You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@nifi.apache.org by "rfellows (via GitHub)" <gi...@apache.org> on 2025/12/01 14:12:36 UTC
[PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
rfellows opened a new pull request, #10583:
URL: https://github.com/apache/nifi/pull/10583
# Summary
[NIFI-15276](https://issues.apache.org/jira/browse/NIFI-15276)
This addresses #10574, #10570, and #10568
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "rfellows (via GitHub)" <gi...@apache.org>.
rfellows commented on code in PR #10583:
URL: https://github.com/apache/nifi/pull/10583#discussion_r2578672996
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/service/component-state.service.ts:
##########
@@ -19,28 +19,40 @@ import { Injectable, inject } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { ClearComponentStateRequest, ComponentStateEntity, LoadComponentStateRequest } from '../state/component-state';
import { Observable } from 'rxjs';
-import { NiFiCommon } from '@nifi/shared';
+import { ComponentType, NiFiCommon } from '@nifi/shared';
@Injectable({ providedIn: 'root' })
export class ComponentStateService {
+ private static readonly API = '../nifi-api';
+
private httpClient = inject(HttpClient);
private nifiCommon = inject(NiFiCommon);
getComponentState(request: LoadComponentStateRequest): Observable<ComponentStateEntity> {
+ const path = this.nifiCommon.getComponentTypeApiPath(request.componentType);
return this.httpClient.get<ComponentStateEntity>(
- `${this.nifiCommon.stripProtocol(request.componentUri)}/state`
+ `${ComponentStateService.API}/${path}/${request.componentId}/state`
);
}
clearComponentState(request: ClearComponentStateRequest): Observable<any> {
- return this.httpClient.post(`${this.nifiCommon.stripProtocol(request.componentUri)}/state/clear-requests`, {});
+ const path = this.nifiCommon.getComponentTypeApiPath(request.componentType);
+ return this.httpClient.post(
+ `${ComponentStateService.API}/${path}/${request.componentId}/state/clear-requests`,
+ {}
Review Comment:
This was already here. it isn't new in these changes. just how the url path is constructed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "rfellows (via GitHub)" <gi...@apache.org>.
rfellows commented on code in PR #10583:
URL: https://github.com/apache/nifi/pull/10583#discussion_r2578684549
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/state/flow/index.ts:
##########
@@ -673,6 +673,7 @@ export interface FlowState {
}
export interface RunOnceRequest {
+ id: string;
Review Comment:
No, i removed it in the latest commit. thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "mcgilman (via GitHub)" <gi...@apache.org>.
mcgilman commented on code in PR #10583:
URL: https://github.com/apache/nifi/pull/10583#discussion_r2579223155
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/service/queue.service.ts:
##########
@@ -42,11 +40,15 @@ export class QueueService {
);
}
- pollEmptyQueueRequest(dropRequest: DropRequest): Observable<any> {
- return this.httpClient.get(this.nifiCommon.stripProtocol(dropRequest.uri));
+ pollEmptyQueueRequest(request: EmptyQueueRequest): Observable<any> {
+ return this.httpClient.get(
+ `${QueueService.API}/flowfile-queues/${request.connectionId}/drop-requests/${request.dropRequestId}`
+ );
Review Comment:
We may need to introduce a new method pollEmptyQueuesRequest and call the appropriate one from the effects based on the action.
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/service/queue.service.ts:
##########
@@ -42,11 +40,15 @@ export class QueueService {
);
}
- pollEmptyQueueRequest(dropRequest: DropRequest): Observable<any> {
- return this.httpClient.get(this.nifiCommon.stripProtocol(dropRequest.uri));
+ pollEmptyQueueRequest(request: EmptyQueueRequest): Observable<any> {
+ return this.httpClient.get(
+ `${QueueService.API}/flowfile-queues/${request.connectionId}/drop-requests/${request.dropRequestId}`
+ );
}
- deleteEmptyQueueRequest(dropRequest: DropRequest): Observable<any> {
- return this.httpClient.delete(this.nifiCommon.stripProtocol(dropRequest.uri));
+ deleteEmptyQueueRequest(request: EmptyQueueRequest): Observable<any> {
+ return this.httpClient.delete(
+ `${QueueService.API}/flowfile-queues/${request.connectionId}/drop-requests/${request.dropRequestId}`
+ );
Review Comment:
We may need to introduce a new method pollEmptyQueuesRequest and call the appropriate one from the effects based on the action.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "scottyaslan (via GitHub)" <gi...@apache.org>.
scottyaslan commented on PR #10583:
URL: https://github.com/apache/nifi/pull/10583#issuecomment-3598792573
Reviewing...
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "mcgilman (via GitHub)" <gi...@apache.org>.
mcgilman merged PR #10583:
URL: https://github.com/apache/nifi/pull/10583
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "mcgilman (via GitHub)" <gi...@apache.org>.
mcgilman commented on code in PR #10583:
URL: https://github.com/apache/nifi/pull/10583#discussion_r2578579899
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/state/flow/index.ts:
##########
@@ -673,6 +673,7 @@ export interface FlowState {
}
export interface RunOnceRequest {
+ id: string;
Review Comment:
Is `uri` below still needed?
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/state/queue/queue.reducer.ts:
##########
@@ -47,7 +47,12 @@ export const queueReducer = createReducer(
})),
on(submitEmptyQueueRequestSuccess, pollEmptyQueueRequestSuccess, (state, { response }) => ({
...state,
- dropEntity: response.dropEntity,
+ dropEntity: {
+ dropRequest: {
+ ...response.dropEntity.dropRequest,
+ connectionId: state.connectionId!
