27
Replies
Thanks for clarifying, @matthewl20646694 . I now understand better what the issue is, and that it has been confirmed to be a bug..
That said, I still have some suggestions.
- Use Application.cfc in place of Application.cfm. I don't fully understand what is going on in Application.cfm, but I can see that its contents are better suited to Application.cfc, as the CFC is event-driven. The code shows clearly that you want a function to run when a request to a predefined target page starts. With Application.cfc you can precisely time the occurrence of such an event.
I shall put the Application.cfm to one side. To enable me to proceed with the testing of test.cfm I shall replace#request.ParameterEncryptionKey#
with#generateSecretKey('AES')# - I think your test.cfm code example could benefit from some simplication. At the moment, too many different variables are bundled together in a single line.
For example, the variable tmpURLData is compounded so often that, in the end, it's unclear what it stands for.
Therefore, it would help to separate the various variables involved. I shall do so in a moment. - Even though the data in tmpURLData is initially url-encoded, it is subsequently url-encoded, and again, unnecessarily.
- The purpose of the variable EUData is unclear. A remote CFC call should usually include, as a standard, the variable method=methodName . Whereas your first link does not. There the EUData value is something like
EUData=#encrypted_string_that_has_been_encoded_for_URL#There is no method=TestFunc, which can be a problem. We therefore need to add it.
- Apparently, EUData is central to what you want to do in the Application file. As you are already aware, ColdFusion has become stricter with regard to the remote calling of CFC methods. If EUData must be in the remote call, then the function must explicitly have
<CFArgument name="EUData" required="yes">And vice versa.
The above suggestions result in the following test code:<--- TestCFC.cfc ---> <cfcomponent> <cffunction name="TestFunc" access="remote" output="yes" returntype="void"> <CFArgument name="EUData" required="yes"> <CFArgument name="Param1" required="no"> <CFArgument name="Param2" required="no"> <CFArgument name="DataExpiration" required="no"> <cfdump var="#arguments#" > </cffunction> </cfcomponent><!--- test.cfm ---> <CFTry> <CFSet tmpURLData="Method=TestFunc&Param1=Test&DataExpiration=#encodeForURL(DateFormat(dateAdd('h', 1, NOW()), 'mm/dd/yyyy') & ' ' & timeFormat(dateAdd('h', 1, NOW()), 'HH:mm'))#"> <CFSet randomizedURLData="R=#randrange(100,999)#&#tmpURLData#"> <CFSet encryptedURLData = encrypt(randomizedURLData,"#generateSecretKey('AES')#",'AES', 'Base64')> <CFOutput> Here is Encrypted link: <a href="./TestCFC.cfc?method=TestFunc&EUDATA=#encryptedURLData#">Test Link</a><br> Here is Encrypted link with Extra Parameter: <a href="./TestCFC.cfc?#tmpURLData#&Param2=something&EUDATA=#encryptedURLData#">Test Link</a><br> Non Encrypted link: <a href="./TestCFC.cfc?Method=TestFunc&Param1=Test&EUDATA=#encryptedURLData#">Test Link</a><br> Non Encrypted link with Extra: <a href="./TestCFC.cfc?Method=TestFunc&Param1=Test&Param2=something&EUDATA=#encryptedURLData#">Test Link</a><br> </CFOutput> <br><br> <cfloop collection="#StructToSorted(server.system.properties,"text","asc")#" item="key"> <cfif key.startswith("coldfusion.") and not key is "coldfusion.classpath"> <cfif listfind("coldfusion.home,coldfusion.jsafe.defaultalgo,coldfusion.libPath,coldfusion.rootDir",key)>*</cfif> <cfoutput>#key# = #server.system.properties[key]#</cfoutput><br> </cfif> </cfloop> <CFCAtch type="any"> <CFdump var="#CFCatch#"> </CFCAtch> </CFTry>
EUData is designed to be an encrypted string that has regular key/value URL pairs of data encrypted with in. So the link would look like:
By @matthewl20646694
TestCFC.cfc?EUData=ui9eTHvdhYo6opbyLfU2rGKmBsa1%2FbYY7diE3BJ607HdztvuoEW6UcHTmH5ehV%2FFEKlO0eisUGYKXHeBfxyx5GXd0vqgq%2BmvICY%2BT3E%2FXdU%3D
I did understand that. I hope you can see it implies the following: calling a CFC remotely without passing the method. That might be a problem.
I suggested the following correction, which contains the essence of your code:
- In test.cfm
Here is Encrypted link: <a href="./TestCFC.cfc?method=TestFunc&EUDATA=#encryptedURLData#">Test Link</a>- In TestCFC.cfc
<CFArgument name="EUData" required="yes">
I am surprised you start by saying, "I do not think that is true. " After that, you actually proceed to reproduce the exact situation I had described.
In short, the root-cause is:
In the ColdFusion build where you encounter the issue, the line
<!---
Remotely requested CFC method which has at least one "required" argument
--->
<cfset url.method="testFunc">automatically triggers ColdFusion to validate the method for required arguments.
Your conclusion is:
... it gives the same error about " The PARAM1 parameter to the TestFunc function is required but was not passed in.". So it gets the METHOD name from where I set it in the application.cfc, but it does not get/read the parameters set there.
By @matthewl20646694
That is the same as my conclusion about the root-cause:
"The root cause is that, rightly or wrongly, ColdFusion is preprogrammed to validate the remote CFC method the moment url.method is defined. That is, the moment it encounters:
<cfset url.method = "testFunc">
That is what happens in your case. Apparently, that line of code confuses ColdFusion into thinking that method=testFunc is part of the query-string coming from the browser. But then it misses the required parameter. Hence the error."
As I said, it might help to share my latest explanation with your contact at Adobe. They should be aware that, in the latest ColdFusion 2023 build, the assignment url.method = "myMethod" automatically triggers validation of the method. They could then tell you whether that is an intentional change, or an unintentional side-effect or bug that needs to be fixed..
I have switcxhed over to using application.cfc, to see if that made a difference.
By @matthewl20646694
To be clear, switching from Application.cfm to Application.cfc improves the design of your code. However, the switch does not influence the behaviour we have been discussing.
AdChoices