You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by GitBox <gi...@apache.org> on 2021/03/01 18:48:53 UTC
[GitHub] [nifi] exceptionfactory commented on a change in pull request #4857: NIFI-8230 Removed default Sensitive Properties Key
exceptionfactory commented on a change in pull request #4857:
URL: https://github.com/apache/nifi/pull/4857#discussion_r584964533
##########
File path: nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-properties-loader/src/main/java/org/apache/nifi/properties/NiFiPropertiesLoader.java
##########
@@ -241,9 +239,53 @@ public NiFiProperties load(String path) {
*/
public NiFiProperties get() {
if (instance == null) {
- instance = loadDefault();
+ instance = setSensitivePropertiesKey(loadDefault());
}
return instance;
}
+
+ private NiFiProperties setSensitivePropertiesKey(final NiFiProperties niFiProperties) {
+ NiFiProperties processedProperties = niFiProperties;
+
+ if (isKeyGenerationRequired(niFiProperties)) {
+ final File flowConfigurationFlow = niFiProperties.getFlowConfigurationFile();
+ if (flowConfigurationFlow.exists()) {
+ logger.error("Flow Configuration File [{}] Found: Migration Required for blank Sensitive Properties Key [{}]", NiFiProperties.SENSITIVE_PROPS_KEY);
+ final String message = String.format("Sensitive Properties Key [%s] not found: %s", NiFiProperties.SENSITIVE_PROPS_KEY, MIGRATION_INSTRUCTIONS);
+ throw new SensitivePropertyProtectionException(message);
+ }
+
+ logger.warn("Generating Random Sensitive Properties Key [{}]", NiFiProperties.SENSITIVE_PROPS_KEY);
+ final SecureRandom secureRandom = new SecureRandom();
+ final byte[] sensitivePropertiesKeyBinary = new byte[SENSITIVE_PROPERTIES_KEY_LENGTH];
+ secureRandom.nextBytes(sensitivePropertiesKeyBinary);
+ final String sensitivePropertiesKey = KEY_ENCODER.encodeToString(sensitivePropertiesKeyBinary);
+ try {
+ final File niFiPropertiesFile = new File(CryptoUtils.getDefaultFilePath());
Review comment:
That's a good point, will change to an instance variable to avoid multiple calls to `CryptoUtils.getDefaultFilePath()`.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org