A

Anonymous

Answered

Coldfusion 10 Case Sensitive URLs?!?

Forum|Forum|13 years ago
May 17, 2012
10 replies
20115 views

I just migrated my CF8 site to CF10 (development only, thankfully!) and noticed that all sorts of issues were occuring with missing images. It appears that, after over a decade of "test.html" being the same as "TEST.HTML", the adoption of Tomcat has killed that. A link to "MyImage.jpg" will not bring up "myimage.jpg".

Please tell me I'm wrong or, better still, tell me a way to turn off case sensitivity in the Tomcat system. My application has thousands of templates (each with multiple links) and I'm not very happy about the idea of having to go in, page by page, and standardize their casing.

Server administration

This topic has been closed for replies.

Correct answer

I'm happy to report that somebody has found a workaround. I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.

From Chad Baloga on HouseOfFusion:

"

Found out how..

look for context.xml under {drive}\ColdFusion10\cfusion\runtime\conf

Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">

Restart the CF service
"

Why you set it to "true" and not to "false" is beyond me. But I'm not too concerned. It works, which means that I don't need to update thousands of templates nor do I have to install IIS right now.

G

Goliath Development

Inspiring

This changed again in Coldfusion 2016 and the previous fix isn't working. If anyone has a workaround - please post.

Thank you!

C

coolcf69663051

Participant

Add the blow line after <Context> tag

Restart CF.

Note from Tomcat about this flag.

If the value of this flag is true, symlinks will be allowed inside the web application, pointing to resources outside the web application base path. If not specified, the default value of the flag is false.

NOTE: This flag MUST NOT be set to true on the Windows platform (or any other OS which does not have a case sensitive filesystem), as it will disable case sensitivity checks, allowing JSP source code disclosure, among other security problems.

S

SBramAtWork

Participant

I stumbled onto the solution just before reading this but wanted to confirm for others that it does work on ColdFusion 2016 running Apache Tomcat 8.5.x, although you probably want to self-close it to be safe (for XML reasons):

...

...

And just FYI, caseSensitive="true" (as seen in the solution for older versions) is not missing/necessary, i.e., <Resources allowLinking="true" caseSensitive="true" /> does not appear to have any effect

A

Anonymous

Of note this issue still exists in CF11, specifically when using CF Express with CF Builder 3. The entry listed as the fix for this issue under CF10 resolved it for CF11 as well.

K

Kibbage-Data-Services

Inspiring

I too have this problem and will make sure NOT to use Tomcat in production!!!

M

Mark.Gregory

Known Participant

Just to chime in with a late "Me Too".

Windows 7 workstation, using builtin web server, CF10.

itisdesign

Inspiring

Hi all,

The CF10 case-sensitivity bugs (#3199281 & #3199283) are both thankfully marked Open/ToFix! Awesome.

Thanks,

-Aaron

A

Anonymous

Correct answer

I'm happy to report that somebody has found a workaround. I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.

From Chad Baloga on HouseOfFusion:

"

Found out how..

look for context.xml under {drive}\ColdFusion10\cfusion\runtime\conf

Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">

Restart the CF service
"

Why you set it to "true" and not to "false" is beyond me. But I'm not too concerned. It works, which means that I don't need to update thousands of templates nor do I have to install IIS right now.

A

Adam Cameron.

Inspiring

Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">

DO NOT DO THIS ON WINDOWS SERVERS.

Read the docs:

http://tomcat.apache.org/tomcat-5.5-doc/config/context.html#Standard_Implementation:

Excerpt:

allowLinking

If the value of this flag is true, symlinks will be allowed inside the web application, pointing to resources outside the web application base path. If not specified, the default value of the flag is false.

NOTE: This flag MUST NOT be set to true on the Windows platform (or any other OS which does not have a case sensitive filesystem), as it will disable case sensitivity checks, allowing JSP source code disclosure, among other security problems.

Why you set it to "true" and not to "false" is beyond me.

See above.

But I'm not too concerned.

Yeah, OK, provided you only do this on your dev system, sure.

I'm really hesitant about you promoting this idea as a valid answer to this issue without adding the caveats that come along with it. I'd hate someone to read that and think it's something they should do.

--

Adam

A

Anonymous

1) I made it EXTREMELY clear in my response that I felt it should only be used for dev purposes. To reiterate my original point:

I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.

2) It lists JSP code exposure as a potential problem (which is of absolutely no concern for Coldfusion developers, no?). "Among other security concerns" is conveniently vague. It's like saying, "we don't know of any other problems but we REEAAAALLLLY don't want you to do this because something else might pop up in the future." Fine. See #1.

3)

I'm really hesitant about you promoting this idea as a valid answer to this issue without adding the caveats that come along with it. I'd hate someone to read that and think it's something they should do.

My original question was posted as to whether or not there was a way to turn off case-sensitivity. That question was solved. Your caveats are duly noted.

A

Anonymous

Thank you both for your feedback. Here's hoping that Adobe is willing to compile their own version of Tomcat which will allow us to toggle the case sensitivity.

