[jira] [Commented] (NIFI-16059) Connector custom UI: validate postMessage origin against the application origin instead of the connector's configuration URL

["ASF subversion and git services (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/NIFI-16059?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18096288#comment-18096288 ] 

ASF subversion and git services commented on NIFI-16059:
--------------------------------------------------------

Commit f516dde311fe95323bb3ca2ff4dd76366a619474 in nifi's branch refs/heads/main from Matt Gilman
[ https://gitbox.apache.org/repos/asf?p=nifi.git;h=f516dde311f ]

NIFI-16059: validate connector postMessage origin against the host origin instead of the entity-controlled configurationUrl (CWE-346) (#11379)

This closes #11379

> Connector custom UI: validate postMessage origin against the application origin instead of the connector's configuration URL
> ----------------------------------------------------------------------------------------------------------------------------
>
>                 Key: NIFI-16059
>                 URL: https://issues.apache.org/jira/browse/NIFI-16059
>             Project: Apache NiFi
>          Issue Type: Improvement
>          Components: Core UI
>            Reporter: Matt Gilman
>            Assignee: Matt Gilman
>            Priority: Major
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> The connector custom UI host (ConnectorMessageHost) validates the origin of
> inbound postMessage events from a connector's embedded custom UI. The origin it trusts is derived from the connector entity's configurationUrl / detailsUrl --
> the same per-connector field that is used to set the custom UI iframe's src.
> Because the content loaded into the iframe and the origin used to validate
> messages coming back from it are taken from the same per-connector value, the
> inbound origin check does not represent an independent trust decision. Whatever
> controls that field controls both the loaded UI and the origin string used to
> validate messages from it, so the validation is effectively self-referential
> (an Origin Validation Error, CWE-346).
> Connector custom UIs are served by the NiFi web server itself: the
> configuration/details URLs are generated server-side in ConnectorResource from
> the incoming request URI, so the custom UI is same-origin with the application.
> The origin that should be trusted for these messages is therefore a property of
> the application, not of an individual connector entity, and the current coupling
> between the iframe source and the message-trust origin is unnecessary.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)