Issue with remove function parameters on CF 2023 Update 15

Hi @matthewl20646694 , thanks for the clarification. It confirms that my understanding of the intention of the code has been correct right from the start. However, I think I haven't yet convinced you that there are possible loopholes in the reasoning and in the design of your code. There actually are. They could do with some improvement. 

Before we get to the root-cause of the issue, let me show you that I understand what is going on. What I understand is essentially as follows. The code that is causing the issue involves a CFC, a test CFM and Application.cfm. The test CFM contains a link to a remote call to the CFC:

test.cfm

<!--- 
The query-string consists of the requested CFC method and 4 URL variables and their respective values.
The entire query-string is url-encoded, then encrypted.
The link represents a remote call to the CFC.
In the call, the query-string has been replaced by just one variable, EUData=#UrlEncodedEncryptedQueryString#,
--->
<CFSet queryString = "Method=TestFunc&Param1=Param1Value&Param2=Param2Value&Param3=Param3Value&Param4=Param4Value">
<CFSet encryptedQueryString = encrypt(queryString,"PjzF/tm6q3FB+jtYUsLXqzJMYsdCSBwd3cvtYfyTeuo=",'AES', 'Base64')>
<cfset UrlEncodedEncryptedQueryString = encodeForURL(encryptedQueryString)>
<CFOutput>
    The encrypted link:  <a href="./TestCFC.cfc?EUData=#UrlEncodedEncryptedQueryString#">Test Link</a><br>
</CFOutput>

TestCFC.cfc

<cfcomponent>
    <cffunction name="testfunc" access="remote" returntype="void">
	    <cfargument name="param1" required="yes">
    
    </cffunction>
</cfcomponent>

Application.cfm

<!---
The remote URL request is intercepted here.
The main (single) URL variable, EUData, is decrypted and its constituent parts extracted.

(Note: Though the constituent parts consist of the 5 name-value pairs from the original query-string in the test CFM, they are themselves NOT URL variables. 
The only URL variable ColdFusion knows at this point is URL.EUData.) 

The decrypted string is parsed, from which URL variables are set, among which, 

<cfset url.method = "testFunc">
<cfset url.param1= "Param1Value">
<cfset url.param2= "Param2Value">
<cfset url.param3= "Param3Value">
<cfset url.param4= "Param4Value">
--->

The issue: 

When you run test.cfm and click on the link, you get the error "The PARAM1 parameter to the testFunc function is required but was not passed in.". You're getting the error after Update 14 of ColdFusion 2023. The code worked without any issues on previous updates.

I hope that shows you I understand what the issue is. Then I will say that the cause of the issue is clear. Following Update 14 of ColdFusion 2023, remote CFC calls have become stricter. If the remotely invoked CFC method contains a required argument, then that argument must be present as one of the parameters in the query-string. Otherwise you will get an error.

Now comes what I consider to be the root cause of the error you're getting. In using Application.cfm to intercept the URL request, you're effectively doing a URL-rewrite. As far as ColdFusion is concerned, the only URL variable it knows is EUData. The variable URL.method does NOT yet exist.

The root cause is that, rightly or wrongly, ColdFusion is preprogrammed to validate the remote CFC method the moment url.method is defined. That is, the moment it encounters:

<cfset url.method = "testFunc">

 
That is what happens in your case. Apparently, that line of code confuses ColdFusion into thinking that method=testFunc is part of the query-string coming from the browser. But then it misses the required parameter. Hence the error.

Here's much simpler code to reproduce the behaviour:

test.cfm

<CFSet queryString = "Method=TestFunc&ParamX=ParamXValue">
<CFSet encryptedQueryString = encrypt(queryString,"PjzF/tm6q3FB+jtYUsLXqzJMYsdCSBwd3cvtYfyTeuo=",'AES', 'Base64')>
<cfset UrlEncodedEncryoptedQueryString = encodeForURL(encryptedQueryString)>
<CFOutput>
    The encrypted link:  <a href="./TestCFC.cfc?EUData=#UrlEncodedEncryoptedQueryString#">Test Link</a><br>
</CFOutput>

TestCFC.cfc

<cfcomponent>
    <cffunction name="testfunc" access="remote" returntype="void">
	    <cfargument name="paramX" required="yes">
    
    </cffunction>
</cfcomponent>

Application.cfc

<cfcomponent>
<cfset this.name = "RemoteCFCTestApp">

<cffunction name="onApplicationStart" returntype="boolean">
		
<cfreturn true>
</cffunction>

<cffunction name="onRequestStart" returntype="boolean">
 	<cfargument name = "targetPage" type="String" required="true"> 	

 	<!--- 
 	The next line automatically triggers validation of the remote call testFunc().
    If the function happens to have a required argument, you will get an error.
 	--->
 	<cfset url.method="testFunc">
 	<!---<cfset url.paramX="ParamXValue">--->
 		
 	<cfreturn true>
</cffunction>
 
</cfcomponent>

That such things happened "auto-magically" is a clear sign that you were taking risks. One little change or bug-fix in ColdFusion, and the whole pack of cards may come crashing down. 

As a workaround, here's one of my suggestions once again: include method=testFunc transparently in the link from the browser..That is,

• In test.cfm

Here is Encrypted link:  <a href="./TestCFC.cfc?method=testFunc&EUData=#encryptedURLData#">Test Link</a>

•  In TestCFC.cfc
  

<CFArgument name="EUData" required="yes">