Coldfusion erroneously removing spaces after "<<"

[yui8979]

Hi,

I've encountered an issue where I am puzzled by coldfusion's output. Is this a bug, or the design?

<cfset x="meow">

<textarea><cfoutput>< #x#</cfoutput></textarea><br>

<textarea><cfoutput>< meow</cfoutput></textarea><br>

<textarea><cfoutput>x #x#</cfoutput></textarea><br>

<textarea><cfoutput>x meow</cfoutput></textarea><br>

In the above, I expect the output to be :

<[space]meow

<[space]meow

x[space]meow

x[space]meow

But the result I am getting is :

<meow

<[space]meow

x[space]meow

x[space]meow

Where the variable output in the sequence of <[space][variable] promptly cuts off my space. If it is whitespace management kicking into affect, the 4th output should have spaces removed as well but that is not the case. Changing whitespace management gives the same result. Please help .... This looks like a bug? Or is it supposed to be like this? Of course I could move the <cfoutput> tag around to preserve the space but this shouldn't be happening in the first place, right?

Coldfusion Version : 9.0.1 and 11

[haxtbh]

This could be to do with Global Script Protection. It can be changed in the settings section of the CF admin. Its used to prevent XSS attacks so you wouldnt really want it turned off.

A better alternative is to use html entity values. This stops there being any confusion and keeps the output uniform. For example for a left and right bracket like you are using you would use &lt; (this is <) or &gt; (this is >). Most punctuation and non alpha characters have these entities - Character Entity Reference Chart

[BKBK]

Curious indeed. But not funny. Please report a bug.