cfchart issues in a security sandbox on ColdFusion 2021 Developer Edition

[Aidan Whitehall]

A machine running ColdFusion 2021 Developer Edition has sandbox security enabled and the ColdFusion Lockdown Tool run. The following sandbox File/Dirs permissions have been granted:

• %cfusion-root%/tmpCache/CFFileServlet/_cf_chart      Read,Write,Delete
• %cfusion-root%/tmpCache/CFFileServlet/_cf_chart/*   Read,Write,Delete

A chart created using cfchart is causing a NullPointerException to be thrown (stack trace shown below), seemingly in the method call setUpWatermark().

Activating the server or disabling the sandbox causes the cfchart image to be displayed. In the latter case, the Not For Production Use watermark is shown.

Does anyone know what changes are required (perhaps additional sandbox permissions?) so the cfchart-generated image is displayed when sandbox security is enabled on a machine running the Developer Edition?

Thanks in advance.

java.lang.NullPointerException
at coldfusion.graph.InteractiveChart.setUpWatermark(InteractiveChart.java:328)
at coldfusion.graph.InteractiveChart.mergeJSON(InteractiveChart.java:452)
at coldfusion.tagext.io.ChartTag.doEndTag(ChartTag.java:1184)
at cfpathobfuscated2ecfm1167273304._factor3(path-obfuscated.cfm:106)
at cfpathobfuscated2ecfm1167273304._factor7(path-obfuscated.cfm:101)
at cfpathobfuscated2ecfm1167273304.runPage(path-obfuscated.cfm:1)
at coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:257)
at coldfusion.tagext.lang.IncludeTag.handlePageInvoke(IncludeTag.java:749)
at coldfusion.tagext.lang.IncludeTag.doStartTag(IncludeTag.java:578)
at coldfusion.filter.CfincludeFilter.invoke(CfincludeFilter.java:65)
at coldfusion.filter.ApplicationFilter.invoke(ApplicationFilter.java:573)
at coldfusion.filter.RequestMonitorFilter.invoke(RequestMonitorFilter.java:43)
at coldfusion.filter.MonitoringFilter.invoke(MonitoringFilter.java:40)
at coldfusion.filter.PathFilter.invoke(PathFilter.java:162)
[snip]

[BKBK]

Some suggestions:

1.  The two File/Dirs permissions you show might be redundant. You should use just one, the one ending with .../_cf_chart.
2.  You should fill in the full path instead of %cfusion-root%. For example,  C:/ColdFusion2021/cfusion/tmpCache/CFFileServlet/_cf_chart.
3.  If that doesn't resolve the issue then you could experiment by adding to the sandbox the path of the CFM or CFC page that generates the chart.