[NIFI-10375] Stateless NiFi requires JDK to run on Java 9+. It shouldn't.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.17.0, 1.16.1, 1.16.2, 1.16.3
• Fix Version/s: 1.18.0
• Component/s: NiFi Stateless
• Assignee: Mark Payne
• Reporter: Mark Payne
• Created: 19/Aug/22 19:44
• Updated: 24/Aug/22 14:50
• Resolved: 24/Aug/22 14:50

Description

If run with Java 9+, the AllowListClassLoader that is used by NiFi Stateless requires that the JDK be in use, not just a JRE. This is because it looks for presence of .jar and .jmod files in the $JAVA_HOME directory but the jmod files are only present in the JDK.

When attempting to load a class, if it's not in the Allowed List, it should check the class's module and allow through anything in the java. and jdk. modules. This allows a more compatible way of detecting that a given class is part of Java and therefore needs to be made available, versus a part of the third party application that is calling Stateless.

Issue Links

• relates to: NIFI-9861 Stateless ClassLoader isolation does not work on Java 11
• relates to: NIFI-9576 ClassLoader isolation for Stateless NiFi
• links to: GitHub Pull Request #6317