This seems like a bug...

writedump(getFileFromPath("<s3://testbucket/APDF.pdf>"))

Result

java.lang.RuntimeException
{SECRET_ACCESS_KEY}: Could not found accessKeyId / secretAccessKey. You can define the credentials as part of the path itself in various ways s3://{accessKeyId}:{SECRET_ACCESS_K.....

Are you utilizing um the S3 credentials that are required?

No, I certainly dont want a

getFileFromPath()

call to go anywhere near the actual S3 buckets

Then what is the bug, I am not following your issue

Anymore than I want a

getFileFromPath("/etc/passwd")

to access

/etc/passwd

Sounds like you need to place security restrictions on what Lucee has access to

I am fairly certain you dont understand the issue here

You are stating that a function shouldnt perform its actual operation based on a certain path you are giving it..."Extracts a filename from an absolute path."

Have a look at the tryCF gist

Yes, I can run that anywhere I want, it will never ACTUALLY ACCESS

file.txt

s3 is considered a virtual file system and the file system tools are built for use with it

What?? Please, have a look at the tryCF again

Since you arent being clear; are you stating, that function should NEVER access but merely read from the path provided and return the name?

Patrick, Im being as clear as I can be, the TryCF shows that the getfilefrompath function simply returns the filename from a path. It doesnt have to be an actual path, the file doesnt have to exist, unless you are suggesting that the server tryCF runs on actually has both

c:/windows/system32/test.dll

and

/etc/passwd

and that the Lucee instance that TryCF is running on has access to those files.

So yes, we are now on the same page. Appears using s3: in any of the file functions likely has some middle functionality for interactions with s3 related stuff

It shouldnt, because its just a function to return the file part of a path

I understand your stance; just not sure what

s://

should be considered

It shouldnt be considered at all, any more than

getFileFromPath("<mysql://var/mysql.sock>")

should try to open a MySQL connection

Like I said, I am torn on it. Because s3 is a file storage virtual path but that path needs auth against it. Yes same should occur if accessing a c:/windows type path if not authorized. But yea not sure, im 50/50

Consider this example, my app doesn't use S3 at all as a backend, but I let people store links to S3 bucket objects, or http links. Im my object table Im going to store the full path the customer adds, but on the display page, I want to display just the filename. This bug means you cannot do

getFileFromPath("<s3://customer-bucket/path/file.txt>")

, but you can do

getFileFromPath("<https://mysite.com/path/file.txt>")

Yea agree with you in that circumstance