tracker issue : CF-4203092

select a category, or use search below
(searches all categories and all time range)
Title:

when Application Sandbox Security is turned on, CFPDF action="processDDX" fails

| View in Tracker

Status/Resolution/Reason: Closed/Fixed/

Reporter/Name(from Bugbase): Yuliang Ruan / ()

Created: 07/17/2018

Components: Document Management, PDF manipulation

Versions: 2016

Failure Type: Crash

Found In Build/Fixed In Build: 2016.0.06.308055 C:/ColdFusion2016/cfusion/lib/updates/chf20160006.jar JRE 1.8.0_171 / V13.0

Priority/Frequency: Normal / All users will encounter

Locale/System: English / Win 2016

Vote Count: 0

Problem Description:

Steps to Reproduce:
in CFIDE, turn on sandbox security.   enable ALL tag, function and other permissions.    add read,write,delete permission for   C:\ColdFusion2016\cfusion\tmpCache\tmpPdf     

execute code with <cfpdf action="processDDX">    throws exception 
Could not initialize class coldfusion.pdf.PDFDocOperation The specific sequence of files included or processed is:  "
java.lang.NoClassDefFoundError: Could not initialize class coldfusion.pdf.PDFDocOperation
	at coldfusion.tagext.lang.PDFTag.doStartTag(PDFTag.java:1539)

Actual Result:

Output stream is interrupted.  coldfusion-error.log has entry
Jul 17, 2018 9:00:21 AM org.apache.catalina.core.ApplicationDispatcher invoke
SEVERE: Servlet.service() for servlet [jsp] threw exception
java.lang.IllegalStateException: getOutputStream() has already been called for this response

Expected Result:

Any Workarounds:
turn off sandbox security completely and restart service.  completely negating the point of security

Attachments:

Comments:

Hi Yuliang, Thanks for raising this concern. In fact, we have already addressed the above issue. And will be available to you in one of the upcoming BugFix updates. Thanks!   
Comment by S Preethi
29385 | July 24, 2018 08:04:26 AM GMT
thanks for letting me know. Do you have a timeframe for the next HF update? is it fixed in CF2018 release?
Comment by Yuliang Ruan
29391 | July 24, 2018 01:15:24 PM GMT
alternatively, can you provide the fix jar? this is blocking our upgrade in live environment.
Comment by Yuliang Ruan
29392 | July 24, 2018 04:04:10 PM GMT