cfdiv bind 404 error with updated encryption

[cf_isfun]

We have a shared cfc file that builds html elements, one of which calls a separate function in the file that builds a bound selection box. While testing a newer version of CF in our Dev environment we had been utilizing the following flag in our server settings:

Encryption - = -Dcoldfusion.encryption.useCFMX_COMPATAsDefault

Once we removed the flag, our bind element returns a 404 error, I assume due to the updated encryption in recent CF releases. 

Is there anything that needs to be done to make sure cfdiv bind will work with the udpated encryption?

[BKBK]

From the information you have provided so far, it is difficult to say what's to be done.

What is your ColdFusion version and update level? Is it possible for you to share some code with the forum?

[cf_isfun]

It looks like we are using enterprise version 2021.0.18.330341

We have a directory where we have many different forms. In a separate directory we have a lot of our shared CFC files with functions to build the form elements. 

So, in a cfm file we call a function where 'formObject' is the CFC file in the other directory:

<cfset someInput=formObject.getSomeInput("yCallout","job","job",variables.var1,variables.var2,variables.var3,variables.var4,variables.var5)/>
<div>#variables.someInput#</div>

The code in this function builds 4 form elements, one of which is bound to the others. It is called via a separate function in the same CFC file with this bind code: 

<div class="field">
<cfdiv id="input2Div" bind="cfc:ReportFormElements.displayBoundInput({chosenVar1},{chvar2},{chosenVar3},{chVar4})" bindOnLoad="True" />
</div>

This all functioned fine until we removed this flag:

Encryption - = -Dcoldfusion.encryption.useCFMX_COMPATAsDefault

With the flag removed, our code will only function if it is in the same directory from which it's being called. So, if we have 60 different forms, we now need to put this code in 60 different folders rather than being able to reference the single CFC we are currently using.

[BKBK]

Thanks for the extra information. So far, I cannot yet see any connection with encryption. However, one thing needs to be clarified. 

The flag to be used is not Encryption - = -Dcoldfusion.encryption.useCFMX_COMPATAsDefault . It is either

-Dcoldfusion.encryption.useCFMX_COMPATAsDefault=true

if you wish to use CFMX_COMPAT as the default encryption, or else,

-Dcoldfusion.encryption.useCFMX_COMPATAsDefault=false

if you don't.

That flag is to be added as one of the attributes of the java.args property in jvm.config. When the flag is not added, then ColdFusion defaults to the flag's default value, which is false.

So, set the flag as described here. Then restart ColdFusion, and see whether the problem disappears.

In any case, can you share the contents of your jvm.config file?

[cf_isfun]

Thanks for the reply.

We had the flag set to true and everything worked fine. In our Dev environments we are removing the flag because we are under the impression that at some point ColdFusion will not support the use of that flag. We are making sure all our code will still work when we have to remove the flag. Removing the flag breaks cfdiv bind and I was hoping there was a better solution than just putting the CFC with the bind in every single folder that needs to utitilize that code. 

[BKBK]

Your instincts are correct. The CFMX_COMPAT flag has been removed in ColdFusion 2025.

However, as I said, I don't yet see the link between bind and CFMX_COMPAT encryption. If you've found a link, can you please let me know.

I have been able to test the following cfc-bind application, without using the CFMX_COMPAT flag. It works as expected.

Try it yourself. Place all 3 files within the same directory. Then launch testpage.cfm in a browser.

The functionality is simple. When you click on a state, you automatically get a select-list of cities from that state.

<!--- CityState.cfc --->

<cfcomponent>
    <cffunction name="getXmlData" output="false" returntype="xml" access="private">
        <cfset var xmlData = "">
        <cffile action="read" file="#expandpath('.')#\states.xml" variable="xmlData">
        <cfset xmlData = XmlParse(xmlData)>
        <cfreturn xmlData>
    </cffunction>

    <cffunction name="getStates" access="remote" returntype="array">
        <cfset var state = arraynew(2)>
        <cfset var xmlData = getXmlData()>
        <cfset var numStates = 0>

        <cfset numStates = ArrayLen(xmlData.states.XmlChildren)>
		<cfset state[1][1] = "">
        <cfset state[1][2] = "== State ==">
        <cfloop from="1" to="#numStates#" index="j">
            <cfset state[j+1][1] = ltrim(xmlData.states.state[j].XmlAttributes.abr)>
            <cfset state[j+1][2] = ltrim(xmlData.states.state[j].name.xmlText)>
        </cfloop>
        <cfreturn state>
    </cffunction>

    <cffunction name="getCities" access="remote" returntype="array">
        <cfargument name="state" required="yes">
        <cfset var city = arraynew(2)>
        <cfset var xmlData = getXmlData()>
        <cfset var numStates = 0>
        <cfset var numCities = 0>

        <cftry>
            <cfset numStates = ArrayLen(xmlData.states.XmlChildren)>
			<cfset city[1][1] = "">
            <cfset city[1][2] = "== City ==">
            <cfloop from="1" to="#numStates#" index="j">
                <cfif xmlData.states.state[j].XmlAttributes.abr eq state>
                    <cfset numCities = ArrayLen(xmlData.states.state[j].cities.XmlChildren)>
                    <cfloop from="1" to="#numCities#" index="k">
                        <cfset city[k+1][1] =ltrim(xmlData.states.state[j].cities.city[k].XmlAttributes.name)>
                        <cfset city[k+1][2] = ltrim(xmlData.states.state[j].cities.city[k].XmlAttributes.name)>
                    </cfloop>
                    <cfbreak>
                </cfif>
            </cfloop>
        <cfcatch type="any">
            <cfdump var="#cfcatch#">
        </cfcatch>
        </cftry>
        <cfreturn city>
    </cffunction>

</cfcomponent>

states.xml

<states>
    <state abr="NJ">
        <name>New Jersey</name>
        <cities>
            <city name="Edison" />
            <city name="Rahway" />
            <city name="Atlantic City" />
            <city name="Hoboken" />
            <city name="Jersey City" />
            <city name="Newark" />
            <city name="Trenton" />
            <city name="Union City" />
        </cities>
    </state>
    <state abr="CA">
        <name>California</name>
        <cities>
            <city name="Anaheim" />
            <city name="Beverly Hills" />
            <city name="Elk Grove" />
            <city name="Fairfield" />
            <city name="Fremont" />
            <city name="Indian Wells" />
            <city name="Long Beach" />
        </cities>
    </state>
    <state abr="ME">
        <name>Maine</name>
        <cities>
            <city name="Augusta" />
        </cities>
    </state>
    <state abr="MA">
        <name>Massachusetts</name>
        <cities>
            <city name="Boston" /> 
            <city name="Cambridge" />        
        </cities>
    </state>
</states>

<!--- testpage.cfm --->

<cfform name="mycfform">
    <cfselect name="state" bind="cfc:citystate.getstates()" bindonload="true" >
    </cfselect>
    <cfselect name="city" bind="cfc:citystate.getcities({state})">
    </cfselect>
</cfform>

[BKBK]

Does any of your code use CFML functions associated with encryption, such as encrypt(), decrypt(), hash(), and so on?

[cf_isfun]

It does not. 

Just like with your code above, we are able to get cfdiv bind to work fine when all the files are in the same directory. That is the problem. We need them in separate directories because the code is shared by 60+ reports we have in separate folders. So, all of those directories point to one CFC file. It worked fine with the flag, but does not now that it is removed. So, to get it to work, I need to move that specifc CFC code in every directory that is using it. I believe is has something to do with ajax as another developer at our organization get the same issue when using cfajaxproxy. My gut feeling is that there is some sort of encryption done on ajax calls that CF did not update to their new encryption methods, in which case I'm SOL, but that's just a guess.

[BKBK]

Hi @cf_isfun ,

Thank you for your last explanation. I now, for the first time, completely undertand what the issue is. I shall now look into it with this new knowledge.

[BKBK]

I am unable to reproduce what you describe. I copied the CFC and XML in the above example from the test directory to a directory outside the project. I then created a new test page in the test directory as follows:

<!--- testpage2.cfm --->

<cfform name="mycfform">
    <cfselect name="state" bind="cfc:dotted.relative.path.from.root.to.cfc.located.in.new.dir.getstates()" bindonload="true" >
    </cfselect>
    <cfselect name="city" bind="cfc:dotted.relative.path.from.root.to.cfc.located.in.new.dir.getcities({state})">
    </cfselect>
</cfform>

When I launch testpage2.cfm in the browser, it works as expected.

Can you please share the errors that you get? Can you also share the contents of your jvm.config file?

[cf_isfun]

I tried your code and got it to work in the same directory, but when I moved the CFC to a different directory, I got the same error as I am with our binds. Assuming you are testing on a newer version of CF without the flag?

Unfortunately, I am in a larger organization and do mostly development. I am not able to include the jvm.config file.

Thank you for all your assistance. At this point I think I'm going to have to find a different work around in our CF environment.

[Dave Watts]

I don't see the complete CFC in your post, so I'm guessing it's the file doing the encryption. Can you post it?

[cf_isfun]

We're not actually doing any encryption code in our CFC. Removing that encryption flag just breaks the cfdiv bind when the cfdiv bind is not in the same directory as the source calling the functions. My assumption was that CF uses the encryption on the function calls when binding one element to a different function, and removing the flag messes that up.

[Dave Watts]

Are all of the files on a single CF server instance, or multiple instances? Have you tried deleting the caches of all the instances? Have you tried using folders which are only on one instance - for example, a subfolder of the current folder? Have you tried using absolute paths instead of relative paths? Have you tried using folders which are only on one instance - for example, a subfolder of the current folder? When you upgraded your production server to the latest version, did you delete all the files then? Are you using sandboxes in production? I mean, there are a lot of places to look here.

[BKBK]

@cf_isfun , I don't know of any such connection between CFMX_COMPAT encryption and CFC binding. As I said earlier, I think such a connection is unlikely. Let me explain why.

