cfcompile jsafeJCE Error

[delroy_3222]

Been banging my head against this server for a few days now. We are currently working with ColdFusion 2021 on update 21.

While using cfcompile, we received an error concerning jsafe not being found. From what I can find, update 14 phased this encryption out in favor of a more modern standard. The problem I'm finding is I cant get around this error. The jsafejce.jar file is also missign from the coldfusion directory. See below.

java.lang.reflect.InvocationTargetException

at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.base/java.lang.reflect.Method.invoke(Method.java:566)

at coldfusion.tools.CommandLineInvoker.main(CommandLineInvoker.java:112)

Caused by: java.lang.NoClassDefFoundError: com/rsa/jsafe/provider/JsafeJCE

at coldfusion.security.AbstractCfPathValidator.<clinit>(AbstractCfPathValidator.java:42)

at coldfusion.compiler.NeoTranslator.<clinit>(NeoTranslator.java:73)

at coldfusion.tools.Compiler.main(Compiler.java:287)

... 5 more

Caused by: java.lang.ClassNotFoundException: com.rsa.jsafe.provider.JsafeJCE

at coldfusion.bootstrap.BootstrapClassLoader.loadClass(BootstrapClassLoader.java:303)

at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)

... 8 more

[delroy_3222]

Of course right after I submit this as my last resort, I think I solved it. I was able to copy a cryptojce.jar file from \cfusion\wwwroot\WEB-INF\lib to \cfusion\lib and that resolved the cfcompile error and the application compiled as intended.

 

[Charlie Arehart]

Glad you've solved it and thanks for that update. That said, I had started writing up this before seeing your reply :-), so I'll go ahead and share it in case it may help you, Adobe, or others.

1) First, can you confirm that this problem is happening when you RUN cfcompile? (I'm assuming that becasue your error refers to "CommandLineInvoker".)

1a) If so, it may interest you to hear that I am NOT experiencing the same inability to run cfcompile on CF2021 update 21. (FWIW, I had updated from update 20. How about you? It might make a difference if you jumped from some much older update.)

1b) As for it failing for you (and your need to copy that jar), I wonder if perhaps you may have had an error during the update (tracked in the install log for the update, within cfusion/hf-updates), or in downloading package updates (tracked at the bottom of that log), or upon updating the packages (tracked during CF startup in the coldfusion-out.log).

1c) One other thing I would have proposed was that you see if stopping CF and deleting the cfusion/bin/felix-cache folder (then restarting CF, which would recreate it) might have fixed your probem. But I get it that your copy step was sufficient for you. I share this as much for other readers.

2) All that said, for you I also want to clarify that you referred to the June 2024 CF update (in your case, CF2021 update 14) that "phased out encryption". But what you're referring to here is the use of the cfcompile tool, which technically has nothing to do with that encryption change. Still, there's ANOTHER recent change related to cfcompile that you SHOULD know about.

(For readers not familiar with it, note that the cfcompile tool--found in cfusion/bin, as a bat file in Windows or an sh for Mac/Linux--was added in CF7, to allow one to manually compile CFML pages in such a way that the CFM file in your source directory is actually REPLACED with the bytecode CF would normally store and run from cfusion/wwwroot/WEB-INF/cfclasses. It's a form of obfuscation.)

3) Anyway, what may be important for you to hear is that with the April 2025 CF updates (in your case, CF2021 update 19), Adobe has CHANGED CF to default to NOT BE ABLE TO EXECUTE such cfcompile'd code. So while you have gotten your cfcompile to work, via the tweak you did, can you confirm if you can RUN that code?

3a) Note that the same Apr 2025 update also added a new JVM arg that would ALLOW YOU to let CF still run such cfcompile'd code. It's:

-Dcoldfusion.compiler.block.bytecode=false

3b) They also added then a new pathfilter.txt file (in cfusion/lib) that would allow you to name a folder of such files to allow, then in the May update that was changed to instead a pathfilter.json file (which also is used to allow scheduled tasks to "publish" their output.) Just beware that in the FOLLOWING update sadly CF resets those pathfilter files back to their empty default values. 😞

Anyway, I just wanted to offer this heads-up about cfcompile. (And on a related note, that April 2025 CF update also removed the old cfencode tool--a still older way to obfuscate code--and they removed also the ability of CF to RUN such cfencoded templates, with a JVM arg to revert that also.)  BTW, the cfcompile tool does indeed still remain in CF, even after this update.

4) As such, again it's certainly interesting that you had to make that tweak of copying that jar. If you might have another server where you'll update CF, or if others might experience it, and if you/they confirm there are no update errors in the logs, and you/they confirm that the cfcompile tool still fails even with felix-cache deleted, it would seem helpful to report it as a bug, at tracker.adobe.com. (Adobe may not see you reporting the problem here, of if they do they tend not to fix things raised here unless a bug report is opened...and they do indeed fix things based on those tracker bug reports--though not EVERY bug reported, of course.) 

If you do (or anyone else does) file a bug, please add the link here so that others finding this discussion can view it, add votes, get notified of changes as the bug may be fixed.

Hope all that additional info is helpful, to you or other readers. 

[delroy_3222]

1) Yes, I'm running it from another bat file that mostly just copies some files and handles some clean up at the end. Besides that, there is a command to run cfcompile.

1a) Interesting. I did indeed update from 18 to 21.

1b) No errors of note to report.

1c) I did clear the felix-cache thinking along the same lines.

2) Ah this makes more sense. Apologies for the confusion.

3a,b) I did come across this in my pursuit of answers and was able to include this in my jvm arg and can confirm that it works as expected. I attempted to add the directories to the pathfilter.json to no effect.

Thank you much for the information and time to help troubleshoot this issue.

[Charlie Arehart]

Glad to have helped. As for your last point, had you been careful about the path separators? As shown in the file, they must be forward slashes even on Windows. And the drive letter and path are case-sensitive. 

[Charlie Arehart]

@delroy_3222, did you get a chance to try the pathfilter.json with the clarifications I shared. Is it working now for you, even if just as a test?