Skip to main content
Y
yui8979
Inspiring
April 9, 2013
Question

Securing GraphData.cfm

  • April 9, 2013
  • 1 reply
  • 1008 views

Recently, some security audit testers have insisted that the error screen NOT BE SHOWN when /CFIDE/GraphData.cfm is called. They obtained the URL from one of our graph reports, which usually have a query string appended to it when called with CFCHART.

The resulting page is as attached, a Jrun Servlet Error 500 Internal Server Error page. They have categorized this under "Weaknesses in Error Handling mechanism" and insist that it should be improved.

My question is :

Without messing about with

1) IIS MOD REWRITE, or

2) Engage complicated methods to generate a CFCHART image (ie generate CFCHART, save it to a temporary directory, and re-displaying it without going through GraphData.cfm)

Is there a way to get Coldfusion to not display this error when the URL in question is called?

    This topic has been closed for replies.

    1 reply

    D
    Dan_Bracuk
    Inspiring
    April 9, 2013

    You can write an onError() function in your Application.cfc file. 

    Y
    yui8979Author
    Inspiring
    April 9, 2013

    Site handlers have been tried unsuccessfully. If you've noticed, the call to GraphData.cfm is via Coldfusion's own /CFIDE/.

    Why doesn't Adobe just handle the error properly since it is the one that created the GraphData.cfm alias?

    pete_freitag
    pete_freitag
    Participating Frequently
    April 10, 2013

    Since this error is thrown from a Servlet not CFML the CFML error handlers won't work.  You would need to use the error handling capabilities of the Servlet engine, eg add a custom error-page tag to the web.xml file, see: http://livedocs.adobe.com/jrun/4/Programmers_Guide/techniques_servlet12.htm

    --

    Pete Freitag

    Foundeo Inc. Makers of HackMyCF and FuseGuard

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices