How to disable Log4j Visualizer from Nexus Welcome page

sameer29nov · July 20, 2022, 4:52pm

Hello Team,

I am building nexus container with latest version but I don’t want popup message for log4j visualizer at Nexus Welcome page , is there any setting I can enable/disable to disable that warning

I tried to comment here

github.com

sonatype/nexus-public/blob/0da1f75f64137a453504ea52dd2519270afc8fc9/plugins/nexus-coreui-plugin/src/main/resources/static/rapture/NX/coreui/controller/Outreach.js#L148

      
        
            log4jDisclaimerAvailable = response.data === 'false';
            var user = NX.State.getUser();
            if (user && user.administrator) {
              welcomePage.add({
                xtype: 'container',
                id: 'log4jDisclaimer',
                hidden: !log4jDisclaimerAvailable,
                style: {
                  padding: '24px'
                },
                html:
                    '<div id="log4j" class="nx-log4j-disclaimer">' +
                    // TODO close btn is disabled due to some UI issues
                    ' <div class="dismiss" style="display: none"><a href="javascript:;" onclick=""><i class="fa fa-times-circle nx-log4j-close"></i></a></div>' +
                    ' <i class="fa fa-exclamation-triangle nx-log4j-warning-icon"></i>' +
                    ' <div class="nx-log4j-disclaimer-text">In response to the log4j vulnerability identified in <a href="https://ossindex.sonatype.org/vulnerability/f0ac54b6-9b81-45bb-99a4-e6cb54749f9d" target="_blank">CVE-2021-44228</a> (also known as "log4shell") impacting organizations world-wide, we are providing an experimental Log4j Visualizer capability to help our users identify log4j downloads impacted by CVE-2021-44228 so that they can mitigate the impact. Note that enabling this capability may impact Nexus Repository performance. Also note that the visualizer does not currently identify or track other log4j vulnerabilities.<div>' +
                    ' <div><a class="nx-log4j-button" href="#admin/repository/insightfrontend" style="color: white">Enable Capability</a></div> ' +
                    '</div>',
                listeners: {
                  render: function(doc) {
                    doc.el.dom.getElementsByClassName('nx-log4j-button')[0].addEventListener('click', function(event) {

Which is part of the “nexus-coreui-plugin” ( see nexus-public/plugins/nexus-coreui-plugin at release-3.38.0-01 · sonatype/nexus-public · GitHub

but it will be helpful if anyone can direct me to correct file, I know its weird request but that pop is not allowing us to do some automation testing,

Please guide

Regards
SAMURAI

glee · July 25, 2022, 8:04pm

Hi Sameer,

Thank you for posting this. This is something we are aware of, and our team is currently looking into this. Sorry for any inconvenience this has caused.

Best regards,
Grace

sameer29nov · July 26, 2022, 8:35am

Hello Grace @glee ,

I have done workaround by disabling outreach plugin by commenting it in this file /sonatype/nexus/assemblies/nexus-oss-feature/3.39.0-01/nexus-oss-feature-3.39.0-01-features.xml

for now its ok for us, since outreach doesn’t harm if we disable

but thank you for your support & time