There are a number of encryption algorithms in ColdFusion. For example, AES, AES/CBC/PKCS5Padding, CFMX_COMPAT and DES, to name some. You are free to choose which encryption type to use.  I therefore think it is unlikely that the ColdFusion application server would have been designed in such a way that CFC binding is strongly coupled to the CFMX_COMPAT encryption algorithm.

To return to the issue at hand, the error message you show suggests a path error. So, on the server side, check ColdFusion's mappings settings. On the web server side, check the rewrite rules. See, for example, the Stackoverflow post on "Ajax to ColdFusion Remote .cfc returns 404 on different server".

Furthermore, CFC binding makes use of ColdFusion's UI functions. These in turn make use of the Javascript scripts installed by default in /wwwroot/cf_script/scripts/. (As you can see, "cfajax.js" is in fact mentioned in the error message). So ensure that the scripts directory is available to your application. 

[cf_isfun]

I agree it is unlikely, but at this point I'm not sure what else it could be. 

I'm positive paths, js, etc are fine because it works when that flag is set and doesn't when the flag is not set, without any other changes in code or settings. I can't see how setting that flag would resolve js or path issues if that were the problem.

[BKBK]

OK, since you're emphatic about the CFMX_COMPAT flag, let's look into it some more.  However, before we go any further, could you let me know if you did test one of my earlier suggestions?  Namely, adding

-Dcoldfusion.encryption.useCFMX_COMPATAsDefault=false

to jvm.config, instead of removing the flag entirely.

When you do, remember to restart ColdFusion.

[BKBK]

Hi @cf_isfun , I have been able to run the bind example on ColdFusion 2021, with the bound CFC being successfully accessed from two separate directories. The CFMX_COMPAT setting was not involved.

Here are the steps I followed:

1.  Download, install and update ColdFusion 2021

On Windows 10 Pro,  download ColdFusion 2021 from CFML Repo. After installing it, use the Package Manager utility in the ColdFusion Administrator to apply all updates. The final result is then ColdFusion 2021 Update 18.

2.  Check for CFMX_COMPAT in jvm.config

Check the contents of C:\ColdFusion2021\cfusion\bin\jvm.config. Confirm that it contains no CFMX_COMPAT setting.

3.  Create test project

Create a project directory at the following location: C:\ColdFusion2021\cfusion\wwwroot\workspace\CF_Project\.

Create 3 subdirectories within CF_Project: dir1, dir2 and dir3 .

Place in dir1 the three files from above, namely, CityState.cfc, states.xml and testpage.cfm.

Place in dir2 the following CFM file:

<!--- testpage2.cfm (in dir2) --->
<!--- 
Here workspace.cf_project.dir1.citystate is the 
dotted full path of the component, starting from the web root
--->
<cfform name="mycfform">
    <cfselect name="state" bind="cfc:workspace.cf_project.dir1.citystate.getstates()" bindonload="true">
    </cfselect>
    <cfselect name="city" bind="cfc:workspace.cf_project.dir1.citystate.getcities({state})">
    </cfselect>
</cfform>

   Place in dir 3 the following CFM file:

<!--- testpage3.cfm (in dir3) --->
<!--- 
Here myCFproject is a mapping set in the ColdFusion Administrator. 
It maps to the path C:/ColdFusion2021/cfusion/wwwroot/workspace/CF_Project/.
--->
<cfform name="mycfform">
    <cfselect name="state" bind="cfc:myCFproject.dir1.citystate.getstates()" bindonload="true">
    </cfselect>
    <cfselect name="city" bind="cfc:myCFproject.dir1.citystate.getcities({state})">
    </cfselect>
</cfform>

4.  Create mapping to path of project 

Open the ColdFusion Administrator and go to the Mappings page. 

Create the following mapping:

Logical Path:    /myCFProject 
Directory Path: C:/ColdFusion2021/cfusion/wwwroot/workspace/CF_Project/ 

That completes the setup of the project. 

To test, run testpage.cfm, testpage2.cfm and testpage3.cfm in turn. Each runs successfully, producing the expected result. Though all three are in separate directories, each has access to the CFC. The key is that each uses the correct path:

• testpage.cfm uses bind="cfc:citystate.getstates()", as testpage.cfm and CityState.cfc are in the same directory.
• testpage2.cfm uses bind="cfc:workspace.cf_project.dir1.citystate.getstates()", where workspace.cf_project.dir1.citystate is the CFC's dotted full path from the webroot.
• testpage3.cfm uses bind="cfc:mycfproject.dir1.citystate.getstates()", where mycfproject is the mapping of the path C:/ColdFusion2021/cfusion/wwwroot/workspace/CF_Project/

So, check whether each request uses the correct path to a CFC.

[cf_isfun]

Working with our server guy to try some of this.

Out of curiosity, in the CF admin caching tab, do you have 'Component cache' checked?

[BKBK]

When I installed ColdFusion 2021, "Cache template in request", "Component cache" and "Save class files" were checked by default.