Title:
Post ColdFusion Security Hotfix APSB13-10 - error on JSON returned with debug on
| View in TrackerStatus/Resolution/Reason: Closed/Fixed/
Reporter/Name(from Bugbase): Ross Phillips / Ross Phillips (ross_phillips)
Created: 04/18/2013
Components: AJAX
Versions: 9.0.1
Failure Type: Crash
Found In Build/Fixed In Build: 9.0.1 /
Priority/Frequency: Critical / All users will encounter
Locale/System: English / Windows 7
Vote Count: 12
Problem Description:
After completing the install process of the hotfix (APSB13-10) I get the following error when debugging ("Enable Request Debugging Output") is on and the response comes from a remote function whose returnformat is JSON.
Steps to Reproduce:
This is the test component:
<cfcomponent>
<cffunction name="myfunc" access="remote" returntype="struct" output="true" returnformat="JSON">
<cfscript>
var st = {};
st["name"] = "ross";
return st;
</cfscript>
</cffunction>
</cfcomponent>
Called in the following fashion:
http:/localhost/test.cfc?Method=myfunc
Actual Result:
<head><title>JRun Servlet Error</title></head><h1>500 </h1><body>
<pre>
coldfusion.server.DebuggingService.getShowAjaxDebug()Z</pre><br><pre>
javax.servlet.ServletException: coldfusion.server.DebuggingService.getShowAjaxDebug()Z
at coldfusion.xml.rpc.CFCServlet.invoke(CFCServlet.java:155)
at coldfusion.xml.rpc.CFCServlet.doGet(CFCServlet.java:265)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:740)
at org.apache.axis.transport.http.AxisServletBase.service(AxisServletBas e.java:327)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:8 9)
at jrun.servlet.FilterChain.doFilter(FilterChain.java:86)
at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringS ervletFilter.java:42)
at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46 )
at jrun.servlet.FilterChain.doFilter(FilterChain.java:94)
at jrun.servlet.FilterChain.service(FilterChain.java:101)
at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106)
at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
at jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java: 286)
at jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java: 543)
at jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.ja va:203)
at jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.j ava:428)
at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)
</pre></body>
Expected Result:
{"name":"ross"}
Any Workarounds:
None other than not installing the hotfix or not using debugging output when developing.
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 3544895
External Customer Info:
External Company:
External Customer Name: ross_phillips
External Customer Email:
External Test Config: My Hardware and Environment details:
Windows 7 Enterprise (64bit)
IIS 7.5Attachments:
Comments: