Coldfusion 10 Case Sensitive URLs?!?

Community Beginner ,
May 17, 2012 May 17, 2012

Copy link to clipboard

Copied

I just migrated my CF8 site to CF10 (development only, thankfully!) and noticed that all sorts of issues were occuring with missing images.  It appears that, after over a decade of "test.html" being the same as "TEST.HTML", the adoption of Tomcat has killed that.  A link to "MyImage.jpg" will not bring up "myimage.jpg".

Please tell me I'm wrong or, better still, tell me a way to turn off case sensitivity in the Tomcat system.  My application has thousands of templates (each with multiple links) and I'm not very happy about the idea of having to go in, page by page, and standardize their casing.

TOPICS
Server administration

Views

17.4K

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines

correct answers 1 Correct Answer

Community Beginner , Jun 27, 2012 Jun 27, 2012
I'm happy to report that somebody has found a workaround.  I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.From Chad Baloga on HouseOfFusion:"Found out how.. look for context.xml under {drive}\ColdFusion10\cfusion\runtime\conf Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">Restart the CF service "Why you set it to "true" and not to "false" is beyond me.  But I'm not too concerned.  ...

Likes

Translate

Translate
LEGEND ,
May 18, 2012 May 18, 2012

Copy link to clipboard

Copied

OK... you asked for it: you're wrong 😉

I don't doubt yer seeing what yer seeing, but it's CF10/Tomcat ain't case-sensitive as far as URLs goes out of the box.  So there's some vagary of your set up which you're not telling us about (which is not hard: you don't tell us much about it) which is impacting your situation.

Here're these forums guidelines as to how best to post a question:

http://forums.adobe.com/thread/607238

Especially relevant here is your system config.

--

Adam

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Community Professional ,
May 18, 2012 May 18, 2012

Copy link to clipboard

Copied

I think you're actually right, Kevinmkr. I also encountered case-sensitivity in URLs some time ago, but ignored it. Your post has made me revisit the issue. From what I have read so far, case-sensitivity might in fact be the (intended) default behaviour of Tomcat.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Beginner ,
May 20, 2012 May 20, 2012

Copy link to clipboard

Copied

Ok, thanks for the feedback so far.  Adam, I *do* think that I'm ultimately correct, as BKBK pointed out.  However, I think you have a point that I neglected some very important information.  I will provide that now (along with my theory on the cause)....

I am on Windows 2003 Server 32-bit running CF10.  I am *not* using IIS (this is the key here, I believe) but, rather, using the built-in CF server (now Tomcat).

I'm thinking that the issue doesn't lie with CF (directly) but, rather, lies with the "web server" aspect of CF.  As long as you are running IIS (or some other 3rd party web server) to serve your websites on Windows, you will not necessarily experience the issue. But if you are on a dev install running the "CF" server (Tomcat), you will.  Everything I've found online suggests that Tomcat descriminates by nature (and, as of version 6, allows no option to override) between cases.  So, TEST.HTML and test.html are not the same under the Tomcat web server.  Again, I'm *assuming* that this descrimination is limited to the web server itself and NOT to Coldfusion (which has always been case-insensitive -- StructKeyExists() = structkeyexists() = STRUCTKEYEXISTS()) and does *not* pose an issue if you are using a 3rd party web server (such as IIS).  Regardless, it *is* frustrating to have a common standard such as case-insensitivity suddenly go by the wayside because Adobe decided to replace their built-in web server with a more restrictive one.

Adobe, I'm talking to you -- you've replaced your previously case-insensitive web server with a new case-sensitive one.  Your users deserve a method to upgrade with backwards compatibility, no?

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
LEGEND ,
May 20, 2012 May 20, 2012

Copy link to clipboard

Copied

Adobe, I'm talking to you -- you've replaced your previously case-insensitive web server with a new case-sensitive one.  Your users deserve a method to upgrade with backwards compatibility, no?

I'm running the dev install and using the inbuillt web server.  I've run it on Win7, Win Vista and Win Server 2003 (32-bit), and that accounts for about a dozen installs.  I am also aware of around 50 (at least) other installs made by different people, and I've heard no reports of case-sensitivity.  And trust me... these people would have reported it (it being their job in this instance to specifically test the product).

CF10 (beta, and now "actual") has been available to the gen. pop. for a few months now, and I've heard no one else having experienced this.

Again, I don't doubt you're seeing what you're seeing, but it's not a case of the default install of the default web server treats URLs case-sensitively.

NB: Adobe host these forums but it is not an official support channel, and if anyone from Adobe participate here, it's in their own time.  If you want to speak to Adobe, you need to raise a support ticket with them.

--

Adam

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Community Professional ,
May 21, 2012 May 21, 2012

Copy link to clipboard

Copied

Adam Cameron. wrote:


I'm running the dev install and using the inbuillt web server.  I've run it on Win7, Win Vista and Win Server 2003 (32-bit), and that accounts for about a dozen installs.  I am also aware of around 50 (at least) other installs made by different people, and I've heard no reports of case-sensitivity.  And trust me... these people would have reported it (it being their job in this instance to specifically test the product).

CF10 (beta, and now "actual") has been available to the gen. pop. for a few months now, and I've heard no one else having experienced this.

Again, I don't doubt you're seeing what you're seeing, but it's not a case of the default install of the default web server treats URLs case-sensitively.

NB: Adobe host these forums but it is not an official support channel, and if anyone from Adobe participate here, it's in their own time.  If you want to speak to Adobe, you need to raise a support ticket with them.

Did any of those tests involve static(non-ColdFusion) URLs? For such URLs, Tomcat indeed enforces case-sensitivity. I have reproduced this on ColdFusion 10 Beta and on the recently released ColdFusion 10.

Copy an image file, myPic.jpg, say, to the directory myImages, under the web root. Open the URL in the browser, for example, http://127.0.0.1:8500/myImages/myPic.jpg. You should see the image as expected.

Now, rename the file to MYPIC.jpg. Open the same URL as before. In my example, that would be http://127.0.0.1:8500/myImages/myPIC.jpg. You won't see the image. Instead, you will get something like:

HTTP Status 404 - /myImages/myPIC.jpg

type Status report

message /myImages/myPIC.jpg

description The requested resource (/myImages/myPIC.jpg) is not available.

Apache Tomcat/7.0.23

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
LEGEND ,
May 21, 2012 May 21, 2012

Copy link to clipboard

Copied

Did any of those tests involve static(non-ColdFusion) URLs? For such URLs, Tomcat indeed enforces case-sensitivity. I have reproduced this on ColdFusion 10 Beta and on the recently released ColdFusion 10.

Yikes.

You're right.

Also CFM files have case-sensitive file extensions.  eg: index.cfm is the same as INDEX.cfm, but not the same as index.CFM.

Apologies to the OP for saying he's wrong.  I had indeed only tested with CFM files, and I had only ever varied the capitalisation of the file name, not the extension.

I am in a position to make sure Adobe know about this, and will do so right now.

--

Adam

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Adobe Community Professional ,
May 21, 2012 May 21, 2012

Copy link to clipboard

Copied

BKBK wrote:

Now, rename the file to MYPIC.jpg. Open the same URL as before. In my example, that would be http://127.0.0.1:8500/myImages/myPIC.jpg. You won't see the image. Instead, you will get something like:

HTTP Status 404 - /myImages/myPIC.jpg

type Status report

message /myImages/myPIC.jpg

description The requested resource (/myImages/myPIC.jpg) is not available.

Apache Tomcat/7.0.23

Sorry I copy-pasted a similar, but different, Tomcat response. That should actually read:

Now, rename the file to MYPIC.jpg. Open the same URL as before. In my example, that would be http://127.0.0.1:8500/myImages/myPic.jpg. You won't see the image. Instead, you will get something like:

HTTP Status 404 - /myImages/myPic.jpg

type Status report

message /myImages/myPic.jpg

description The requested resource (/myImages/myPic.jpg) is not available.

Apache Tomcat/7.0.23

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Beginner ,
May 21, 2012 May 21, 2012

Copy link to clipboard

Copied

Thank you both for your feedback.  Here's hoping that Adobe is willing to compile their own version of Tomcat which will allow us to toggle the case sensitivity.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
LEGEND ,
Jun 01, 2012 Jun 01, 2012

Copy link to clipboard

Copied

I spoke to members of the Adobe CF team and asked them to feedback on this thread.  Unfortunately they didn't seem to bother (or forgot, or something).

😞

--

Adam

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Beginner ,
Jun 27, 2012 Jun 27, 2012

Copy link to clipboard

Copied

I'm happy to report that somebody has found a workaround.  I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.

From Chad Baloga on HouseOfFusion:

"

Found out how..

look for context.xml under {drive}\ColdFusion10\cfusion\runtime\conf

Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">

Restart the CF service
"

Why you set it to "true" and not to "false" is beyond me.  But I'm not too concerned.  It works, which means that I don't need to update thousands of templates nor do I have to install IIS right now.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
LEGEND ,
Jun 27, 2012 Jun 27, 2012

Copy link to clipboard

Copied

Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">

DO NOT DO THIS ON WINDOWS SERVERS.

Read the docs:

http://tomcat.apache.org/tomcat-5.5-doc/config/context.html#Standard_Implementation:

Excerpt:

allowLinking

If the value of this flag is true, symlinks will be allowed inside the web application, pointing to resources outside the web application base path. If not specified, the default value of the flag is false.

