createObject work around?

[Dinghus]

I have a customer on a Godaddy with ColdFusion 8. BUT Godaddy doesn't allow cfobject or createobject() and part of his code is to create a java ojbect.

Specifically

createObject("java","javax.crypto.spec.SecretKeySpec")

createObject("java","javax.crypto.Mac")

I've tried making these into cfinvokes but no luck. Maybe I'm doing it wrong. Anybody have a suggestion or 2?

[Adam Cameron.]

I realise that "don't use godaddy" is not very helpful advice, but I think that's about the best advice you're gonna get.  From a technological POV, I think you're sunk.  From a moral point of view, it's clear that godaddy do not want you using Java objects, so you shouldn't use them if you are going to be using their service (you will have agreed to this in your T&Cs).  It would be a) disingenuous of you; b) violate your T&Cs if you were to circumvent the intent of their restrictions, and they'd probably be able to axe your site immediately if they found out, if that's how they felt like reacting.

That said: any half-decent CF provider will have long since removed the need for that sort of disabling-tags carry-on, and you should vote with your feet / cheque book.

--

Adam

[Dinghus]

Adam, did you miss the "client" part? lol

But in response, GoDaddy is actually a pretty good hosting service overall. Their uptime is the best I've seen especially for the price.

What is interesting about this is you can access the same objects usuing PHP. So maybe I'll do those functions in PHP and put the results somewhere that CF can get to them.

As far as changing hosts, this site was on HostingAtoZ.com. They suck. Seriously through customers and my own experiences, unless you are willing and able to shell out some big bucks for a dedicated server, GoDaddy is about the best you are going to really get for performance.  These small inexpensive hosting sites are obviously getting a VPS or dedicated server and packing as many accounts on them as possible making the server unstable.  One site can cause the whole deck of cards to crash and it does on a regular basis.  It was almost a weekly thing to be submitting a ticket for the site being down.

Maybe I'll try to convince all my clients to let me move them to a new host and go get a dedicated server just for me.

I will take it that the answer to using cfinvoke to get a java object is "NO".  Thus I will have to go the PHP route.

[Adam Cameron.]

Adam, did you miss the "client" part? lol

Not at all.  My clients pay for my expertise and for my advice.  My expert advice would be for them to move providers.  Or the price of the project would increase because I'd need to work around the shortcomings of their hosted solution.  Or they don't get the functionality.  It's got to be one of those three options, hasn't it?  And having a stable and professionally hosted platform is a pretty significant consideration.  And godaddy - from what I hear, which is at odds with your experience though - are... well... well you get what you pay for, I guess.  I'd rather pay more and get a proper service.

It might be worth asking godaddy how it is those classes are available on PHP and not CF, as it seems to make little sense.  That's if you can find anyone to talk to there who actually knows.

To confirm what you asked about <cfinvoke>... no, it's for components and web services. http://help.adobe.com/en_US/ColdFusion/9.0/CFMLRef/WSc3ff6d0ea77859461172e0811cbec22c24-7e0a.html

--

Adam

[Dinghus]

Yeh. Problem is I was the one who recommended moving to HostingAtoZ.  So  ......

I am surprised how many people have negatives to say about Godaddy. Other than the cfobject/createObject problem, I've had no problems with them and they have answered all my questions in a timely manner.  The only ones who I have found to be as good is RackSpace and they are very expensive.

I may just see if I can talk to one of their engineers. Maybe this is just a hold over or something.

[Adam Cameron.]

I may just see if I can talk to one of their engineers. Maybe this is just a hold over or something.

Let us know how you get on...

--

Adam

[Jochem van Dieten]

Native Java classes can not be secured in CF 8 in any other way then through disabling cfobject and createObject("java", ..). Compared to the alternative, I think that disabling Java with proper disclosure in the FAQ is definitely the better alternative.

[ilssac]

Unfortunatly the answer is to go with a hosting Plan and|or Provider that allows the use of the desired functionality OR do without the functionality.

The reason that createObject() or any similar functionality is often disallowed on many shared plans is that it is difficult to limit what type of objects are accessed.  If your client could access his createObject("java","javax.crypto.spec.SecretKeySpec") objects, he or another user could also access the createobject("java", "coldfusion.server.ServiceFactory") object.  And this object pretty much would give that user compete access to the ColdFusion applicaiton server and all the clients on the shared system using it.