You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@nifi.apache.org by "shoemoney (via GitHub)" <gi...@apache.org> on 2026/08/25 20:44:46 UTC

[PR] fix(nifi): use equals for JNDI scheme allowlist not contains [nifi]

shoemoney opened a new pull request, #11592:
URL: https://github.com/apache/nifi/pull/11592

   JNDI Provider URL allowlist bypass via substring check.
   
   Bug: JndiJmsConnectionFactoryProperties.isSchemeAllowed uses allowedScheme.contains(scheme). Any substring of an allowed scheme passes, for example s:// passes because ssl.contains(s) is true, and fi:// passes via file.contains(fi).
   
   Fix: Replace contains with equalsIgnoreCase for exact case-insensitive match. One line change at line 195.
   
   Evidence:
   * Manual verification shows s:// and fi:// correctly rejected after fix, while valid schemes ssl, tcp, file, etc still pass.
   * Existing tests pass: JndiJmsConnectionFactoryProviderTest, 7 tests, 0 failures before and after.
   * Blast radius: 1 file, 1 line changed, no formatter changes.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(nifi): use equals for JNDI scheme allowlist not contains [nifi]

Posted by "exceptionfactory (via GitHub)" <gi...@apache.org>.

exceptionfactory closed pull request #11592: fix(nifi): use equals for JNDI scheme allowlist not contains
URL: https://github.com/apache/nifi/pull/11592


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] fix(nifi): use equals for JNDI scheme allowlist not contains [nifi]

Posted by "shoemoney (via GitHub)" <gi...@apache.org>.

shoemoney commented on PR #11592:
URL: https://github.com/apache/nifi/pull/11592#issuecomment-5417546945

   Thanks @exceptionfactory for the review. Acknowledged that this PR is closed and did not meet the NiFi contribution requirements.
   
   Missing items per the PR template:
   * Apache NiFi Jira issue and NIFI-XXXXX prefix on title and commit
   * GPG signed commit showing Verified status
   * Single commit on current main
   * Verification via ./mvnw clean install -P contrib-check
   
   The fix itself (equalsIgnoreCase instead of contains for scheme allowlist, 1 line) is verified and existing tests pass. Plan is to create a Jira, rebase to a single signed commit with the NIFI prefix, and open a new PR that follows the template. No action needed on this closed PR.
   
   Appreciate the guidance.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org