[NIFI-10674] Variable access through evaluateELString()

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.18.0
• Fix Version/s: 1.19.0
• Component/s: Security, Variable Registry
• Labels: security
• Assignee: David Handermann
• Reporter: Gogolev Sergey
• Created: 19/Oct/22 21:12
• Updated: 07/Aug/23 13:58
• Resolved: 21/Oct/22 18:19

Description

Not sure it's bug, but security breach. With expression language i can view content of sensitive parameter from parameter context. For example:

1. Create parameter context with sensitive parameter
   
2. Create variable with name of this sensitive parameter #{sample}
   
3. Create simple flow with EL expression: ${secret:evaluateELString()}
   
4. Content of this flowfile will contain sensitive value from parameter
   

I suppose evaluateELString shouldn't access to sensitive parameters.

Issue Links

• causes: NIFI-11763 evaluateELString not evaluating ContextParameters
• links to: GitHub Pull Request #6562