Random String Index Out of Range Errors

[yakitori_33]

Hi There,

I have an issue with our application where we keep getting String Index Out of Range errors when we do a Replace call with some legacy code.

Overview:

We are using a custom tag called cf_html which basically generates the container for the content (doc type, html, head, title, meta, body, form tags, toolbar).

So we would call it like this:

<cf_html title="Invoice" toolbar="view">

     blah blah blah blah

     some content

</cf_html>

We host thousands of customers who have their own websites. Our customer  sites are created as www.mysite.com in which case customer images  uploaded by mysite.com will be stored on our file servers in the  m/my/mys/mysite folder. If I had another site called www.anothersite.com image would be stored in a/an/ano/anothersite/ folder. We have some rewrite rules that will convert the path www.mysite.com/image.jpg to go into the /m/my/mys/mysite/ folder in our file system to get the image.jpg file.

All the customer sites hosted on our servers share a common secure url (https://securepage.com) for things like checkout (https://securepage.com/checkout.html)

So if you click on the checkout button on www.mysite.com, it will be redirected to https://securepage.com/checkout.html

Problem:

From what I understand of the code, inside the cf_html tage we have some Replace functions that search for certain directory paths (/f/, /i/, /t/) in the content and convert it to the secure version if the page is secure. We do this because this image <img src=''www.mysite.com/image.jpg /> would be fine on a non secure page (http://www.mysite.com/products.html) but on a secure page (https://securepage.com/checkout.html) the browser will give a unsecure warning regarding the image.

The replace is as follows:

<cfset start = Replace(content, '/f/', '/secureImage.cfm/#siteName#/f/','all') />

<cfset start = Replace(content, '/i/', '/secureImage.cfm/#siteName#/i/','all') />

<cfset start = Replace(content, '/t/', '/secureImage.cfm/#siteName#/t/','all') />

So the image http://www.mysite.com/f/image.jpg will be converted to http://www.mysite.com/secureImage.cfm/mysite.com/f/image.jpg

And the image https://securepage.com/f/image.jpg will be converted to https://securepage.com/secureImage.cfm/mysite.com/f/image.jpg

The secureImage.cfm file will take the /f/ in the url to know it needs to look in the /f/ folder. It will also take the #siteName# (ex. mysite.com) from the url and know that it needs to go to get the image from /m/my/mys/mysite/ folder and that the image is called image.jpg.

The secureImage.cfm will get the file from the proper directory and do a <cfcontent type="image/jpg" file="#image#"> to display the image.

For some reason the first replace of '/f/' passes but the second one replacing the '/i/' gives a String Index Out of Range with a high number like 15720.

The mysterious thing is, it doesn't happen all the time. In fact, I am having trouble replicating the issue but it constantly comes up in our error logs for different customer sites. Even if I visit the exact URL in the error logs the page works fine. I've been trying to solve this problem for awhile now but no luck so far. Since I can't replicate it and it happens randomly, it's becoming a really frustrating bug.

Are there any variable scoping issues inside custom tags like how you must var scope variable in cfc's? Any methods to replicate the issue?

Any help will be greatly appreciated.

[BKBK]

Might be a bug. In any case, I am sure Coldfusion will have no problems if you rewrite it as follows:

<cfset replaceString1 =  "/i/">
<cfset replaceString2 = "/secureImage.cfm/" & siteName & "/i/">
<cfset start = ReplaceNoCase(content, replaceString1, replaceString2, "all")>

[yakitori_33]

Thanks BKBK for your response.

We changed the code as you  suggested, setting the string to the variable and using those variables  in the ReplaceNoCase and we just rolled it yesterday.

Unfortunately  it didn`t fix the errors as our error logs continually receive `String  index out of range` errors referring to the same replace code.

Any other suggestions? This is a frustrating but because we can`t replicate it.

[BKBK]

yakitori_33 wrote:

We changed the code as you  suggested, setting the string to the variable and using those variables  in the ReplaceNoCase and we just rolled it yesterday.

Unfortunately  it didn`t fix the errors as our error logs continually receive `String  index out of range` errors referring to the same replace code.

Any other suggestions? This is a frustrating but because we can`t replicate it.

Assuming this isn't a bug, then the likely cause of the problem is the variable, content, in the line:

<cfset start = ReplaceNoCase(content, replaceString1, replaceString2, "all")>

It might be bringing in strange or unexpected characters. Log the value, for example by placing the following code just before the troublesome line:

<cflog file="test" text="#content#">

[yakitori_33]

Thanks BKBK,

I`ll try to log the content and see if there`s anything strange contained in the content.

I know that the content can be fairly large because it is the html code used to generate the page. Do you know if there are any limitations on the ReplaceNoCase function of how long the string can be?

Thanks

[BKBK]

yakitori_33 wrote:

... the content can be fairly large because it is the html code used to generate the page. Do you know if there are any limitations on the ReplaceNoCase function of how long the string can be?

It all seems clear now. The cause of the exception is most likely the content variable. ReplaceNoCase has no length limitation, at least, none that I know of. Even if it had, it would be a large number of characters. In fact, I have just tested ReplaceNoCase with text of around 50 000 characters. No problems.

However, in my test, I used continuous text consisting exclusively of alphanumeric characters, spaces, commas, and full-stops. A combination of quotes and commas in the content variable will likely cause problems, because commas and quotes are needed to separate the parameters in the ReplaceNoCase function. I can imagine that, in your case, there are lots of double quotes or single quotes, and commas, in the string variable. That might explain your observation, "String Index Out of Range with a high number like 15720". You might just be passing too many arguments to the function!

I got inspired by my solution to a related problem I myself have had today. My suggestion is to use REReplaceNoCase instead. For example, do the replacement only within URLs.