Hi @gabrieldavis321 ,
Thanks for the update.
Hi BKBK and Charlie,
First I would like to thank you both for your help. I believe we found the root cause and it WAS code. There was a function to scrub passwords from structs so that we could safely create error handling emails with dumps of form, request and CGI and not have the password displayed. Below is from the developer:
I think this was a subtle difference between CF2016 and CF2021 in the way it handles copying structs inside a function. Let me explain a little further…
Looking at the sanitizeStruct function, the first line says:
<cfset var retVal = arguments.sourceStruct/>
In CF2016, the expectation was that this was creating a local copy of the passed struct (in our case the CGI scope). So later in the function when we clear the struct:
<cfset structClear(local.retVal)/>
It was safe because we were clearing the LOCAL copy and not the original struct.
It seems that in CF2021, when we create out local variable, it must not be creating a pointer instead of a local COPY. So later when we clear the struct, in CF2021, it seems to be clearing the original CGI scope.
I think this could possible be solved by changing this line:
<cfset var retVal = arguments.sourceStruct/>
To be this:
<cfset var retVal = Duplicate(arguments.sourceStruct)/>
This would ensure that the local variable is a duplicate of the passed struct instead of a reference to it."