Cascading "Standard (CFML Default)" setting behaves differently than ACF

Description

The Standard (CFML Default) option for the Cascading setting in the Lucee Administrator does not function the same as ACF when it comes to local scoping of methods in a component.

The issue is if a local variable ends up being null, then Lucee will parse the scopes to look for the same variable name and if it exists, it will use that variable value, where as ACF will see a local variable that's set to null and not parse the scope tree.

This is leading towards a bunch of issues with our application, because anytime a local variable in a method ends up holding a null value and the request happens to have form/url parameters that match the variable name, the code does not behavior as expected.

Here's an example of the issue:

In the above case if you try to call the getValue() method, you would expect it to return a null value. However, if the request has a modelId variable in another scope (such as form.modelId) then the method returns that value.

For example, this returns `null` as you would expect:

 

However, if following will return `Hello World!` in Lucee, but ACF 10+ will return `null`.

 

This leads to all sorts of possible injection issues and is breaking our code.

Changing the setting to Strict does fix the behavior, but that breaks other parts of our application. The biggest issue is this setting is designed to mimic the logic of ACF but does not.

I've attached a demo that shows the behavior

.

Environment

Tomcat 9.45 / Luceee 5.3.7.48+ / CentOS 7

Attachments

1

Activity

Show:

dan.switzer@givainc.com 1 March 2022 at 17:06

/ ,

I’ve added a pull request to the Lucee docs:

Brad Wood 23 February 2022 at 19:35

I agree with the doc updates suggested above. You can send a pull directly to the Lucee docs and CFDocs.org, both of which use markdown or JSON on github.

https://github.com/lucee/lucee-docs/edit/master/docs/03.reference/01.functions/isnull/function.md

https://github.com/foundeo/cfdocs/edit/master/data/en/isnull.json

Just a note- before Lucee makes any decision on this ticket, it’s worth noting Adobe did mark their ticket “to fix” which would seem to imply they are willing to change their behavior to match Lucee’s. Of course, it remains to be seen if Adobe will actually ever do anything, or when they do, if they’ll do it correctly

dan.switzer@givainc.com 23 February 2022 at 17:28

If this existing behavior is deemed to be correct, I would recommend at least updating the docs for the isNull() function ( ) so they mention that to explicit check for null values in a UDF that you should scope the variable. Perhaps something like:


Determines whether given object is null or not.

When testing the presence of null values unscoped variables will use scope precedence to determine if the variable exists in any scope. This behavior differs from Adobe ColdFusion. So when testing when local variables in a function are null, it’s important to prefix the variable with the local scope.

For example, in the following code the variable name would return false for the isNull() if name ends up in a user supplied scope, such as the URL or FORM scopes:

In order to make sure that only the local name variable is checked, you would change the code to:


Brad Wood 22 February 2022 at 20:40
Edited

Lucee’s behavior is correct and Adobe’s is incorrect. Given CFML’s rules, null values do not exist. Therefore, if you were to dump out modelID, you would correctly scope-hunt up to the url scope where the variable would be resolved, therefore not being null. If you want null to be an acceptable value for a variable, then enabling full null support in Lucee will cause the code to work in the manner you want. Otherwise, just scoping your variable so it’s clear what you’re checking for null-ness will also work.

To summarize:

  • Given the rules of CFML echo( modelId ) returns a value because modelID is resolved to a found, non-null value

  • Therefore, isNull( modelID ) is correct to return false as the echo above clearly shows modelID not null.

  • If you want to explicitly check if local.modelID is null, then use the code isNull( local.modelID )

I have entered this ticket for Adobe’s incorrect behavior:

Which can be seen in this Gist:

dan.switzer@givainc.com 22 February 2022 at 14:16

Is there any update on this issue? I keep running into issues due to this behavior.

Details

Assignee

Reporter

Priority

New Issue warning screen

Before you create a new Issue, please post to the mailing list first https://dev.lucee.org

Once the issue has been verified, one of the Lucee team will ask you to file an issue

Affects versions

Created 18 May 2021 at 17:48
Updated 1 March 2022 at 17:06