tracker issue : CF-4198401

select a category, or use search below
(searches all categories and all time range)

"<cfloop list=varName" without escaping the varName treats "varName" as a string

| View in Tracker

Status/Resolution/Reason: Closed/Withdrawn/AsDesigned

Reporter/Name(from Bugbase): Mosh Teitelbaum / Mosh Teitelbaum ()

Created: 03/13/2017

Components: Language

Versions: 2016

Failure Type: Incorrectly functioning

Found In Build/Fixed In Build: 2016.0.03.300466 /

Priority/Frequency: Normal / All users will encounter

Locale/System: ALL / Windows 10 64 bit

Vote Count: 0

Problem Description:

When using "<cfloop list=", if you use a variable whose value is the list contents as the value of the "list" attribute, without surrounding it with hashes/pound signs, ColdFusion treats the NAME of the variable as the list.

Steps to Reproduce:

<cfset theList = "1,2,3" />
<cfloop list=theList index="i">
 <cfoutput>#i#<br /></cfoutput>

Actual Result:


Expected Result:


Any Workarounds:

Surround the variable name with hashes/pound signs as in:

<cfloop list=#theList# index="i">



This behavior is expected. To provide list in the cfloop , the list name should be surrounded by hash.
Comment by Poonam J.
1088 | March 16, 2017 03:29:00 AM GMT
This behavior is expected. To provide list in the cfloop , the list name should be surrounded by hash. @Mosh: Could you check and confirm at your end?
Comment by Poonam J.
1089 | May 03, 2017 04:05:34 AM GMT
@Poonam: Yes, as you can see in my workaround, adding hashes around the variable works just fine. But I don't think behavior should be expected. In general in CF, a variable that is neither surrounded by hashes or quotes resolves to the value of the variable, not the name of the variable. For example: <cfset a = 5 /> <cfset b = a /> <cfoutput>#b#</cfoutput> outputs "5" and not "a". This is because, in the second line, the "a" variable is not surrounded by anything so it resolves to its value. In the same way: <cfset theList = "1,2,3" /> <cfloop list=theList index="i"> should be equivalent to: <cfset theList = "1,2,3" /> <cfloop list="1,2,3" index="i"> because the "theList" variable in the second line is not surrounded by anything.
Comment by Mosh T.
1090 | May 03, 2017 03:10:20 PM GMT
@Mosh : This behavior is expected and as-designed. The loop over list or array in CF , it should be surrounded by hash. cfset behavior is different compare to cfloop. This is as-designed.
Comment by Poonam J.
1091 | May 04, 2017 06:37:07 AM GMT
@Poonam: I can't argue whether or not it is as-designed. You guys define the language, so it is whatever you say it is. It just seems backwards to me that everywhere else in the language, an unescaped variable resolves to the variable's value but here, in this one instance, it resolves to its name. That's not the behavior of a consistent and well-defined language. Is there any other usage of an unescaped variable in CF that resolves to its name and not its value? This is the only case that I've ever run into. As I see it, all of the following should resolve to the value of the variable: <cfloop list=var index="i"> <cfloop list=#var# index="i"> <cfloop list="#var#" index="i"> and only the following should resolve to the name of the variables: <cfloop list="var" index="i">
Comment by Mosh T.
1092 | May 04, 2017 01:13:02 PM GMT
@mosh, You will the same behavior for in cfloop when looping over array or any other attribute like collection etc. Also, I understand your point here and will check on this ,if this can be taken as an enhancement. Thanks
Comment by Poonam J.
1093 | May 05, 2017 05:00:36 AM GMT
@Poonam: Thanks. It's a bit strange that only the <cfloop> tag functions this way. It's very inconcsistent compared to the rest of the language.
Comment by Mosh T.
1094 | May 05, 2017 03:02:50 PM GMT
This is expected behavior. cfset tag didnot require # sign for assignment, While all other tag expect # sign to evaluate the value.
Comment by Poonam J.
1095 | October 05, 2017 01:32:52 AM GMT
Why was this marked as "Withdrawn"? I didn't withdraw it. It was previously marked as "To- Fix". How did it change from that to "Withdrawn"?
Comment by Mosh T.
1096 | October 08, 2017 05:04:15 AM GMT
This was "Closed as withdrawn" by the Adobe team since we found the behaviour to be on expected lines. Apart from the cfloop tag, there are other tags too that need hashes (##) to be wrapped around the variable names. For example, if you run the code below, the output will be x and not 10. To see 10 as the output, you will need to use #x#. <cfset x = 10> <cfswitch expression=x> <cfcase value="10"> <cfoutput>#x#</cfoutput> </cfcase> <cfcase value="x"> <cfoutput>x</cfoutput> </cfcase> <cfdefaultcase> <cfoutput>default</cfoutput> </cfdefaultcase> </cfswitch>
Comment by Vamseekrishna N.
1097 | October 10, 2017 05:35:39 AM GMT