Disable Java stacktrace under /flex2gateway mapping

[Guest]

Hello,

CF: ColdFusion 8.0.1 Entreprise

OS: Windows 2003 32 bits

WebServer: IIS6

I'm looking for a solution to disable stacktrace when a user call an URL like "/flex2gateway/something" ...

For the moment, here is what user can see:

500

No configured channel has an endpoint path '/flex2gateway/azeqsdwxc'.

javax.servlet.ServletException: No configured channel has an endpoint path '/flex2gateway/azeqsdwxc'.
     at coldfusion.filter.FlashRequestControlFilter.doFilter(FlashRequestControlFilter.java:87)
     at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46)
     at jrun.servlet.FilterChain.doFilter(FilterChain.java:94)
     at jrun.servlet.FilterChain.service(FilterChain.java:101)
     at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106)
     at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
     at jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:286)
     at jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:543)
     at jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.java:203)
     at jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java:320)
     at jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:428)
     at jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:266)
     at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)

We are asking to disable the stacktrace... and I need to keep the flex2gateway mapping for the Server Monitoring.

Is anyone know how to disable this information from ColdFusion (Not from the webserver) ?

Thanks!!

[Charlie Arehart]

Erloz, do you really want to "stop the stack trace"? Or don't you want to stop the error happening instead? The fact that CF drops some stack trace info when an error happens isn't that unusual.

I hear you saying you don't want to disable the flex2gateway mapping, for the server monitor. But are you saying you don't (personally) recognize the failing request (/flex2gateway/azeqsdwxc)? Is it at all meaningful to you?

If it is, then it would seem somehow something's not right that perhaps needs to be configured.

If it is not something you recognize, then perhaps you may want to find out what's sending the request (by looking in your IIS log for the IP address of the sender) and stop that from happening. There are even ways you can tell IIS to stop letting URLs through if they look like that, if you really want to go that far.

I will add that I just tested on both a CF8 and CF9 machine, using IIS 6 and 7 respectively, and when I make a request for a random gateway, like /flex2gateway/xx, I don't get the error you do (on screen, nor in the CF logs or CF runtime logs), which makes me think again there may be something unique about the config of your environment that's at play here.

For instance, take a look at the last edit date for the file where such gateway's can be defined (services-config.xml, in C:\coldfusion8\wwwroot\WEB-INF\flex). If there is no channel-definition element for that specific url, then it would be processed by the one for /flex2gateway/, which tries to execute the named thing as a CFC (if called via a flash remoting client). But even then, it should generate an error like "Unable to invoke CFC - Could not find the ColdFusion component or interface ".

Perhaps something in that file is otherwise in error. Hope that helps some.

/charlie

[Guest]

Thanks for you answer.

You are right, there is 2 differents points:

First:

It will be better if the error does not occured.

My services-config.xml is the default one. There is no specific channel-definition, that's why  the error is "No configured channel has an endpoint path '/flex2gateway/azeqsdpopm'".

I think the problem is in my web.xml, I have the following mapping:

    <servlet-mapping id="coldfusion_mapping_0">
        <servlet-name>MessageBrokerServlet</servlet-name>
        <url-pattern>/flex2gateway/*</url-pattern>
    </servlet-mapping>

By in my services-config.xml, the wildward is not handle.

What example of settings do you have about the flex2gateway in the web.xml and services-config.xml ?

Second:

We have security constraints, so that we are asking to disable all stacktrace information that can be displayed in our production server...  so I'm looking for a way to do it...

[Charlie Arehart]

Erloz, on your first point, I did agree that if there was no channel-definition for the named endpoint, then the default one (running it as a CFC) should handle it. That was why it seemed odd that you got an error for it. Anyway, my main point was to suggest you make sure there was nothing amiss in the config file, and you're saying it's the default, and that's good enough to move forward.

Glad you caught the point about the web.xml, too. There could certainly be an issue at play there.

Now, here's something odd: the text of your message in the email below is not exactly the same as the text in your message on the web forums. I don't know how that could happen (most of it is the same, but some is different). Below you ask to see the related xml entries on my end (for comparison, I suppose), but in the web-based message you do not.

FWIW, I'm happy to provide mine, but I can't attach them as email so would need to do it in reply on the forum. Since I wanted you (and others, interested) to see the body of the email as I got it, though, I'm offering this first note in reply to that, via email.

As for your second point, about stack tracing, again I am wondering if you're looking at this from the wrong angle. First, are you saying that end users see these error messages? Second, are they seeing it within Flex apps? Or web apps? I'll note that there is a setting in the CF Admin, on the debugging page (even if debugging is not enabled) which may be affecting you, "enable robust exception handling". Is that checked or not?

Finally, I had also asked if you recognize the failing request (/flex2gateway/azeqsdwxc). Just curious. Do you?

/charlie

[Charlie Arehart]

I said in my last note that I would attach 2 config files for Erloz to consider, but I can't find any way even in the web interface to do that. 🙂 Anyone know? Also, Erloz, perhaps you may confirm if in fact you do still want to see them.