On March 12, 2024 ColdFusion (2021 release) Update 13 introduced a change with significant implications for developers, particularly for developers managing older code that could be “leveraging” a “feature” of ColdFusion whereby ColdFusion would forgivingly “search” through scopes in a specific order if a variable name is not prefixed with a scope identifier.
Rather than re-explain all the details here, Pete Freitag has a great write-up of the unscoped variable issue.
The release notes for the update also contain a section titled Significant changes in the release which details the issue and provides 2 options for “fixing” the issue.
Option 1: Correct application code to fetch values from the correct scope.
This option is obviously the ideal one, but how do you locate the offending code? If you are fortunate enough to use Fixinator there is an option to scan for the issue. See this post for how to use Fixinator.
If you don’t have Fixinator you can implement Option 2 and then use the new patch provided by Adobe to help find issues.
Option 2: Set searchimplicitscopes value back to TRUE.
This can be accomplished by doing the following:
- Add the newly introduced flag, -Dcoldfusion.searchimplicitscopes=true to the jvm arguments
- Set searchimplicitscopes key to TRUE in Application.cfc or Application.cfm to override the jvm flag set at the server level:
this.searchimplicitscopes = true
Using the patch to find issues
Once you have Option 2 in place Adobe introduced a patch on April 1, 2024 to allow developers to view unscoped variables in a log file.
Link to the patch: https://helpx.adobe.com/coldfusion/kb/view-unscoped-variables-log-file.html
How to apply the patch
- Copy the patch to
cfusion/lib/updates. - Restart ColdFusion.
Once I had the patch in place I went to my application and just started using it. Within the first view pages the log file had entries.
How to view the log file
Navigate to the /cfusion/logs and locate the log file: unscoped.log. The unscoped variable is appended to the template name as :VARIABLENAME
"Severity","ThreadID","Date","Time","Application","Message"
"Information","XNIO-1 task-2","04/09/24","09:32:12","applicationName","/pathToApp/render.cfm:BTNSUBMIT"
"Information","XNIO-1 task-1","04/09/24","09:34:36","applicationName","/pathToApp/add.cfm:BTNSUBMIT"
"Information","XNIO-1 task-2","04/09/24","09:35:24","applicationName","/pathToApp/edit.cfm:DETAILID"
"Information","XNIO-1 task-2","04/09/24","09:35:24","applicationName","/pathToApp/edit.cfm:DETAILID"
"Information","XNIO-1 task-2","04/09/24","09:35:30","applicationName","/pathToApp/edit.cfm:BTNSUBMIT"
"Information","XNIO-1 task-2","04/09/24","09:35:49","applicationName","/pathToApp/received.cfm:BTNSUBMIT"
"Information","XNIO-1 task-3","04/09/24","09:41:06","applicationName","/pathToApp/note.cfm:BTNSUBMIT"
I’m going to implement this workflow and monitor the unscoped.log file daily to make corrections. Once some of the issues are identified in the unscoped.log file it becomes easier to use find/replace for common issues in the codebase.
For additional reading here is a good ColdFusion forum post: View unscoped variables in a log file