+ }
+ },
Review Comment:
The connectionId is already in this store. We should be able to use it and pass it where needed instead of adding it to the `dropRequest`.
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/service/component-state.service.ts:
##########
@@ -19,28 +19,40 @@ import { Injectable, inject } from '@angular/core';
import { HttpClient } from '@angular/common/http';
import { ClearComponentStateRequest, ComponentStateEntity, LoadComponentStateRequest } from '../state/component-state';
import { Observable } from 'rxjs';
-import { NiFiCommon } from '@nifi/shared';
+import { ComponentType, NiFiCommon } from '@nifi/shared';
@Injectable({ providedIn: 'root' })
export class ComponentStateService {
+ private static readonly API = '../nifi-api';
+
private httpClient = inject(HttpClient);
private nifiCommon = inject(NiFiCommon);
getComponentState(request: LoadComponentStateRequest): Observable<ComponentStateEntity> {
+ const path = this.nifiCommon.getComponentTypeApiPath(request.componentType);
return this.httpClient.get<ComponentStateEntity>(
- `${this.nifiCommon.stripProtocol(request.componentUri)}/state`
+ `${ComponentStateService.API}/${path}/${request.componentId}/state`
);
}
clearComponentState(request: ClearComponentStateRequest): Observable<any> {
- return this.httpClient.post(`${this.nifiCommon.stripProtocol(request.componentUri)}/state/clear-requests`, {});
+ const path = this.nifiCommon.getComponentTypeApiPath(request.componentType);
+ return this.httpClient.post(
+ `${ComponentStateService.API}/${path}/${request.componentId}/state/clear-requests`,
+ {}
Review Comment:
Did we intend to have an empty `{}` here?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "mcgilman (via GitHub)" <gi...@apache.org>.
mcgilman commented on code in PR #10583:
URL: https://github.com/apache/nifi/pull/10583#discussion_r2579207692
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/users/service/users.service.ts:
##########
@@ -73,7 +71,7 @@ export class UsersService {
...request.userPayload
}
};
- return this.httpClient.put(this.nifiCommon.stripProtocol(request.uri), payload);
+ return this.httpClient.put(`${UsersService.API}/tenants/users/${request.id}`, payload);
Review Comment:
I believe the `uri` field in the `request` object is no longer used and can be removed.
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/service/queue.service.ts:
##########
@@ -42,11 +40,15 @@ export class QueueService {
);
}
- pollEmptyQueueRequest(dropRequest: DropRequest): Observable<any> {
- return this.httpClient.get(this.nifiCommon.stripProtocol(dropRequest.uri));
+ pollEmptyQueueRequest(request: EmptyQueueRequest): Observable<any> {
+ return this.httpClient.get(
+ `${QueueService.API}/flowfile-queues/${request.connectionId}/drop-requests/${request.dropRequestId}`
+ );
}
- deleteEmptyQueueRequest(dropRequest: DropRequest): Observable<any> {
- return this.httpClient.delete(this.nifiCommon.stripProtocol(dropRequest.uri));
+ deleteEmptyQueueRequest(request: EmptyQueueRequest): Observable<any> {
+ return this.httpClient.delete(
+ `${QueueService.API}/flowfile-queues/${request.connectionId}/drop-requests/${request.dropRequestId}`
+ );
Review Comment:
This delete method only works for clearing single queues. When clearing multiple queues (through the Empty All Queues menu item on a Process Group) we don't have a single connection id. Rather we have a single Process Group id like in the submit method above.
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/service/queue.service.ts:
##########
@@ -42,11 +40,15 @@ export class QueueService {
);
}
- pollEmptyQueueRequest(dropRequest: DropRequest): Observable<any> {
- return this.httpClient.get(this.nifiCommon.stripProtocol(dropRequest.uri));
+ pollEmptyQueueRequest(request: EmptyQueueRequest): Observable<any> {
+ return this.httpClient.get(
+ `${QueueService.API}/flowfile-queues/${request.connectionId}/drop-requests/${request.dropRequestId}`
+ );
Review Comment:
This poll method only works for clearing single queues. When clearing multiple queues (through the Empty All Queues menu item on a Process Group) we don't have a single connection id. Rather we have a single Process Group id like in the submit method above.
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/users/service/users.service.ts:
##########
@@ -85,7 +83,7 @@ export class UsersService {
...request.userGroupPayload
}
};
- return this.httpClient.put(this.nifiCommon.stripProtocol(request.uri), payload);
+ return this.httpClient.put(`${UsersService.API}/tenants/user-groups/${request.id}`, payload);
Review Comment:
I believe the `uri` field in the `request` object is no longer used and can be removed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] NIFI-15276 - Address security vulnerabilities in dependencies: angular, node-forge [nifi]
Posted by "mcgilman (via GitHub)" <gi...@apache.org>.
mcgilman commented on code in PR #10583:
URL: https://github.com/apache/nifi/pull/10583#discussion_r2579223155
##########
nifi-frontend/src/main/frontend/apps/nifi/src/app/pages/flow-designer/service/queue.service.ts:
##########
@@ -42,11 +40,15 @@ export class QueueService {
);
}
- pollEmptyQueueRequest(dropRequest: DropRequest): Observable<any> {
- return this.httpClient.get(this.nifiCommon.stripProtocol(dropRequest.uri));
+ pollEmptyQueueRequest(request: EmptyQueueRequest): Observable<any> {
+ return this.httpClient.get(
+ `${QueueService.API}/flowfile-queues/${request.connectionId}/drop-requests/${request.dropRequestId}`
+ );
Review Comment:
We probably want to introduce a new method pollEmptyQueuesRequest and call the appropriate one from the effects based on the action.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@nifi.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org