Prevent Direct Access to Custom Tags

[csgaraglino]

Hello all,

I have an application running on CF9 and there are many Custom Tags and CFC files - that some are calling directly. For example, somehow a bot found one and now it tries to index it as a direct URL.

http://www.yourdomain.com/my-custom-tag.cfm

How do I stop any direct URL access  to a CT or CFC - and only allow the CT to run when called?

[haxtbh]

Not storing them in the web root would be the first thing. Is there a reason they need to go in the webroot?

If they must be there, then put them in a sub folder which is only accessible by the CF service, if anyone else navigates to them it will give them a 401/3

[csgaraglino]

Sorry - they are not in the web root - they are in their own folder and available to all websites on the server.

[Steve Sommers]

We avoid using custom tags but some of our legacy tags have code similar to the following:

<cfif NOT thisTag.hasEndTag>

    <cfabort showerror="You need to supply a closing &lt;CF_Head&gt; tag.">

</cfif>

<cfif thisTag.executionMode EQ "end">...

You may be able to simply check for the existence of thisTag - isDefined("thisTag").

Another option is updating your application.cfm or application.cfc to white list the templates that can be accessed from the outside world. You can do the same via folders and access permissions similar to what haxtbh mentioned - but restructuring your app may be more difficult than <cfif NOT listFindNoCase("big.cfm,ugly.cfm,list.cf,of.cfm,files.cfm",cgi.script_name)><cfabort showerror="Go away!" /></cfif>

[BKBK]

csgaraglino  wrote

http://www.yourdomain.com/my-custom-tag.cfm

How do I stop any direct URL access  to a CT or CFC - and only allow the CT to run when called?

You could just use the settings in your web-server to deny access to the URL.