6

I am currently having issues with users (or bots, not sure) visiting non-existent links that have three periods in a sub-directory.

For example, if someone goes to:

http://www.example.com/.../test/index.cfm?

Then I receive the following error:

String index out of range: -1 null
The error occurred on line -1.

I have tested it with just 1 period and just 2 periods and it goes straight to a 404 error. Any link though that has 3 or more periods will cause this error.

My question is what can I do to stop this from happening? My thoughts are to send them to a 404 error page or redirect them. How could I do that?

I am running ColdFusion 8.0.1 on Microsoft-IIS/7.0.

Edit from Miguel-F

I have duplicated this issue with ColdFusion 9.0.1 on IIS 7.5 and also noticed it during PCI scans.

Error:

java.lang.StringIndexOutOfBoundsException

Stacktrace:

java.lang.StringIndexOutOfBoundsException: String index out of range: -1 at
java.lang.AbstractStringBuilder.delete(Unknown Source) at 
java.lang.StringBuffer.delete(Unknown Source) at 
coldfusion.util.Utils.collapseDotDots(Utils.java:647) at 
coldfusion.util.Utils.canonicalizeURI(Utils.java:601) at 
coldfusion.filter.PathFilter.invoke(PathFilter.java:43) at 
coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:70) at 
coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:28) at
coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38) at 
coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:46) at 
coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38) at 
coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22) at 
coldfusion.filter.CachingFilter.invoke(CachingFilter.java:62) at 
coldfusion.CfmServlet.service(CfmServlet.java:201) at 
coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:89) at 
jrun.servlet.FilterChain.doFilter(FilterChain.java:86) at 
coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:42) at
coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46) at 
jrun.servlet.FilterChain.doFilter(FilterChain.java:94) at 
jrun.servlet.FilterChain.service(FilterChain.java:101) at 
jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106) at 
jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42) at 
jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:286) at 
jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:543) at 
jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.java:203) at 
jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:428) at 
jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)
Miguel-F
  • 13,450
  • 6
  • 38
  • 63
ethanh
  • 125
  • 1
  • 7
  • 1
    Where is this error showing? Is it something from a plugin or browser or directly from CF? – volume one Oct 24 '13 at 22:53
  • I have noticed that I get the same error using ColdFusion 9.0.1 and IIS 7.5. – Miguel-F Oct 25 '13 at 12:00
  • Same here on CF 9.02 + IIS 7.5. CF 10 on built in server has this issue. Railo also throws an error. http://stackoverflow.com/questions/19594577/periods-in-url-cause-railo-error – James A Mohler Oct 25 '13 at 16:06
  • @volumeone, the error I provided is a snippet from a ColdFusion generated error that gets emailed to me. – ethanh Oct 25 '13 at 18:18
  • No such error with CF10 on IIS 7.5 here – volume one Oct 26 '13 at 19:16
  • 1
    Found another question similar to this one but no answer... http://stackoverflow.com/q/10928753/1636917 I have asked that OP if they found anything. – Miguel-F Oct 28 '13 at 12:45
  • @Miguel-F did you ever solved this? I am getting the same issue with CF10. I have the URL as mydomain.com/..mypage.cfm and it caused an exception error. The user will see my exception page, but ideally, it should be redirected to a homepage or show 404 page. – Jack May 14 '21 at 18:56
  • @Jack no, we never did resolve this issue. After upgrading to CF11 it was no longer a problem. We also updated Windows versions and Java versions. Not sure what actually fixed the problem. – Miguel-F May 17 '21 at 15:44

1 Answers1

0

Since you are on IIS, I would think you could use IIS URL rewrite to intercept and send a HTTP 400 (bad request) Error.

That'll catch it before it gets to Coldfusion.

Paul Sturm
  • 2,118
  • 1
  • 18
  • 23
  • I created a URL rewrite rule but have had no luck with it. Here is a screen grab of what I have set up: http://i.imgur.com/ZXjMzTy.png – ethanh Dec 04 '13 at 22:07