This has come up repeatedly over a number of years.

ColdFusion exposes /CFIDE by default, which is bad, and absolutely should not be the case.

However because Adobe have homed the resources for CFUI tags (<cfform> etc) in /CFIDE, a lot of people think they "need" to have that exposed to use these tags. Obviously the - poorly named - <cfajaximport> tag can be used to point these tags at a different location for their resources, but this is a poor approach to dealing with an issue that shouldn't really need to exist.

Just put the stuff for CFUI tags somewhere else! Move them outside /CFIDE. But them in /cfresources or something. Basically follow good web practices and only expose things to the outside world that are supposed to be exposed to the outside world.

I think Adobe needs to step up and be a bit more of a facilitator when it comes to streamlining people's efforts to secure their servers.

This should not be too hard to achieve, and not have many knock-on effects? I'm just wondering about any "backwards compat" issues Adobe might claim as grounds to not do this. I think in this case, product stability and reputation, and being seen to be doing something about ColdFusion's security perceptions should quite possibly trump "backwards compat" concerns?

I'm raising this as a bug not an E/R as it's just wrong to have this stuff coupled with the administrator / API / etc

• 7 Starter 32-bit, Railo Express
• 7 Home Premium 64-bit, Railo Express
• 7 (not sure of flavour: probably Professional or Enterprise) 64-bit, Railo Express (this is the one showing the buggy behaviour)
• 8 Standard 64-bit, both Railo on Tomcat and Railo Express

<cfquery name="colours" datasource="scratch_mssql">
    SELECT  en AS english, mi AS maori
    FROM    colours
    WHERE   id  BETWEEN    <cfqueryparam value="#URL.low#">
                AND        <cfqueryparam value="#URL.high#">
</cfquery>

queryService = new Query();
queryService.setSql("
    SELECT  en AS english, mi AS maori
    FROM    colours
    WHERE   id BETWEEN :low AND :high
");
queryService.setDataSource("scratch_mssql");
queryService.addParam(name="low", value=URL.low);
queryService.addParam(name="high", value=URL.high);
queryResult = queryService.execute();
coloursViaQueryCfc = queryResult.getResult();

coloursViaQueryCfcShorthand = new Query(
    datasource    = "scratch_mssql",
    parameters    = [
        {name="low", value=URL.low},
        {name="high", value=URL.high}
    ],
    sql            = "
        SELECT  en AS english, mi AS maori
        FROM    colours
        WHERE   id BETWEEN :low AND :high
"
).execute().getResult();

coloursViaQueryExecute = queryExecute("
    SELECT  en AS english, mi AS maori
    FROM    colours
    WHERE   id BETWEEN :low AND :high
",
    {low=URL.low, high=URL.high},
    {datasource="scratch_mssql"}
);

<cfset params = {
    low     = URL.low,
    high    = URL.high
}>
<cfquery name="colours" datasource="mssql_scratch" parameters="#params#">
    SELECT  en AS english, mi AS maori
    FROM    colours
    WHERE   id BETWEEN :low AND :high
</cfquery>

<cfset params = [URL.low, URL.high]>
<cfquery name="colours" datasource="mssql_scratch" parameters="#params#">
    SELECT  en AS english, mi AS maori
    FROM    colours
    WHERE   id BETWEEN ? AND ?
</cfquery>

<cfset params = [
    {value=URL.low},
    {value=URL.high}
]>
<cfquery name="numbersViaPositionalParams" params="#params#">
    SELECT  en AS english, mi AS maori
    FROM    colours
    WHERE   id BETWEEN ? AND ?
</cfquery>

<cfset params = {
    low=URL.low,
    high=URL.high
}>
<cfquery name="numbersViaNamedParams" params="#params#">
    SELECT  en AS english, mi AS maori
    FROM    colours
    WHERE   id BETWEEN :low AND :high
</cfquery>

1. I'm a dropkick;
2. Railo's setting "Local scope mode" (which I can't find docs to link to [grumble], so I'll need to explain it).

Local Scope Mode

First Bug

counter = 0;
incrementCounter = function(){
    return ++counter;
};
writeOutput("incrementCounter() returned: #incrementCounter()# (current value of counter: #counter#)<br>");
writeOutput("incrementCounter() returned: #incrementCounter()# (current value of counter: #counter#)<br>");

Second Bug

incrementCounter = function(){
    return ++localcounter;
};

<cfstoredproc procedure="uspGetColours" datasource="scratch_mssql" result="tags.result" clientinfo="true" returncode="true">
<cfprocparam value="#URL.low#" cfsqltype="CF_SQL_INTEGER">
<cfprocparam value="#URL.high#" cfsqltype="CF_SQL_INTEGER">
<cfprocparam type="out" variable="tags.inclusiveCount" cfsqltype="CF_SQL_INTEGER">
<cfprocparam type="out" variable="tags.exclusiveCount" cfsqltype="CF_SQL_INTEGER">
<cfprocresult resultset="1" name="tags.inclusive">
<cfprocresult resultset="2" name="tags.exclusive">
</cfstoredproc>

ALTER PROCEDURE [dbo].[uspGetColours] 
    @low int, 
    @high int,
    @countInclusive int OUTPUT,
    @countExclusive int OUTPUT
AS
BEGIN
    SET NOCOUNT ON;

    SELECT    id, en AS english, mi AS maori
    FROM    colours
    WHERE id BETWEEN @low AND @high

    SELECT @countInclusive = @@ROWCOUNT

    SELECT    id, en AS english, mi AS maori
    FROM    colours
    WHERE id NOT BETWEEN @low AND @high

    SELECT @countExclusive = @@ROWCOUNT
END

• the records within that range;
• how many of those there are;
• the records outwith that range;
• how many of those records there are.

result =  new StoredProc(
    procedure        = "uspGetColours",
    datasource        = "scratch_mssql",
    result            = "anyOldShitYouLike", // seriously. It doesn't matter what value this has
    fetchclientinfo    = true,
    returncode        = true,
    parameters        = [
        {value=URL.low, cfsqltype="CF_SQL_INTEGER"},
        {value=URL.high, cfsqltype="CF_SQL_INTEGER"},
        {type="out", variable="inclusiveCount", cfsqltype="CF_SQL_INTEGER"},
        {type="out", variable="exclusiveCount", cfsqltype="CF_SQL_INTEGER"}
    ],
    procResults        = [
        {resultset=1, name="inclusive"},
        {resultset=2, name="exclusive"}
    ]
).execute();


writeDump(var=[
        result.getPrefix(),
        result.getProcResultSets(),
        result.getProcOutVariables()
]);

cfstoredproc(procedure="uspGetColours", datasource="scratch_mssql",result="script.result", fetchclientinfo=true, returncode=true) {
    cfprocparam(value=URL.low, cfsqltype="CF_SQL_INTEGER");
    cfprocparam(value=URL.high, cfsqltype="CF_SQL_INTEGER");
    cfprocparam(type="out", variable="script.inclusiveCount", cfsqltype="CF_SQL_INTEGER");
    cfprocparam(type="out", variable="script.exclusiveCount", cfsqltype="CF_SQL_INTEGER");

    cfprocresult(resultset=1, name="script.inclusive");
    cfprocresult(resultset=2, name="script.exclusive");
}

• the procedure name
• some parameters
• some options (datasource, etc)

• returns recordset(s)
• returns metadata
• returns values in some of the parameters

options = {
    datasource        = "scratch_mssql",
    fetchclientinfo    = true,
    returncode        = true
};
params = [
    {value=URL.low, type="INTEGER"},
    {value=URL.high, type="INTEGER"},
    {type="out", variable="inclusiveCount", type="INTEGER"},
    {type="out", variable="exclusiveCount", type="INTEGER"}
];

result = executeProcedure("uspGetColours", params, options);

<cfset days = ["Rāhina","Rātū","Rāapa","Rāpare","Rāmere","Rāhoroi","Rātapu"]>
<cfsavecontent variable="contentViaTags">
<ul>
<cfloop index="day" array="#days#">
<cfoutput><li>#day#</li></cfoutput>
</cfloop>
</ul>
</cfsavecontent>
<cfoutput>#contentViaTags#</cfoutput>

savecontent variable="contentViaScript"{
    writeOutput(days.reduce(function(previousResult, thisValue){
        return previousResult & "<li>#thisValue#</li>";
    },"<ul>") & "</ul>");
}
writeOutput(contentViaScript);

1. CFML syntax for setting a variable to be the result of some processing is:
   variable = process
   Not:
   process variable="nameOfVariable"
   So it's at odds with out CFML works to approach functionality that way.
2. We need to add this new {} syntax to enclose the code we're saving the output of. This is a new syntax construct implemented solely to emulate opening/closing tags. This is script code, so we should not be thinking in terms of opening and closing tags.

cfsavecontent(variable="contentViaScriptNew") {
    writeOutput("<ul>");
    days.each(function(v){
        writeOutput("<li>#v#</li>");
    });
    writeOutput("</ul>");
}
writeOutput(contentViaScriptNew);

contentViaFunction = savecontent(function(){
    var decoratedDays = days.map(function(v){
        return "<li>#v#</li>";
    });
    writeOutput("<ul>#decoratedDays.toList('')#</ul>");
});
writeOutput(contentViaFunction);

function saveContent(required function content){
    savecontent variable="local.saved" {
        content();
    }
    return local.saved;
}

1. you're one of my regular blog readers, in which case this will have just found its way in front of you just like anything else I write;
2. you are a person I have successfully contacted who - hopefully - the administrator of a ColdFusion-driven website that I have noticed as having some security issues.

ColdFusion Patching

• ColdFusion Help / Hot fixes | ColdFusion 9
• ColdFusion 10 patching is done within ColdFusion Administrator, but there's at least one mandatory update that needs to be manually installed: "ColdFusion 10 Mandatory Update"
• ColdFusion 8 patches are still available: "Hot Fixes | Cold Fusion 8 and 8.0.1"

ColdFusion Security

• ColdFusion 10 Lockdown Guide (PDF) - Adobe
• [PDF] Adobe® ColdFusion® 9 Server Lockdown Guide

General site / code security

• You must block external access to http://yourdomain.com/CFIDE/administrator. It is absolutely critical that that URL cannot be accessed from the outside world. It is a vector for known, real-world, site hacking.
• Always use an error template and a global error handler. Website errors happen, but you do not want to be exposing the error message to the outside world. Error messages often show areas in which a website can be exploited.
• Make sure that if you browse to http://yourdomain.com/Application.cfm that your error template displays, rather than a generic ColdFusion error message. Unless configured properly, that URL generally bypasses a site's error template.
• This is a bit technical, but all dynamic values being passed to a database must be done via parameters, not via hard-coded values. This is a non-trivial security vector (and one that is obvious if your error pages aren't configured properly!)
• [there's plenty of other stuff to consider too]

Community

Why am I telling you this?

Hi:
Sorry about the "WTF?" moment going on here. I am posting this notice in front of anyone accessing my blog from Firefox.

As I say in my communications policy for this blog, everything here is my opinion. Generally I stick to my opinions about stuff relating to CFML, but I reserve the right to express my opinion on any topic.

Something I have a strong opinion on is the topic of prejudice and bigotry. I won't conscion it. I do not simply mean racial bigotry, I mean bigotry of any stripe, including homophobia.

I was very disappointed to see that Mozilla have appointed a "card-carrying" bigot to the position of CEO. As we have all heard by now, Brendan Eich is so prejudiced against homosexual people he has financially invested in attempts to underwrite homophobia into United States law.

In my opinion, this is completely unacceptable. I can't have a say in whether he should be stood down from this position, but the longer he retains it, the dimmer is my view of Mozilla as a company.

As my own small protest I have deinistalled Firefox from my computer, and I am also now inviting you to do the same.

I'll only be displaying this banner to you once... I've popped a cookie on your browser so it should not display again. Sorry for the interruption.

Cheers.

Really? You're giving a "Yeah, Fuck that guy" a well said? I think Adam may have had a few cocktails before posting this non-CFML related message, or maybe it was click bait Huffington Post style (worked on me). So what's the issue here guys/gals? The man can't have traditional values and or beliefs without getting told to go fuck himself? Real mature.
I doubt he's anti-gay but who knows maybe he dreamt of strangling queers while creating that god awful javascript mess, that's what everyone should be boycotting, not Firefox but js. Just a quick question, would there be this much rage, ranting, pissing and moaning if Mozilla named a... umm... I don't know.... a Muslim as CEO? Didn't think so.

ColdFusion 11 and Railo 4 have added "member functions" to CFML, so one can call a method on an object, rather than pass an object to a function. ColdFusion has implemented list functions as member functions of a string, and in the process have blurred the distinction between what's a list function and what's a string function. There is conversation about this on the Railo Google Group, and this has lead me to wonder what the community participants think about Adobe's approach here.

1. Do you chiefly use/concern yourself with ColdFusion or Railo?

2. Which best reflects your opinion on the concept of "lists" as a CFML "data type"?

Never gave it much thought until you brought it up. They are there, I use them occasionally for short sets of data

I know lists exist, but i typically use array

They have long been a part of CFML, and are present in a number of places (e.g., HTML form attributes for checkboxes come through as lists, query.columnList) within the language. We use them. They are a simple and useful data structure. Can they be abused or used in situations that other data structures would make more sense? Sure.

These are just 'strings', but then again, so is a JSON structure. To me, there is very little difference between: "one,two,three" and '["one","two","three"]'. I've always thought that when I wanted to perform any list function, CF converted my string to an array, performed it's action, and then popped it back to a string.

A list in many languages is a proper data type on its own with specific benefits. CFML lists, being just strings, I cannot condone.

They aren't a data type, but I think it is ok to have them as a concept. Many of the list functions are useful when manipulating strings.

I think lists are great, but because they are also strings, it makes it difficult to explain the differences between lists and strings. In CFML, a list is a string (given a delimiter), and any string can be a list, and each can be treated as the other. This has the benefit of allowing quick loops over strings, outputting lists (in most languages, a more difficult task), and easily specifying custom delimiters to break up a string, but if CFML had a true list construct (akin to an ArrayList, on the level of Structs and Arrays, but would toString() just by outputting), I think things could be improved dramatically. Right now, it's a sloppy mess.

Works well for simple handling of data. Lists are far quicker to define than structures and there is a place for lists in my heart. Lots of times I've been supplied with lists and it's nice to work with them in this form just by pasting them into my code. Lists are a great feature of CFML and like most things you should choose the right tool for each job. Sometimes you just have to use arrays or structs if things get slightly complicated. Viva lists!

I can see the benefit of a "list" data type, remembering back when I was a junior level, I had used them quite a bit. Having "lists" helps with adoption for new developers just starting out that may struggle with arrays and is somewhat unique to the language. However since CF is very loose with data types, overall I'm not sure they make sense. Issue now is they are part of the language and not going anywhere.

I use list functions as a quick way to split up strings. I also use it to sent list of things to arrays as in listToArray.

I'm neutral. I think of them in the manner ColdFusion does because, well, ColdFusion looks at them as such. However, if lists were to be no more and I had to look at it as a string, it's no bother. 9 times out of 10 I end of converting them to arrays for manipulation etc. anyway.

It's an artifact of the "Let's make CFML simple so non-programmers can use it." days - and it was made worse by the ridiculous handling of empty elements in the "list"!

Personally, I love list data types and that their are specific functions for working with them. Sure, it's really just a wrapper for working with strings and/or simple arrays, but we use List functions a lot and like them.

I find lists to be very useful. I know it can be easily done as an array, but I do find the list functions useful.

I use them all the time to extract directories from paths, names/extensions from files, etc... Very handy in my book. Now, that could be done via listToArray, but not having to do that is a convenience that I don't think hurts anything/anyone.

I don't really consider lists to be a cfml datatype. in the past, we've just had list aware functions that have worked on strings. I've found it to be a convenience factor to use string as list, though I mostly turn them into arrays because I've found arrays to be more reliable. the ability to treat a string as a list has some useful side benefits in that string parsing/manipulation is easier

3. Some ColdFusion "list" member functions[...]

They should all be prefixed with list, not only for the reasons given, consistency, new name is often misleading etc, but also because the new 'list' less names are taking names that could be useful string functions that do what the name suggests.

I really like the idea of having member functions available to simplify the language syntax. Where lists in CFML really are just strings, I think the only thing that makes sense is to use the list...() prefix.

With all of the other random inconsistencies within CF, I'm not too surprised. But I'd rather that everything be named the same way and start with list

I would expect "a".append("b") to return "ab", not "a,b", having it as listAppend() avoids this confusion.

Language consistency is powerful. Take a look at PHP to see how inconsistencies have turned out.

Function names should be as consistent as possible. Coldfusion right now is a huge hodgepodge of naming conventions.

I think there needs to be something to indicate that these functions will be acting on the string as if it was a list. Also if they wanted to add an append method that just appended to a string that name would already be taken. You probably wouldn't do that but there could be other cases where that would come up.

string.append() means you are adding one string to another. string.listAppend() means you are adding an item to a list, where the string is a list.

Clarity and consistency are paramount. I hate inconsistencies, it makes things more difficult to remember and bashing out code is more prone to error. It's illogical. Coding is all about logic and if the language is lacking in naming logic then that's a pretty crappy start, especially for people looking at CFML for the first time.

Since the base class of both string and list is really "string", I almost think prefixing with "list" is a requirement to prevent any confusion for future functionality. What I personally would like to see is having to explicitly define a variable as a "list"; otherwise a similar member function would act like a string. Not sure how feasible this is, as I'm sure the underlying class of a list is really a string, but I'm sure it's not beyond possibilities. Things would look like this. param name="mYList" default="x,y,z" type="list"; myList.append(); myList.find(); myList.last(); ... and beyond cfscript, maybe having a cflist tag. .... To me this is essentially the same as cfimage, cfquery and other tags that return explicit types.

It's indicative of Adobe's slap-dash approach to language "design" (i.e., they don't think stuff through properly).

I do agree that they should be clearly delineated versus this blending described - one of my biggest frustration with some other languages, like PHP, is this sort of confusing mix. One thing I've always liked about CF is consistency in function names, and this messes that up.

It's a poor approach to be inconsistent. I personally like not having the "list" prefix as its obvious by the intent. If I was to do "string".first(), I would know I'm working with the string as a list (or an array). "string".find()* should probably be renamed to "string".indexOf().

options = "1) first; 2) second";
options.replace("1,2", "i,ii");

4. Railo are giving thought to adding list-oriented member functions. What are your thoughts on this?

5. Anything else to add?

If Railo are to maintain some level of syntax parity with Adobe, I think they must add these (regardless of how stupid the ACF implementation is). List functions are not the type of functionality that I would expect to be the force driving a wedge between the two platforms - compatibility wise.

Personally, I do think Railo should support all functions/tags from CFML, regardless of whether they "like" them or not. Yes, I get that some people are of the opinion that some tags/functions are stupid, useless, etc and that there is no official "standard" for CFML, but IMHO Railo cannot be seen as a valid alternative to Adobe's CF if it will not actually support the full breath of current CFML tags/functions.

I've seen a lot of code in the wild that does horrible crap like this: cfloop index="i" from="1" to="#listlen(s)#" cfset x = listGetAt(s,i) ... do stuff with x ... /cfloop Inefficient and ugly! No wonder CFML devs have such a bad reputation and everyone thinks CFML is really slow!

So many other ways to do "lists" without JSONizing the language.

Personally, I would like to see the name qualifiers removed from all member functions. Simplify the syntax. In general: move the language toward something like Ruby's "everything's an object" while we're at it. When coding in pure Ruby I find that I love so much of the "object-ness" but dislike the look of some of the syntax. When coding in CFML, I feel the opposite... in general I would like a mixture of the two.

I think if Railo wants to tout itself as a CF replacement, it should follow the Adobe road map and feature set as closely as possible. Especially when it comes to basic core functionality, which I think member functions fall into. That being said, I don't have a problem with Railo taking the lead and implementing them right. Meaning either require explicit definition of a variable as a "list" and implementing names without a "list" prefix, or option 2, implementing member functions all prefixed with "list". Maybe an even better option for Railo would be to require the explicit variable definition, and then implement member functions with and without a prefix. This would make migration from CF to Railo a matter of the parameter initialization with either of these: or param name="myList" default="x,y,z" type='list';

So long as it doesn't break any compatibility if code is moved off a CF server and put onto a Railo server. I guess the other way around isn't a huge concern. :-)

Thanks, Adam -@nathanstrutz

Lists can easily be replaced with Arrays. That being said, I often find myself using lists when working with strings simply because they're available in the language.

I see no real benefit to them. I've heard examples of their usage for handy things such as splitting extensions from file names and such. But here we can take cues from languages like Python: fileName, fileExtension = os.path.splitext("/path/to/file.jpg")

We've moved off of lists in the vast majority of cases for arrays, so in the rare cases that we do need listAppend, we can use the BIF if there is no equivalent member function.

If every other 'tag based' function is going to have a member function, then skipping a set for some reason just seems wrong.

For the sake of the language consistency, lists should have member functions... but as you note, they need to be clearly named to avoid collisions with string member functions.

As usual, Railo is damned if they do and damned if they don't. They have to copy the ill thought out crap that comes out of Adobe to stay compatible. We all know it's wrong (well.. except Adobe) but what else can they do, perhaps they could implement them and immediately deprecate them and recommend they are not used.

@dacCfml You won a few wars this week RT @shanselman: Brendan Eich steps down as Mozilla CEO https://t.co/rHj6IWzqF0
— Gavin Pickin (@gpickin) April 3, 2014

1. I had a method which took an argument url, which conflicted with the URL scope.
2. Railo's CFScriptable <cffeed> equivalent has different syntax to ColdFusion's.
3. In some places I was using the full path to the ColdFusion CFCs, eg: com.adobe.coldfusion.Http, which obviously isn't valid on Railo.
4. I was having problems with <cfcache> in Railo, so I cached some stuff by hand. I have not yet got to the bottom of this (quick update: this seems to be a bug: RAILO-3016).

URL.firstVariable = 17;
someOtherVariable = firstVariable;

URL.secondVariable = 19;
secondVariable = 23;

URL.thirdVariable = 29;
thirdVariable++;
writeDump(var={URL=URL,variables=variables});    

thirdVariable = thirdVariable + 1

URL.fourthVariable = 31;
fourthVariable = fourthVariable + 1;
writeDump(var={
"URL.fourthVariable"        = URL.fourthVariable,
"variables.fourthVariable"  = variables.fourthVariable
});

days = "Tuesday,yesterday,day,another day"
containedAt =  listContains(days, "day")
foundAt = listFind(days, "day")

dump({
"Using listContains()"    = containedAt,
"Using listFind()"        = foundAt
})

This project aims to make at least some functions from newer versions of Adobe
ColdFusion avilable in older versions.  For example, SessionInvalidate() is new
to CF10 but undocumented features make it possible in at least CF8+, possibly
even CF7.
Each set of functions is wrapped within an "if" statement to make sure they
aren't loaded if the version already supports them.