Skip to main content
Inspiring
February 24, 2025
Question

cfchart issues in a security sandbox on ColdFusion 2021 Developer Edition

  • February 24, 2025
  • 1 reply
  • 208 views

A machine running ColdFusion 2021 Developer Edition has sandbox security enabled and the ColdFusion Lockdown Tool run. The following sandbox File/Dirs permissions have been granted:

 

  • %cfusion-root%/tmpCache/CFFileServlet/_cf_chart      Read,Write,Delete
  • %cfusion-root%/tmpCache/CFFileServlet/_cf_chart/*   Read,Write,Delete

 

A chart created using cfchart is causing a NullPointerException to be thrown (stack trace shown below), seemingly in the method call setUpWatermark().

 

Activating the server or disabling the sandbox causes the cfchart image to be displayed. In the latter case, the Not For Production Use watermark is shown.

 

Does anyone know what changes are required (perhaps additional sandbox permissions?) so the cfchart-generated image is displayed when sandbox security is enabled on a machine running the Developer Edition?

 

Thanks in advance.

 

java.lang.NullPointerException
at coldfusion.graph.InteractiveChart.setUpWatermark(InteractiveChart.java:328)
at coldfusion.graph.InteractiveChart.mergeJSON(InteractiveChart.java:452)
at coldfusion.tagext.io.ChartTag.doEndTag(ChartTag.java:1184)
at cfpathobfuscated2ecfm1167273304._factor3(path-obfuscated.cfm:106)
at cfpathobfuscated2ecfm1167273304._factor7(path-obfuscated.cfm:101)
at cfpathobfuscated2ecfm1167273304.runPage(path-obfuscated.cfm:1)
at coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:257)
at coldfusion.tagext.lang.IncludeTag.handlePageInvoke(IncludeTag.java:749)
at coldfusion.tagext.lang.IncludeTag.doStartTag(IncludeTag.java:578)
at coldfusion.filter.CfincludeFilter.invoke(CfincludeFilter.java:65)
at coldfusion.filter.ApplicationFilter.invoke(ApplicationFilter.java:573)
at coldfusion.filter.RequestMonitorFilter.invoke(RequestMonitorFilter.java:43)
at coldfusion.filter.MonitoringFilter.invoke(MonitoringFilter.java:40)
at coldfusion.filter.PathFilter.invoke(PathFilter.java:162)
[snip]

 

1 reply

BKBK
Community Expert
Community Expert
March 3, 2025

Some suggestions:

  1.  The two File/Dirs permissions you show might be redundant. You should use just one, the one ending with .../_cf_chart.
  2.  You should fill in the full path instead of %cfusion-root%. For example,  C:/ColdFusion2021/cfusion/tmpCache/CFFileServlet/_cf_chart.
  3.  If that doesn't resolve the issue then you could experiment by adding to the sandbox the path of the CFM or CFC page that generates the chart.