To enhance configuration flexibility, we are adding a setting that controls whether Lucee is permitted to execute precompiled bytecode files (.cfm) directly. By default, Lucee will allow direct execution of bytecode; however, this new setting provides administrators with the option to disable this feature if preferred.

Implementation Details

A new system property and environment variable, lucee.compiler.block.bytecode (or LUCEE_COMPILER_BLOCK_BYTECODE for environment variables), will allow direct bytecode execution to be toggled on or off.

Example Configuration:

• To block direct bytecode execution, set:

  • System property: -Dlucee.compiler.block.bytecode=true

  • Environment variable: LUCEE_COMPILER_BLOCK_BYTECODE=true

Error Handling: If the setting is enabled and direct bytecode execution is attempted, Lucee will throw a TemplateException with a message that includes guidance on how to adjust the configuration. The exception will read:

"Bytecode execution is disabled by environment configuration. Lucee is configured to prevent the execution of precompiled bytecode files (.cfm) directly. To enable bytecode execution, set the system property -Dlucee.compiler.block.bytecode=false or the environment variable LUCEE_COMPILER_BLOCK_BYTECODE=false."

Motivation

This update supports environments where control over bytecode execution is a priority, offering administrators enhanced configurability to tailor execution behavior as needed.