[NIFI-11484] Fix CVE-2023-22832: Improper Restriction of XML External Entity References in ExtractCCDAAttributes

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Won't Do
• Affects Version/s: 1.19.0, 1.19.1
• Assignee: Unassigned
• Reporter: Jeyassri Balachandran
• Created: 26/Apr/23 09:13
• Updated: 28/Apr/23 08:22
• Resolved: 26/Apr/23 09:26

Description

Backporting the fix from nifi 1.20.

 

References: https://issues.apache.org/jira/browse/NIFI-11029

 
The ExtractCCDAAttributes Processor uses a custom CDAUtil class to load and parse the FlowFile InputStream. The CDAUtil class also includes a load method that takes a standard DOM Document. The Processor should be updated to use the standard nifi-xml-processing library for parsing the XML prior to calling CDAUtil.load.

In addition to implementing standard XML parsing, the ExtractCCDAAttributes Processor should be deprecated for removal because the implementation relies on outdated libraries, and the extensive use of FlowFile attributes does not align with best practices for record-oriented data handling.

Issue Links

• relates to: NIFI-11029 Add Standard XML Parsing to ExtractCCDAAttributes