Skip to main content
B
BG650
Inspiring
April 26, 2011
Question

CF8.0.1: cflayout broken after applying security hotfix APSB11-04

  • April 26, 2011
  • 1 reply
  • 2132 views

After applying hotfix APSB11-04, even this simple script fails:

<cflayout type="tab">

  <cflayoutarea title="blah">

    blah blah blah

  </cflayoutarea>

</cflayout>

The error in exception.log is:
org.owasp.esapi.errors.ValidationException: CFContainerID: Invalid input.
Please conform to: CFContainerID with a maximum length of 100
    at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:140)
    at org.owasp.esapi.reference.DefaultValidator.getValidInput(DefaultValidator.java:166)
    at coldfusion.security.ESAPIUtils.getValidateInput(ESAPIUtils.java:377)
    at coldfusion.tagext.html.ajax.HtmlAssembler.setContainerId(HtmlAssembler.java:543)
    at coldfusion.tagext.html.ajax.LayoutAreaTag.doStartTag(LayoutAreaTag.java:492)

Is it just me? (We have sandbox security enabled.)

    This topic has been closed for replies.

    1 reply

    B
    BG650Author
    Inspiring
    April 26, 2011

    A few more details:

    The problem does indeed seem to be specific to sandbox security.

    If I disable sandbox security, the error goes away.

    The errors are being logged in "esapi.log" which I have never seen before.

    I'm fairly certain that these files from the update are involved:

         lib/ESAPI-1.4.4.jar

         lib/ESAPI.properties

    The latter file is a text file, so I wonder if it can be tweaked to avoid the error?

    Charlie Arehart
    Community Expert
    Charlie ArehartCommunity Expert
    Community Expert
    April 28, 2011

    I see many people burned because during the extraction of the files from the zip, they don't notice that their zip tool may extract them into the directory you name, but then it recreates the subdirectory structure of the zip file, so that a file does not end in the directory you name, but several levels below that. For instance, with respect to that jar, make sure it is in lib, and not in some deep subdirectory under it.

    I'd also recommend going back and checking that for any and all hotfixes you may have applied.

    /charlie

    /Charlie (troubleshooter, carehart. org)
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices