBootstrap.bootstrap(config,
rootClassLoader) that only offers the allow-listed classes.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
