Adobe Community: Coldfusion 10 Case Sensitive URLs?!?

Currently Being Moderated

1. Adam Cameron.,

May 18, 2012 12:37 AM in reply to kevinmkr

Report

OK... you asked for it: you're wrong ;-)

I don't doubt yer seeing what yer seeing, but it's CF10/Tomcat ain't case-sensitive as far as URLs goes out of the box. So there's some vagary of your set up which you're not telling us about (which is not hard: you don't tell us much about it) which is impacting your situation.

Here're these forums guidelines as to how best to post a question:

http://forums.adobe.com/thread/607238

Especially relevant here is your system config.

--

Adam

|

Mark as:

Currently Being Moderated

2. BKBK,

May 18, 2012 9:32 AM in reply to kevinmkr

Report

I think you're actually right, Kevinmkr. I also encountered case-sensitivity in URLs some time ago, but ignored it. Your post has made me revisit the issue. From what I have read so far, case-sensitivity might in fact be the (intended) default behaviour of Tomcat.

|

Mark as:

Currently Being Moderated

3. kevinmkr,

May 20, 2012 7:55 PM in reply to kevinmkr

Report

Ok, thanks for the feedback so far. Adam, I *do* think that I'm ultimately correct, as BKBK pointed out. However, I think you have a point that I neglected some very important information. I will provide that now (along with my theory on the cause)....

I am on Windows 2003 Server 32-bit running CF10. I am *not* using IIS (this is the key here, I believe) but, rather, using the built-in CF server (now Tomcat).

I'm thinking that the issue doesn't lie with CF (directly) but, rather, lies with the "web server" aspect of CF. As long as you are running IIS (or some other 3rd party web server) to serve your websites on Windows, you will not necessarily experience the issue. But if you are on a dev install running the "CF" server (Tomcat), you will. Everything I've found online suggests that Tomcat descriminates by nature (and, as of version 6, allows no option to override) between cases. So, TEST.HTML and test.html are not the same under the Tomcat web server. Again, I'm *assuming* that this descrimination is limited to the web server itself and NOT to Coldfusion (which has always been case-insensitive -- StructKeyExists() = structkeyexists() = STRUCTKEYEXISTS()) and does *not* pose an issue if you are using a 3rd party web server (such as IIS). Regardless, it *is* frustrating to have a common standard such as case-insensitivity suddenly go by the wayside because Adobe decided to replace their built-in web server with a more restrictive one.

Adobe, I'm talking to you -- you've replaced your previously case-insensitive web server with a new case-sensitive one. Your users deserve a method to upgrade with backwards compatibility, no?

|

Mark as:

Currently Being Moderated

4. Adam Cameron.,

May 20, 2012 11:10 PM in reply to kevinmkr

Report

Adobe, I'm talking to you -- you've replaced your previously case-insensitive web server with a new case-sensitive one. Your users deserve a method to upgrade with backwards compatibility, no?

I'm running the dev install and using the inbuillt web server. I've run it on Win7, Win Vista and Win Server 2003 (32-bit), and that accounts for about a dozen installs. I am also aware of around 50 (at least) other installs made by different people, and I've heard no reports of case-sensitivity. And trust me... these people would have reported it (it being their job in this instance to specifically test the product).

CF10 (beta, and now "actual") has been available to the gen. pop. for a few months now, and I've heard no one else having experienced this.

Again, I don't doubt you're seeing what you're seeing, but it's not a case of the default install of the default web server treats URLs case-sensitively.

NB: Adobe host these forums but it is not an official support channel, and if anyone from Adobe participate here, it's in their own time. If you want to speak to Adobe, you need to raise a support ticket with them.

--

Adam

|

Mark as:

Currently Being Moderated

5. BKBK,

May 21, 2012 4:15 AM in reply to Adam Cameron.

Report

Adam Cameron. wrote:

I'm running the dev install and using the inbuillt web server. I've run it on Win7, Win Vista and Win Server 2003 (32-bit), and that accounts for about a dozen installs. I am also aware of around 50 (at least) other installs made by different people, and I've heard no reports of case-sensitivity. And trust me... these people would have reported it (it being their job in this instance to specifically test the product).

CF10 (beta, and now "actual") has been available to the gen. pop. for a few months now, and I've heard no one else having experienced this.

Again, I don't doubt you're seeing what you're seeing, but it's not a case of the default install of the default web server treats URLs case-sensitively.

NB: Adobe host these forums but it is not an official support channel, and if anyone from Adobe participate here, it's in their own time. If you want to speak to Adobe, you need to raise a support ticket with them.

Did any of those tests involve static(non-ColdFusion) URLs? For such URLs, Tomcat indeed enforces case-sensitivity. I have reproduced this on ColdFusion 10 Beta and on the recently released ColdFusion 10.

Copy an image file, myPic.jpg, say, to the directory myImages, under the web root. Open the URL in the browser, for example, http://127.0.0.1:8500/myImages/myPic.jpg. You should see the image as expected.

Now, rename the file to MYPIC.jpg. Open the same URL as before. In my example, that would be http://127.0.0.1:8500/myImages/myPIC.jpg. You won't see the image. Instead, you will get something like:

HTTP Status 404 - /myImages/myPIC.jpg

type Status report

message /myImages/myPIC.jpg

description The requested resource (/myImages/myPIC.jpg) is not available.

Apache Tomcat/7.0.23

|

Mark as:

Currently Being Moderated

6. Adam Cameron.,

May 21, 2012 4:39 AM in reply to BKBK

Report

Did any of those tests involve static(non-ColdFusion) URLs? For such URLs, Tomcat indeed enforces case-sensitivity. I have reproduced this on ColdFusion 10 Beta and on the recently released ColdFusion 10.

Yikes.

You're right.

Also CFM files have case-sensitive file extensions. eg: index.cfm is the same as INDEX.cfm, but not the same as index.CFM.

Apologies to the OP for saying he's wrong. I had indeed only tested with CFM files, and I had only ever varied the capitalisation of the file name, not the extension.

I am in a position to make sure Adobe know about this, and will do so right now.

--

Adam

|

Mark as:

Currently Being Moderated

7. BKBK,

May 21, 2012 4:53 AM in reply to BKBK

Report

BKBK wrote:

Now, rename the file to MYPIC.jpg. Open the same URL as before. In my example, that would be http://127.0.0.1:8500/myImages/myPIC.jpg. You won't see the image. Instead, you will get something like:

HTTP Status 404 - /myImages/myPIC.jpg
type Status report
message /myImages/myPIC.jpg
description The requested resource (/myImages/myPIC.jpg) is not available.
Apache Tomcat/7.0.23

Sorry I copy-pasted a similar, but different, Tomcat response. That should actually read:

Now, rename the file to MYPIC.jpg. Open the same URL as before. In my example, that would be http://127.0.0.1:8500/myImages/myPic.jpg. You won't see the image. Instead, you will get something like:

HTTP Status 404 - /myImages/myPic.jpg

type Status report

message /myImages/myPic.jpg

description The requested resource (/myImages/myPic.jpg) is not available.

Apache Tomcat/7.0.23

|

Mark as:

Currently Being Moderated

8. kevinmkr,

May 21, 2012 7:36 PM in reply to kevinmkr

Report

Thank you both for your feedback. Here's hoping that Adobe is willing to compile their own version of Tomcat which will allow us to toggle the case sensitivity.

|

Mark as:

Currently Being Moderated

9. Adam Cameron.,

Jun 1, 2012 4:59 AM in reply to kevinmkr

Report

I spoke to members of the Adobe CF team and asked them to feedback on this thread. Unfortunately they didn't seem to bother (or forgot, or something).

:-(

--

Adam

|

Mark as:

Currently Being Moderated

10. kevinmkr,

Jun 27, 2012 11:40 AM in reply to kevinmkr

Report

I'm happy to report that somebody has found a workaround. I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.

From Chad Baloga on HouseOfFusion:

"

Found out how..

look for context.xml under {drive}\ColdFusion10\cfusion\runtime\conf

Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">

Restart the CF service
"

Why you set it to "true" and not to "false" is beyond me. But I'm not too concerned. It works, which means that I don't need to update thousands of templates nor do I have to install IIS right now.

|

Mark as:

Currently Being Moderated

11. Adam Cameron.,

Jun 27, 2012 3:17 PM in reply to kevinmkr

Report

Change the context tag to look like: <Context AllowLinking="true" caseSensitive="true">

DO NOT DO THIS ON WINDOWS SERVERS.

Read the docs:

http://tomcat.apache.org/tomcat-5.5-doc/config/context.html#Standard_I mplementation:

Excerpt:

allowLinking

If the value of this flag is true, symlinks will be allowed inside the web application, pointing to resources outside the web application base path. If not specified, the default value of the flag is false.

NOTE: This flag MUST NOT be set to true on the Windows platform (or any other OS which does not have a case sensitive filesystem), as it will disable case sensitivity checks, allowing JSP source code disclosure, among other security problems.

Why you set it to "true" and not to "false" is beyond me.

See above.

But I'm not too concerned.

Yeah, OK, provided you only do this on your dev system, sure.

I'm really hesitant about you promoting this idea as a valid answer to this issue without adding the caveats that come along with it. I'd hate someone to read that and think it's something they should do.

--

Adam

|

Mark as:

Currently Being Moderated

12. kevinmkr,

Jun 27, 2012 5:53 PM in reply to Adam Cameron.

Report

1) I made it EXTREMELY clear in my response that I felt it should only be used for dev purposes. To reiterate my original point:

I'm sure this is probably only a good idea on a development system as a transitioning tool but, regardless, it works.

2) It lists JSP code exposure as a potential problem (which is of absolutely no concern for Coldfusion developers, no?). "Among other security concerns" is conveniently vague. It's like saying, "we don't know of any other problems but we REEAAAALLLLY don't want you to do this because something else might pop up in the future." Fine. See #1.

3)

I'm really hesitant about you promoting this idea as a valid answer to this issue without adding the caveats that come along with it. I'd hate someone to read that and think it's something they should do.

My original question was posted as to whether or not there was a way to turn off case-sensitivity. That question was solved. Your caveats are duly noted.

|

Mark as:

Currently Being Moderated

13. Adam Cameron.,

Jun 27, 2012 10:56 PM in reply to kevinmkr

Report

I dunno if that's making it extremely clear, but fair enough.

For all intents and purposes, CFMs are JSPs. Just written in a different source language.

The issue is - from what I can gather / intuit - is that it would be possible somehow for the web server to accept the URL, but the servlet handler not to handle it and simple return the source code instead of processing it. However as you say they're vague (I would say purposely...) as to what the story actually is.

I reckon it'd just be better if the Apache Tomcat team got their heads out of their arses (their arses being located somewhere in the 1980s) and accepted that Windows exists, and indeed as a certain ubiquity, and if theiy're going to implement their software to run on it, they should do it properly. But that's unlikely to happen, I guess.

--

Adam

|

Mark as:

Currently Being Moderated

14. itisdesign,

Jun 30, 2012 12:38 AM in reply to kevinmkr

Report

Hi all,

The CF10 case-sensitivity bugs (#3199281 & #3199283) are both thankfully marked Open/ToFix! Awesome.

Thanks,

-Aaron

|

Mark as:

Currently Being Moderated

15. original_somedude,

Feb 25, 2013 2:29 PM in reply to kevinmkr

Report

Just to chime in with a late "Me Too".

Windows 7 workstation, using builtin web server, CF10.

|

Mark as:

Currently Being Moderated

16. Kibbage.TEESO,

ColdFusion

Coldfusion 10 Case Sensitive URLs?!?

May 17, 2012 9:22 AM

More Like This

Bookmarked By (0)

Answers + Points = Status