Skip to main content
S
Community Manager
Saurav_GhoshCommunity Manager
Community Manager
April 1, 2024
Question

View unscoped variables in a log file

  • April 1, 2024
  • 1 reply
  • 4097 views

Document history

  • 04/10/2024: The following are the changes to the log file:
    • The log files contain the name of the scope in which the variable exist.
    • Files included using cfinclude tag will be logged.

 

In the last security updates of ColdFusion (ColdFusion (2023 release) Update 7 and ColdFusion (2021 release) Update 13), Adobe released hotfixes that addressed scope injection vulnerabilities. See the tech notes for more information.

 

New patch update

 

Adobe has released a patch for ColdFusion (2023 release) and ColdFusion (2021 release) to help identify the unscoped variables in a log file, and take corrective actions.

 

The patch applies to ColdFusion (2023 release) Update 6 and higher, and ColdFusion (2021 release) Update 12 and higher. Adobe recommends you to be on Update 6 or higher and Update 12 or higher.

 

View the tech note for more information.

 

Please send us your feedback.

      This topic has been closed for replies.

      1 reply

      R
      rickmaz
      Inspiring
      April 1, 2024

      Gosh Adobe just messed this whole thing up. So complicated and never had to be. Now i am totally confused. To be clear, can someone please verify i have the right informatoin.

       

      1. UP until version 13 the default for searchimplicitscopes was TRUE?

      2. once you apply 13 it flips to false as default so if there was nothing set in jvm or application stuff could break.

      3. I i add the variable to application and set it to TRUE and upgrade to 13 my stuff should work exactly as needed and as before ?

      4. This new patch confused me but i think i understand now. If i am on update 12 in 2021 they say set variable to true in application and install and view the logs. But isn't it already true by default? if someone had it set to false wouldn't their stuff already break? is the patch just to see what errors would happen in 13 if you do not set variable to TRUE? i just don't see the reason in their instructions if i am on 12 to set things to true. I am doing that anyway because that is how it needs to be for 13? just so confusing

      S
      Adobe Employee
      satyam-mishra
      Adobe Employee
      April 1, 2024

      If i reply in a single line, for this patch to work, we need searchImplicitScope = true.

      CF-Version Default Value of searchimplicitscope Application Value of searchimplicitscope    
      2021 update below 13 or 2023 update below 7 TRUE Your application value might override default value by Application.cfc or Application.cfm if you have not overriden default value.Patch can be applied directly.But If you are overriding default value to make it false, before applying patch need to make searchimplicitscope=true   
               
      2021 update 13 or 2023 update 7 FALSE Application default  value can be overriden by jvm.args and Application.cfc and Application.cfm It is mandatory to override the default value and make searchimplicitscope=true by using jvm.args or application.cfm or application.cfc for this patch to work.  
      Charlie Arehart
      Charlie Arehart
      Community Expert
      April 4, 2024

      @Charlie Arehart 
      I don't think we have intentions to keep this logging feature in Cf going forward. For as many updates older(this may work with older updates ,but we have not tested) and upcoming , this patch works,  we are happy. 
      We don't intent to include this as part Cf server codebase. It impacts performance of widely used scope search.
      I think all admin settings for logs are still applicable.



      Thanks for that clarification, Satyam. Bad news/good news, I think.

       

      First, I hope that decision may be reconsidered (about whether this logging will work in future updates). Many people who are not yet on these recent updates (or indeed are still on older cf versions) will trip over this issue in the future, when updating/upgrading. If tthey can't get this logging help then, they'll need to be told to first stop at this update as an intermediary step, to do testing, which will be awkward in time.

       

      Some good news on this fix: I tested this hotfix with the current update and previous two (from Jan and Oct), and it worked with them (on both Cf2023 and cf2021). It did not work with the prior update (from Aug). 

       

      I also confirmed the hotfix only reports on unscoped vars that are NOT resolved in the local scopes, which means it won't overreport on EVERY unscoped var. Good to see that, and thanks. 

      /Charlie (troubleshooter, carehart. org)
      Terms & ConditionsAccessibility statement
      Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices