[NIFI-7153] Limit length of component property values

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.11.1
• Fix Version/s: 1.12.0
• Component/s: Core Framework, Core UI
• Labels: security
• Assignee: Troy Melhase
• Reporter: Andy LoPresto
• Created: 14/Feb/20 21:21
• Updated: 13/Dec/21 18:16
• Resolved: 26/Mar/20 00:25

Description

Component properties can vary wildly in their use - some are integers or booleans, while others are simple names, and some can accept arbitrary schema definitions, code and config blocks, etc. There is no universal length limit that can be applied, so the general classes of property should have reasonable limits to avoid denial of service attacks through malicious setting of arbitrary property values.

Issue Links

• causes: NIFI-9481 Exclude HTTP Site-to-Site Communication from DoS Filter
• links to: GitHub Pull Request #4096
• links to: GitHub Pull Request #4125