A

Adam Cameron.

Inspiring

I spoke to members of the Adobe CF team and asked them to feedback on this thread. Unfortunately they didn't seem to bother (or forgot, or something).

:-(

--

Adam

A

Anonymous

Ok, thanks for the feedback so far. Adam, I *do* think that I'm ultimately correct, as BKBK pointed out. However, I think you have a point that I neglected some very important information. I will provide that now (along with my theory on the cause)....

I am on Windows 2003 Server 32-bit running CF10. I am *not* using IIS (this is the key here, I believe) but, rather, using the built-in CF server (now Tomcat).

I'm thinking that the issue doesn't lie with CF (directly) but, rather, lies with the "web server" aspect of CF. As long as you are running IIS (or some other 3rd party web server) to serve your websites on Windows, you will not necessarily experience the issue. But if you are on a dev install running the "CF" server (Tomcat), you will. Everything I've found online suggests that Tomcat descriminates by nature (and, as of version 6, allows no option to override) between cases. So, TEST.HTML and test.html are not the same under the Tomcat web server. Again, I'm *assuming* that this descrimination is limited to the web server itself and NOT to Coldfusion (which has always been case-insensitive -- StructKeyExists() = structkeyexists() = STRUCTKEYEXISTS()) and does *not* pose an issue if you are using a 3rd party web server (such as IIS). Regardless, it *is* frustrating to have a common standard such as case-insensitivity suddenly go by the wayside because Adobe decided to replace their built-in web server with a more restrictive one.

Adobe, I'm talking to you -- you've replaced your previously case-insensitive web server with a new case-sensitive one. Your users deserve a method to upgrade with backwards compatibility, no?

A

Adam Cameron.

Inspiring

Adobe, I'm talking to you -- you've replaced your previously case-insensitive web server with a new case-sensitive one. Your users deserve a method to upgrade with backwards compatibility, no?

I'm running the dev install and using the inbuillt web server. I've run it on Win7, Win Vista and Win Server 2003 (32-bit), and that accounts for about a dozen installs. I am also aware of around 50 (at least) other installs made by different people, and I've heard no reports of case-sensitivity. And trust me... these people would have reported it (it being their job in this instance to specifically test the product).

CF10 (beta, and now "actual") has been available to the gen. pop. for a few months now, and I've heard no one else having experienced this.

Again, I don't doubt you're seeing what you're seeing, but it's not a case of the default install of the default web server treats URLs case-sensitively.

NB: Adobe host these forums but it is not an official support channel, and if anyone from Adobe participate here, it's in their own time. If you want to speak to Adobe, you need to raise a support ticket with them.

--

Adam

BKBK

Community Expert

Adam Cameron. wrote:

I'm running the dev install and using the inbuillt web server. I've run it on Win7, Win Vista and Win Server 2003 (32-bit), and that accounts for about a dozen installs. I am also aware of around 50 (at least) other installs made by different people, and I've heard no reports of case-sensitivity. And trust me... these people would have reported it (it being their job in this instance to specifically test the product).
CF10 (beta, and now "actual") has been available to the gen. pop. for a few months now, and I've heard no one else having experienced this.
Again, I don't doubt you're seeing what you're seeing, but it's not a case of the default install of the default web server treats URLs case-sensitively.
NB: Adobe host these forums but it is not an official support channel, and if anyone from Adobe participate here, it's in their own time. If you want to speak to Adobe, you need to raise a support ticket with them.

Did any of those tests involve static(non-ColdFusion) URLs? For such URLs, Tomcat indeed enforces case-sensitivity. I have reproduced this on ColdFusion 10 Beta and on the recently released ColdFusion 10.

Copy an image file, myPic.jpg, say, to the directory myImages, under the web root. Open the URL in the browser, for example, http://127.0.0.1:8500/myImages/myPic.jpg. You should see the image as expected.

Now, rename the file to MYPIC.jpg. Open the same URL as before. In my example, that would be http://127.0.0.1:8500/myImages/myPIC.jpg. You won't see the image. Instead, you will get something like:

HTTP Status 404 - /myImages/myPIC.jpg

type Status report

message /myImages/myPIC.jpg

description The requested resource (/myImages/myPIC.jpg) is not available.

Apache Tomcat/7.0.23

BKBK

Community Expert

I think you're actually right, Kevinmkr. I also encountered case-sensitivity in URLs some time ago, but ignored it. Your post has made me revisit the issue. From what I have read so far, case-sensitivity might in fact be the (intended) default behaviour of Tomcat.

A

Adam Cameron.

Inspiring

OK... you asked for it: you're wrong ;-)

I don't doubt yer seeing what yer seeing, but it's CF10/Tomcat ain't case-sensitive as far as URLs goes out of the box. So there's some vagary of your set up which you're not telling us about (which is not hard: you don't tell us much about it) which is impacting your situation.

Here're these forums guidelines as to how best to post a question:

http://forums.adobe.com/thread/607238

Especially relevant here is your system config.

--

Adam

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded