tracker issue : CF-4199020

When I install ColdFusion on a Linux VM running inside of VirtualBox on a case insensitive host (like WIndows) and place the CFIDE folder in a location that's mounted to a folder on the host machine, pages in the administrator such as the Datasources list page in the administrator throw the following exception.  (stack trace trimmed)

coldfusion.security.SecurityManager$UnauthenticatedCredentialsException
	at coldfusion.security.SecurityManager.getAdminHash(SecurityManager.java:2298)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.lang.reflect.Method.invoke(Method.java:498)
	at coldfusion.runtime.StructBean.invoke(StructBean.java:508)
	at coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:3168)
	at coldfusion.runtime.CfJspPage._invoke(CfJspPage.java:3068)
	at cfApplication2ecfm1669273262._factor9(/CFIDE/administrator/Application.cfm:171)
	at cfApplication2ecfm1669273262.runPage(/CFIDE/administrator/Application.cfm:1)
	at coldfusion.runtime.CfJspPage.invoke(CfJspPage.java:251)
	at coldfusion.tagext.lang.IncludeTag.handlePageInvoke(IncludeTag.java:737)
	at coldfusion.tagext.lang.IncludeTag.doStartTag(IncludeTag.java:573)
	at coldfusion.runtime.CfJspPage._emptyTcfTag(CfJspPage.java:3698)
	at cfApplication2ecfm478229027.runPage(/CFIDE/administrator/datasources/Application.cfm:8)

This is a common setup now that we're using Docker for a lot of local development, which makes heavy use of folders mounted to the host machine.

This is a tricky bug and actually not related to the admin at all, but due to mishandling of file case sensitivity (The VM OS is case sensitive, but the mounted folder is not)  The core issue is that the internal canonical path to any CFIncluded file has the file name lowercased in this scenario.  I don't know how or why that is happening, but I know it's causing the above exception in the admin because when the root Application.cfm is cfincluded from datasources/Application.cfm it's canonical name has a lower case "a" which fails the security checks.  

It is possible to reproduce the core bug in a standalone scenario without even messing with the administrator.  Create two files in a folder with the following code:

index.cfm
<cfinclude template="Foo.cfm" >

Foo.cfm (Note the uppercase "F")
<cfscript>
	myPage = getPageContext().getPage();
	myParent = createObject( 'java', 'coldfusion.runtime.CfJspPage' ).getClass().getDeclaredField("parent").get( myPage );
	writeDump( myParent.getCanonicalLocation() );
</cfscript>


Now start ColdFusion on a Linux VM and hit the index.cfm with the code on the local drive.  You will see the correct output on the screen of /path/to/local/folder/Foo.cfm

Now map a folder to the host Windows machine, move the files there, and point ColdFusion's web root to this mounted folder.  The code will run as before, but this time you'll get the following incorrect output of /path/to/mounted/folder/foo.cfm

Even though the file name is "Foo.cfm", the internal canonical name for the include is set to "foo.cfm".

Attachments:

1. September 14, 2017 00:00:00: hf201600-4199020.jar

Comments: