Skip to content

Commit 1b70d13

Browse files
NickLarsenNZNickLarsenNZ
committed
chore(nifi): Add and patch 1.28.1
1 parent e769383 commit 1b70d13

File tree

6 files changed

+186
-0
lines changed

6 files changed

+186
-0
lines changed

‎nifi/stackable/patches/1.28.1/0001-no-zip-assembly.patch‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+
From: Nick Larsen <[email protected]>
3+
Date: Mon, 17 Feb 2025 15:13:39 +0100
4+
Subject: no zip assembly
5+
6+
---
7+
nifi-assembly/pom.xml | 1 -
8+
1 file changed, 1 deletion(-)
9+
10+
diff --git a/nifi-assembly/pom.xml b/nifi-assembly/pom.xml
11+
index 27928cf67e..d00154626a 100644
12+
--- a/nifi-assembly/pom.xml
13+
+++ b/nifi-assembly/pom.xml
14+
@@ -66,7 +66,6 @@ language governing permissions and limitations under the License. -->
15+
<tarLongFileMode>posix</tarLongFileMode>
16+
<formats>
17+
<format>dir</format>
18+
- <format>zip</format>
19+
</formats>
20+
</configuration>
21+
</execution>
22+
23+
base-commit: 883338fe28883733417d10f6ffa9319e75f5ea06
24+
--
25+
2.40.1
26+

‎nifi/stackable/patches/1.28.1/0002-allow-bypassing-check-for-host-header.patch‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+
From: Nick Larsen <[email protected]>
3+
Date: Mon, 17 Feb 2025 15:19:01 +0100
4+
Subject: allow bypassing check for host header
5+
6+
NiFi has the configuration option 'nifi.web.proxy.host' which controls allowed
7+
values for the host header field in any incoming request for the web ui.
8+
9+
This frequently causes issues when trying to expose the NiFi UI via for example
10+
an ingress, loadbalancer or any similar type of mechanism.
11+
12+
NiFi does not allow to disable this behavior, so at the moment the nifi operator
13+
simply hardcodes all even remotely possible values into this field.
14+
But in order to allow putting for example in ingress in front of NiFi this means
15+
using config overrides to change the value of this option, copy all the values
16+
the operator put in there and add the extra value you need.
17+
18+
This is less than ideal, the proper solution would probably be
19+
https://github.com/stackabletech/nifi-operator/issues/604
20+
21+
But until that is merged this is a simple workaround that allows overriding the list of allowed
22+
hostnames by just setting it to "*" and this will effectively bypass the hostname check entirely if set.
23+
24+
This allows us to keep the default behavior in place for those users where it works and not remove
25+
security features, but also enables users to disable this check if they know what they are doing.
26+
---
27+
.../org/apache/nifi/web/server/HostHeaderHandler.java | 8 +++++++-
28+
1 file changed, 7 insertions(+), 1 deletion(-)
29+
30+
diff --git a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java
31+
index dd4bbf54c0..ea1b5b2da1 100644
32+
--- a/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java
33+
+++ b/nifi-nar-bundles/nifi-framework-bundle/nifi-framework/nifi-web/nifi-jetty/src/main/java/org/apache/nifi/web/server/HostHeaderHandler.java
34+
@@ -47,6 +47,7 @@ public class HostHeaderHandler extends ScopedHandler {
35+
private final String serverName;
36+
private final int serverPort;
37+
private final List<String> validHosts;
38+
+ private boolean allowAllHosts = false;
39+
40+
/**
41+
* Instantiates a handler with a given server name and port 0.
42+
@@ -107,6 +108,11 @@ public class HostHeaderHandler extends ScopedHandler {
43+
// The value(s) from nifi.web.proxy.host
44+
hosts.addAll(parseCustomHostnames(niFiProperties));
45+
46+
+ // Check if the setting for allowed hosts has only the wildcard entry and
47+
+ // if so store this in allowAllHost for later use
48+
+ List<String> configuredHostNames = niFiProperties.getAllowedHostsAsList();
49+
+ this.allowAllHosts = configuredHostNames.size() == 1 && configuredHostNames.contains("*");
50+
+
51+
// empty is ok here
52+
hosts.add("");
53+
54+
@@ -205,7 +211,7 @@ public class HostHeaderHandler extends ScopedHandler {
55+
}
56+
57+
boolean hostHeaderIsValid(String hostHeader) {
58+
- return validHosts.contains(hostHeader.toLowerCase().trim());
59+
+ return this.allowAllHosts || validHosts.contains(hostHeader.toLowerCase().trim());
60+
}
61+
62+
@Override
63+
--
64+
2.40.1
65+

‎nifi/stackable/patches/1.28.1/0003-add-cyclonedx-plugin.patch‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+
From: Nick Larsen <[email protected]>
3+
Date: Mon, 17 Feb 2025 15:25:52 +0100
4+
Subject: add cyclonedx plugin
5+
6+
---
7+
pom.xml | 18 ++++++++++++++++++
8+
1 file changed, 18 insertions(+)
9+
10+
diff --git a/pom.xml b/pom.xml
11+
index 672c023277..641d772286 100644
12+
--- a/pom.xml
13+
+++ b/pom.xml
14+
@@ -1091,6 +1091,24 @@
15+
</excludes>
16+
</configuration>
17+
</plugin>
18+
+ <plugin>
19+
+ <groupId>org.cyclonedx</groupId>
20+
+ <artifactId>cyclonedx-maven-plugin</artifactId>
21+
+ <version>2.8.0</version>
22+
+ <configuration>
23+
+ <projectType>application</projectType>
24+
+ <schemaVersion>1.5</schemaVersion>
25+
+ <skipNotDeployed>false</skipNotDeployed>
26+
+ </configuration>
27+
+ <executions>
28+
+ <execution>
29+
+ <phase>package</phase>
30+
+ <goals>
31+
+ <goal>makeBom</goal>
32+
+ </goals>
33+
+ </execution>
34+
+ </executions>
35+
+ </plugin>
36+
</plugins>
37+
</build>
38+
<profiles>
39+
--
40+
2.40.1
41+

‎nifi/stackable/patches/1.28.1/0004-CVE-2024-36114-bump-aircompressor-to-0.27.patch‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
2+
From: Nick Larsen <[email protected]>
3+
Date: Mon, 17 Feb 2025 15:27:01 +0100
4+
Subject: CVE-2024-36114 bump aircompressor to 0.27
5+
6+
see https://github.com/stackabletech/vulnerabilities/issues/834
7+
8+
Aircompressor is a library with ports of the Snappy, LZO, LZ4, and
9+
Zstandard compression algorithms to Java. All decompressor
10+
implementations of Aircompressor (LZ4, LZO, Snappy, Zstandard) can crash
11+
the JVM for certain input, and in some cases also leak the content of
12+
other memory of the Java process (which could contain sensitive
13+
information). When decompressing certain data, the decompressors try to
14+
access memory outside the bounds of the given byte arrays or byte
15+
buffers. Because Aircompressor uses the JDK class sun.misc.Unsafe to
16+
speed up memory access, no additional bounds checks are performed and
17+
this has similar security consequences as out-of-bounds access in C or
18+
C++, namely it can lead to non-deterministic behavior or crash the JVM.
19+
Users should update to Aircompressor 0.27 or newer where these issues
20+
have been fixed. When decompressing data from untrusted users, this can
21+
be exploited for a denial-of-service attack by crashing the JVM, or to
22+
leak other sensitive information from the Java process. There are no
23+
known workarounds for this issue.
24+
---
25+
nifi-assembly/pom.xml | 6 ++++++
26+
1 file changed, 6 insertions(+)
27+
28+
diff --git a/nifi-assembly/pom.xml b/nifi-assembly/pom.xml
29+
index d00154626a..da38056c7a 100644
30+
--- a/nifi-assembly/pom.xml
31+
+++ b/nifi-assembly/pom.xml
32+
@@ -97,6 +97,12 @@ language governing permissions and limitations under the License. -->
33+
</plugins>
34+
</build>
35+
<dependencies>
36+
+ <!-- Mitigate CVE-2024-36114: See https://github.com/stackabletech/vulnerabilities/issues/834 -->
37+
+ <dependency>
38+
+ <groupId>io.airlift</groupId>
39+
+ <artifactId>aircompressor</artifactId>
40+
+ <version>0.27</version>
41+
+ </dependency>
42+
<dependency> <!-- handling this explicitly Must be in root lib -->
43+
<groupId>javax.servlet</groupId>
44+
<artifactId>javax.servlet-api</artifactId>
45+
--
46+
2.40.1
47+

‎nifi/stackable/patches/1.28.1/patchable.toml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
upstream = "https://github.com/apache/nifi"
2+
base = "883338fe28883733417d10f6ffa9319e75f5ea06"

‎nifi/versions.py‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,11 @@
44
"java-base": "11",
55
"java-devel": "11", # There is an error when trying to use the jdk 21 (since nifi 1.26.0)
66
},
7+
{
8+
"product": "1.28.1",
9+
"java-base": "11",
10+
"java-devel": "11",
11+
},
712
{
813
"product": "2.0.0",
914
"java-base": "21",

0 commit comments

Comments
 (0)