I'm getting this error being reported occasionally from v5.4.0.80

In the OSGi Bundle with the name [esapi.extension] and the version [2.2.4.13] was no class with name [org.lucee.extension.esapi.functions.EncodeForJavaScript] found. org.lucee.extension.esapi.functions.EncodeForJavaScript

I've traced the elderly code to this block but I'm still not sure what invokes it or what variables contain.

<cfloop query="qVehicleCategories">
	<cfset categoryList = categoryList & '"#encodeForJavaScript( qVehicleCategories.CategoryDescription )#^' & encodeForJavaScript( qVehicleCategories.CategoryDescription ) & ' (' & qVehicleCategories.NoVehicles & ')' & '",'>
</cfloop>

I've not experienced this type of error before and would like some advice on what the issue might be: • v5.4.0.80 • The install of Lucee itself (CommandBox) • The code (not mine!)

hmmm, odd, does it happen with just that line in standalone application when you run a load testing tool over it (like jmeter?)

Not being load tested, just in the normal run of a very elderly application. We were using 5.3.120 before and have not seen this issue before. I didn't know if something hadn't been installed that

encodeForJavaScript()

was dependent upon?

5.3.10 has 2.2.4.8 could be a regression https://github.com/lucee/Lucee/blob/5.3/core/src/main/java/META-INF/MANIFEST.MF#L381C69-L381C76

Should I dial back to 5.3 or see if the issue returns?

try downgrading the extension, normal is prod or mucking around in dev?

Please excuse my inexperience in these matters but how do I downgrade an extension (documentation link) and can I save that in CommandBox/CFConfig?

can you access the lucee admin?

Yep

then go to applications - > extensions in the server admin

Gotcha, thanks. Can I capture that extension version change in CFConfig? I might leave it 2.2.4.13 for now and see if the issue returns and downgrade if it does. I'll keep you informed and see if I can produce a reliable test case.

@richard.herbert You can use the LUCEE_EXTENSIONS environment variable to specify which extensions/versions to install, and EVs can be configured in your

server.json

using the

env

setting: https://commandbox.ortusbooks.com/embedded-server/configuring-your-server/ad-hoc-env-vars

Interesting, so I would set an env var as

LUCEE_EXTENSIONS_[extension_id]=[extension_version]

?

Not sure about that... .Here's an example from one of my server.json files:

"env":{
        "LUCEE_EXTENSIONS":"F2FA5DB2-0C27-499C-B1171D2D812FDAF9;name=MariaDB,FAD1E8CB-4F45-4184-86359145767C29DE;name=Hibernate ORM Engine;version=3.5.5.89,8D7FB0DF-08BB-1589-FE3975678F07DB17;name=Compress Tags,37C61C0A-5D7E-4256-8572639BE0CF5838;name=ESAPI extension,CED6227E-0F49-6367-A68D21AACA6B07E8;name=Lucee Administrator"
    }

Ah, gotcha, I'll have a play with that, thanks!

There are others ways of specifying Lucee extensions in Commandbox, this is the one I'm currently using. One downside is that's it's not very human readable. I've tried formatting the lines but commandbox always forces it back to that single-line value.

you don't say.... https://luceeserver.atlassian.net/browse/LDEV-2472

@zackster The IDs are part of what makes it illegible, but it's also the fact that it's a single line list.

took me a while to convince micha that we should allow non guids

Thank you. I'll keep my eye on it and add any other experiences I have in this area, 👍