Coldfusion 2021 Update 5 breaks xml

[gabrieldavis321]

I just applied update 5 and now I am getting XML errors:

"Error","ajp-nio-127.0.0.1-8020-exec-10","10/13/22","11:28:42","Medlists3","coldfusion.runtime.CFPage.XmlSearch(Lcoldfusion/xml/XmlNodeList;Ljava/lang/String;)Ljava/lang/Object;

https://helpx.adobe.com/coldfusion/kb/coldfusion-2021-update-5.html says

CHANGE IN XML

If the XML path contains a forward slash or backslash, it will be blocked. The flag, coldfusion.xml.allowPathCharacters, must be set to true to allow the same.

But I don't know where to make this change.

[michaelg11604920]

clearing \ColdFusion2021\{instances}\wwwroot\WEB-INF\cfclasses worked for me. Thanks. Adobe updates are always an adventure, and not in a good way.. Didn't catch this until it was in production.

[Charlie Arehart]

Yes, Michael. And it doesn't help that the suggestion to clear the cfclasses is only in the cf2018 update 15 technote, which is quite unfortunate.

And back to an earlier comment in this thread, there's also no clarification about which cfml xml features/functions are impacted by these changes, whether the need to do that class clearing or adding the jvm arg (discussed in both technotes). 

[Brad Hogg_51]

Hello All,

I can confirm, for CF2018 at least, that the jvm argument is only needed when using xmlTransform().  It is not needed if you are only using xmlSearch().  Clearing the classes was indeed necessary however.  We use a ton of XML, so I can say this quite confidently.

Thanks,

Brad

[michaelg11604920]

Appears to be the same for 2021. We use xmlSearch a lot, but not xmlTransform. Removing this flag doesn't cause any issues for us. Clearing the classes fixed everything.