|
Avoiding Those "Hidden" Features
By Raymond Camden
Expert Author
Article Date: 2007-08-28
I've said more than once that folks should avoid using hidden, undocumented features in ColdFusion.
This warning applies especially to the ServiceFactory.
Did you know that in ColdFusion 8 you can restrict access to the factory?
In the settings page there is a new option: Disable access to internal ColdFusion Java components
Disables the ability for CFML code to access and create Java objects that are part of the internal ColdFusion implementation.
This prevents an unauthenticated CFML template from reading or modifying administration and configuration information for this server. So what happens when this is enabled?
Consider this simple code:
<cfset monitor = createObject("java", "coldfusion.runtime.RequestMonitor") />
With the above option disabled, it runs fine, but when turned on, you will get: Permission denied for creating Java object: coldfusion.runtime.RequestMonitor.
Access to Java objects in the ColdFusion package has been disabled by the administrator. So just keep it in mind when developing.
I won't deny that I've used these internal objects myself in the past, but now I avoid them like the plague. Almost anything you need (almost) is available via the Admin API anyway.
Comments
About the Author:
Raymond Camden, ray@camdenfamily.com
http://ray.camdenfamily.com
Raymond Camden is Vice President of Technology for roundpeg, Inc. A long
time ColdFusion user, Raymond has worked on numerous ColdFusion books
and is the creator of many of the most popular ColdFusion community web
sites. He is an Adobe Community Expert, user group manager, and the
proud father of three little bundles of joy.
|
|