NOTE: This flag MUST NOT be set to true on the Windows platform (or any other OS which does not have a case sensitive filesystem), as it will disable case sensitivity checks, allowing JSP source code disclosure, among other security problems.


Why you set it to "true" and not to "false" is beyond me.

See above.

But I'm not too concerned.

Yeah, OK, provided you only do this on your dev system, sure.

I'm really hesitant about you promoting this idea as a valid answer to this issue without adding the caveats that come along with it.  I'd hate someone to read that and think it's something they should do.

--

Adam

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Beginner ,
Jun 27, 2012 Jun 27, 2012

Copy link to clipboard

Copied

1) I made it EXTREMELY clear in my response that I felt it should only be used for dev purposes.  To reiterate my original point:

I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.

2)  It lists JSP code exposure as a potential problem (which is of absolutely no concern for Coldfusion developers, no?).  "Among other security concerns" is conveniently vague. It's like saying, "we don't know of any other problems but we REEAAAALLLLY don't want you to do this because something else might pop up in the future."  Fine.  See #1.

3)

I'm really hesitant about you promoting this idea as a valid answer to this issue without adding the caveats that come along with it.  I'd hate someone to read that and think it's something they should do.

My original question was posted as to whether or not there was a way to turn off case-sensitivity.  That question was solved.  Your caveats are duly noted.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
LEGEND ,
Jun 27, 2012 Jun 27, 2012

Copy link to clipboard

Copied

I dunno if that's making it extremely clear, but fair enough.

For all intents and purposes, CFMs are JSPs.  Just written in a different source language.

The issue is - from what I can gather / intuit - is that it would be possible somehow for the web server to accept the URL, but the servlet handler not to handle it and simple return the source code instead of processing it.  However as you say they're vague (I would say purposely...) as to what the story actually is.

I reckon it'd just be better if the Apache Tomcat team got their heads out of their arses (their arses being located somewhere in the 1980s) and accepted that Windows exists, and indeed as a certain ubiquity, and if theiy're going to implement their software to run on it, they should do it properly.  But that's unlikely to happen, I guess.

--

Adam

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Contributor ,
Apr 17, 2014 Apr 17, 2014

Copy link to clipboard

Copied

This solution did not work for me. Using a dev version of CF10 patch 12 fully patched, and that did not work.

Has this worked for anyone using 10 patch 12 or greater?

Looks like we'll be fixing names to all lowercase now.

RLS

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Explorer ,
Apr 17, 2014 Apr 17, 2014

Copy link to clipboard

Copied

I'm on patch 13 and the fix/workaround works for me.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Engaged ,
Jun 30, 2012 Jun 30, 2012

Copy link to clipboard

Copied

Hi all,

The CF10 case-sensitivity bugs (#3199281 & #3199283) are both thankfully marked Open/ToFix!  Awesome.

Thanks,

-Aaron

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Feb 25, 2013 Feb 25, 2013

Copy link to clipboard

Copied

Just to chime in with a late "Me Too".

Windows 7 workstation, using builtin web server, CF10.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Explorer ,
Apr 11, 2013 Apr 11, 2013

Copy link to clipboard

Copied

I too have this problem and will make sure NOT to use Tomcat in production!!!

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Participant ,
May 05, 2014 May 05, 2014

Copy link to clipboard

Copied

Of note this issue still exists in CF11, specifically when using CF Express with CF Builder 3.  The entry listed as the fix for this issue under CF10 resolved it for CF11 as well.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
Community Beginner ,
Mar 14, 2016 Mar 14, 2016

Copy link to clipboard

Copied

This changed again in Coldfusion 2016 and the previous fix isn't working.  If anyone has a workaround - please post.

Thank you!

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
Dec 07, 2016 Dec 07, 2016

Copy link to clipboard

Copied

Add the blow line after <Context> tag

     <Resources allowLinking="true">

Restart CF.

Note from Tomcat about this flag.

If the value of this flag is true, symlinks will be allowed inside the web application, pointing to resources outside the web application base path. If not specified, the default value of the flag is false.

NOTE: This flag MUST NOT be set to true on the Windows platform (or any other OS which does not have a case sensitive filesystem), as it will disable case sensitivity checks, allowing JSP source code disclosure, among other security problems.

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines
New Here ,
May 23, 2017 May 23, 2017

Copy link to clipboard

Copied

LATEST

I stumbled onto the solution just before reading this but wanted to confirm for others that it does work on ColdFusion 2016 running Apache Tomcat 8.5.x, although you probably want to self-close it to be safe (for XML reasons):

<Context>

...

    <Resources allowLinking="true" />

...

And just FYI, caseSensitive="true" (as seen in the solution for older versions) is not missing/necessary, i.e., <Resources allowLinking="true" caseSensitive="true" /> does not appear to have any effect

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
community guidelines