Regression: Lucee gets confused and renders wrong file (with same name)

Description

There is some subtle timing problem that results in Lucee getting confused about which index.cfm file to render. For example, I request /sso/index.cfm, but Lucee renders /index.cfm. Using the FusionReactor debugger, I can confirm that CGI.script_name is /sso/index.cfm, so it's not a rewrite problem. It's also perhaps worth mentioning that /sso/Application.cfc extends the root Application.cfc.

On our production servers, we have seen the exact same code behave differently in this regard. For example, one server was rendering the wrong index.cfm at /sso/index.cfm, another was doing so at /socket/cxml/index.cfm, and a third had no problem with either subdirectory.

I was able to reproduce this once locally (in my Docker-based dev env) on 5.3.3.63, but it's very difficult to repro due to the timing issues. I also have not been able to repro the problem outside of my application.

Downgrading our production servers to 5.3.3.60 cleared up the problem, and I haven't been able to repro locally on 5.3.3.60.

I suspect that this change may be the culprit, because it modifies class loading behavior. https://github.com/lucee/Lucee/commit/32c292627981f0bc97fc59db737a282f36116afe . That change has no associated tests or tickets, so I'm not sure what problem it was meant to fix.

We will continue to run on 5.3.3.60 for a few days and I will update this ticket later in the week to confirm whether the downgrade seems to have fixed the problem.

Environment

Lucee 5.3.3.62
Docker, and also CentOS 7.7
FusionReactor 8.2

Status

Assignee

Unassigned

Reporter

Leon Miller-Out

Labels

Affects versions

5.3.3.62

Priority

Critical
Configure