[PR] NIFI-16059: validate connector postMessage origin against the host or… [nifi]

["mcgilman (via GitHub)" <gi...@apache.org>]

mcgilman opened a new pull request, #11379:
URL: https://github.com/apache/nifi/pull/11379

   …igin instead of the entity-controlled configurationUrl (CWE-346)
   
   # Summary
   
   [NIFI-16059](https://issues.apache.org/jira/browse/NIFI-16059)
   
   Connector custom UIs are embedded in the application via an `<iframe>` and
   communicate with the host through `window.postMessage`. The host's
   `ConnectorMessageHost` derived the origin it trusted — for both inbound message
   validation and the outbound `targetOrigin` — from the connector-provided
   `configurationUrl` / `detailsUrl`. Because those URLs are controlled by the
   connector entity, the entity could effectively attest to its own message
   origin, which is an origin-validation weakness (CWE-346).
   
   This change decouples the iframe `src` from the trusted origin. The host now
   trusts only the application's own origin (`document.location.origin`), which is
   valid because connector custom UIs are served by the same web server that serves
   the application (the `configurationUrl` / `detailsUrl` are built from the
   incoming request and contribute only the path, so the iframe is same-origin with
   the parent).
   
   ### Changes
   
   - `ConnectorMessageHost`
     - Removed the `expectedOrigin` option and the static `extractOrigin()` helper.
     - Trust only `trustedOrigin` (`document.location.origin`, via the `DOCUMENT`
       token), used for both inbound origin validation and the outbound
       `targetOrigin`. Messages whose `event.origin` does not match are dropped
       (fail-closed). The existing `event.source` (iframe `contentWindow`) and
       message namespace/type checks are unchanged.
   - `connector-configure` / `connector-detail`
     - No longer pass `expectedOrigin` to `startListening(...)`.
     - The disconnected-node-acknowledgment is posted to `trustedOrigin` rather than
       an origin derived from the entity URL.
   
   ### Verification
   
   - Added a regression test asserting that a message whose origin matches an
     attacker-controlled `configurationUrl` is dropped, and that a message from the
     application origin is accepted.
   - Added a direct test for the outbound disconnected-node-acknowledgment asserting
     it is posted with `targetOrigin === window.location.origin` and the expected
     message namespace/type.
   - `nx test nifi` (full suite) and `nx lint nifi` pass.
   
   # Tracking
   
   Please complete the following tracking steps prior to pull request creation.
   
   ### Issue Tracking
   
   - [x] [Apache NiFi Jira](https://issues.apache.org/jira/browse/NIFI) issue created
   
   ### Pull Request Tracking
   
   - [x] Pull Request title starts with Apache NiFi Jira issue number, such as `NIFI-00000`
   - [x] Pull Request commit message starts with Apache NiFi Jira issue number, as such `NIFI-00000`
   
   ### Pull Request Formatting
   
   - [x] Pull Request based on current revision of the `main` branch
   - [x] Pull Request refers to a feature branch with one commit containing changes
   
   # Verification
   
   Please indicate the verification steps performed prior to pull request creation.
   
   ### Build
   
   - [ ] Build completed using `mvn clean install -P contrib-check`
     - [ ] JDK 21
   
   ### Licensing
   
   - [x] New dependencies are compatible with the [Apache License 2.0](https://apache.org/licenses/LICENSE-2.0) according to the [License Policy](https://www.apache.org/legal/resolved.html)
   - [x] New dependencies are documented in applicable `LICENSE` and `NOTICE` files
   
   ### Documentation
   
   - [x] Documentation formatting appears as expected in rendered files


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] NIFI-16059: validate connector postMessage origin against the host or… [nifi]

["rfellows (via GitHub)" <gi...@apache.org>]

rfellows commented on code in PR #11379:
URL: https://github.com/apache/nifi/pull/11379#discussion_r3579332118


##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/connectors/service/connector-message-host.service.spec.ts:
##########
@@ -350,23 +350,43 @@ describe('ConnectorMessageHost', () => {
         });
     });
 
-    describe('extractOrigin', () => {
-        it('should extract origin from a valid URL', () => {
-            expect(ConnectorMessageHost.extractOrigin('https://connector-ui.example.com/config?id=123')).toBe(
-                'https://connector-ui.example.com'
+    describe('origin decoupling (FLOW-11982)', () => {

Review Comment:
   This isn't a valid nifi jira number, can you update this to the proper reference or just eliminate it?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] NIFI-16059: validate connector postMessage origin against the host or… [nifi]

["rfellows (via GitHub)" <gi...@apache.org>]

rfellows merged PR #11379:
URL: https://github.com/apache/nifi/pull/11379


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org