Hey everyone. New patch announcement this morning. We've released two patches (CF2023: https://cfdownload.adobe.com/pub/adobe/coldfusion/misc/hf202300-8888888.jar) & (CF2021: https://cfdownload.adobe.com/pub/adobe/coldfusion/misc/hf202100-9999999.jar) which allows you to identify unscoped variables inside of a log file. For more information on how to use this tooling, please see our tech note here: https://helpx.adobe.com/coldfusion/kb/view-unscoped-variables-log-file.html

is this where you say "April Fools"?

Thank you to community member @rodel30 for suggesting we add this ability in logs.

Just to clarify, this isn't a patch in the sense that it is or will be required for CF to run. It provides that additional optional logging capability, only. Right?

Dave, correct. If you wish to use this functionality, you can. It is not necessary or required. And if you use Fixinator, you already have a similar capability.

I just want to take a moment to sincerely applaud Adobe (and @Mark Takata (Adobe) for probably riding herd on the process) for adding this requested functionality so quickly! I can't recall ever seeing a user suggestion like this implemented in such a short time frame. Well done!!!👏

Props to @Satyam Mishra & the team for recognizing the value of the recommendation and working the extra hours to get it in.

I know there aren't breaking changes in ACF often, but it would be wonderful if going forward Adobe is able to provide deprecation warnings ahead of any known changes that will break things. (which I'm sure I said before, but am reiterating now 😬) Very grateful to the ACF team for making this patch to help the transition!

so I guess Adobe didn't want to update their "enterprise only" security scanner to include these ?

That is a significantly more time consuming addition than this was, as it happens. So, to provide as immediate an assist as possible to as many folks as we can, we did this first. We're looking at where we can fit in that update into the code scan tooling.

This is bloody fantastic. Well done team.

Thank you for the log tool, however a couple of things to note about the logging: • There is no line number in the output • We do extensive <cfincludes> and we use a index.cfm?cmd=eventdetail&...... So the logs only show index.cfm not the included file (which is the file we need to fix)

Yeah, I noticed that as well. Which definitely makes it less helpful... the other thing that I think could be helpful in the log (and I would think that they'd have on hand at the time) is which scope the variable was ultimately found in.

@Mark Berning Line number was bit misleading, so removed it intentionally..var declaration will never come in this log but if it is present in template, it needs to be refactored..only when any variable is looked for in scope, it comes in this log but that does not mean other references of the variable may need not require refactoring.. so we kept log message generic. <cfinclude> thing will look into.. @rodel30 scope thing also will check if possible Thanks for feedback. We appreciate it.

Thank you! Will try it soon. So far we've used varscoper and CFLint to identify unscoped variables in our code.