ColdFusion 2018 Update broke ajax calls

[Carolyn5E88]

We've just gone from ColdFusion 2018 Update 3 to Update 10, and in the process all of the application's ajax calls are returning a 500 error "Parameter validation error for the STRUCTKEYEXISTS function.The function takes 2 parameters." The returnformat on some functions is JSON, on others it's plain. I've searched the application and can't find any instance of StructKeyExists that doesn't have two parameters. I suspect the issue is security related, but this is beyond my level of expertise. Any suggestions?

[BKBK]

There might be a security issue, as you say. But my guess is that you have somewhere in your application used structKeyExists with less than 2, or with more than 2, arguments. Check the application and exception logs. What do you find there?

[Carolyn5E88]

Thanks for responding. I've just searched the entire application again and found no instance of StructKeyExists with anything but two parameters.

The coldfusion-out and application logs both report...

"Error [ajp-nio-127.0.0.1-8018-exec-8] - Parameter validation error for the STRUCTKEYEXISTS function.The function takes 2 parameters. The specific sequence of files included or processed is: C:\inetpub\Websites\ctecourse-dev-scoe-net\model\Ajax\SectorPathwayCBEDS.cfc, line: 4."

Line 4 of SectorPathwayCBEDS.cfc is the first and only <cfargument> line for the first <cffunction> in the component. The same line is reported whether the page throwing the error uses the first function or one later in the file.

It may help to know that the application uses Fusebox 5.51. The application worked flawlessy in ColdFusion 11 for years. A couple weeks ago we moved it to a new ColdFusion 2018 server, running with update 3, and still the application worked as it should. It was only after applying update 10 last week that things went awry. 

[BKBK]

We're then left with one remaining possibility: check the occurrence of structKeyExists in all the Application.cfm/Application.cfc files.

[Carolyn5E88]

There's one Application.cfc. StructKeyExists is used within OnRequestStart to determine if the request is an ajax call, but I get the error message even when I comment out the code and remove references to Request.IsAjax (used to determine layout template).

<cfset reqData = getHTTPRequestData() />
<cfif StructKeyExists(reqData.Headers, "X-Requested-With") and reqData.Headers["X-Requested-With"] eq "XMLHttpRequest">
<cfset Request.IsAjax = true />
<cfelse>
<cfset Request.IsAjax = false />
</cfif>

[BKBK]

The error would have been logged in application.log and exception.log. Could you share these files by private messaging?

[Carolyn5E88]

Just tried sending my first private message, BKBK. Was I successful? 

[BKBK]

I didn't receive any, @Carolyn5E88 . Did you receive mine?

[BKBK]

@Carolyn5E88 :There's one Application.cfc. StructKeyExists is used within OnRequestStart to determine if the request is an ajax call, but I get the error message even when I comment out the code ...

Just one Application.cfc and just one occurrence of StructKeyExists? Are you sure about that?

I ask because when I google Fusebox Application.cfc I get an application file that contains 17 occurrences of  StructKeyExists.

[Carolyn5E88]

I'm sorry, you're absolutely right. I completely forgot about the Fusebox Application.cfc. All of those Fusebox files just do their thing without me ever having to touch them, I forget about them. 

[BKBK]

I think we just have to rule out the possibilities.

[Carolyn5E88 · Accepted solution]

Fixed!

Your observation that it was switching to fusebox552/Application.cfc alerted me to the fact that the mapping was wrong, it should have been fusebox551/Application.cfc.

Fixing that didn't resolve the problem though, at least not on its own. I couldn't find an instance of StructKeyExists that had anything but two arguments, not in that file and not anywhere in the application. I still don't understand what triggered that specific error message.

Anyway, while confirming the value of this.name, I noticed this.secureJSON was set to false. I set it to true with no positive effect, then I removed it entirely and voila! Even the Ajax calls that didn't return serialized data worked again.

(I also had to address some case issues in the javascript since some of the returned data was undefined.)

Even though your feedback didn't directly solve the issue, it ended up guiding me to the root of the problem and I don't know how long it would have taken me to get there on my own. Thank you so much!

[BKBK]

I am glad to hear that! Thanks for sharing your solution. Incidentally, it is worth clarifying that the suggestion about fusebox552 occurred in a private message. 

I wouldn't have imagined the cause. But now you mention it, it becomes obvious.  The property "this.secureJson" works only with ColdFusion's own native cfAjax. It is known to cause problems when you use it with an external Ajax library. But I would never have guessed "StructKeyExists".