We have just learned that ColdFusion 2021 Update 1...
# cfml-generalp
Pawel Czarnota
03/12/2024, 8:18 PMWe have just learned that ColdFusion 2021 Update 13 introduced variable scope changes. We have a lot of un-scoped variables, so we will be using the searchimplicitscopes=true flag as a temporary solution, but will need to fix this before next major upgrade. Does anyone know if there is a tool that we could use to find all un-scoped variables in our ColdFusion codebase?
f
foundeo
03/12/2024, 8:20 PM
Likely something I will be adding to https://fixinator.app in the near future, but it is not in the current version
👍 5
🤘 3
j
James Harris
03/12/2024, 8:21 PMSee a larger discussion in another channel here: https://cfml.slack.com/archives/C06TABBT8/p1710270949513319
James Harris
03/12/2024, 8:21 PMThe above is not an answer to your question directly, simply more information around the change.
s
Scott Haas
03/12/2024, 8:33 PMHands up if (like a doofus) you patched PROD and discovered this the hard way... 😐
😢 1
p
Pawel Czarnota
03/12/2024, 8:33 PMThanks for the information. I will take a look at the bigger discussion and the blog. 🙂 We are just patching dev at this point.
g
Gareth
03/12/2024, 10:14 PMhttps://github.com/cfmleditor/CFLint will have an implicit scope checker soon ( not in the current release ), its not perfect but it'll pick up a lot
p
Pawel Czarnota
03/13/2024, 11:01 AMThanks Gareth!
g
Gareth
03/13/2024, 12:05 PMhttps://github.com/cfmleditor/CFLint/releases/tag/1.5.3-SNAPSHOT if you're running CFLint somewhere already this is compiled against JDK 11 and isn't compatible with older JRE's, also the implicit scope checker is a bit slow...
Gareth
03/13/2024, 12:07 PMhopefully some of you find it of some use
Gareth
03/13/2024, 12:08 PMlike I said, its not perfect
Gareth
03/13/2024, 12:09 PMbut I'm using it and its already improving code its identified
👍 1
p
Pawel Czarnota
03/13/2024, 6:41 PMThanks Gareth, we will give it a try!
g
Gareth
03/13/2024, 11:59 PMI'm a bit limited in how much time I can spend on this, but I'm still quite interested in any feedback
p
Pawel Czarnota
03/14/2024, 6:25 PMGareth, the tool works good. It gives me a lot of false positives, but I can see why it might "think" those are unscopped, so I think that's okay. Here is example of false positive. In this code, it reports duplicate(cfcatch) as possibly unscopped.
<cfcatch type="any">
<cfscript>
structAppend(local.excptInfo, duplicate(cfcatch));
Pawel Czarnota
03/14/2024, 6:31 PMAnd an example of a good result. Line below was missing quotes around the ZeroSize:
addError(GetProfileString(Application.ErrorIniPath, "docMgmt", ZeroSize));
Pawel Czarnota
03/14/2024, 8:51 PMGareth, my colleague also tried the below. Looks like CFLint is not marking that code as possible implicit use. Is this something you could add to CFLint?
I dropped in a basic example to test behavior:
<cfset cookie.test=1>
<cfoutput>#test#</cfoutput>
Neither varscoper nor CFLint flagged this unscoped variable, although I am getting an (expected) error from ColdFusion.
g
Gareth
03/14/2024, 9:48 PMI was having some trouble with new files in some projects and can't quite get to the bottom of it, but I tried this in a file I know was being scanned correctly
p
Pawel Czarnota
03/18/2024, 3:33 PMInteresting, looks like you're using it in the VS Code, I will need to try that. I was testing it with the actual jar file, running it manually in the command line.
Copy code
java -jar CFLint-1.5.3-all.jar -file <fullPathToFile>Pawel Czarnota
03/18/2024, 3:47 PMGareth, apologies. Looks like my colleague was testing it with 1.5.0 version and not the latest 1.5.3-SNAPSHOP version of the jar file. I just tried the same code as my colleague's (and yours) and CFLint correctly marks it as possible error.
Pawel Czarnota
03/19/2024, 12:55 PMI tried CFLint in VS Code and I think it works well for me. Thanks for providing it!
7 Views