Out of curiosity/experimentation, does anyone know if

cfcontent

, with the

file

attribute pointed at a remote URL, downloads the file locally before displaying, or just passes through the reference?

cfcontent(file='<https://placehold.co/676x322>');

From the docs, the file attribute must be an on-disk or in-memory file, so just from that it doesn’t sound like referencing a URL like that would work.

Sadly, that's the experimentation part - it does work in 2021+

That's a tad creepy, isn't it? CF will download a remote file that way? I wonder what file types it will reject.

given your example, just redirect to it

The server will fetch the contents of the URL and return it to the user. This behavior applies to any tag/function that accepts an Apache Commons VFS scheme (could be a URL, a local file path, other supported schemes) as a parameter. ("Resources" are the equivalent in Lucee -- https://docs.lucee.org/guides/Various/lucee-resources.html) So you'll want to review/avoid/validate any instances where the user can control the resource/destination. It's potentially a little more risky in cases like

cfcontent

where the results will be displayed to the user, but even letting arbitrary requests be made from your application server can have negative security results (cf. https://www.hoyahaxa.com/2021/04/ssrf-in-coldfusioncfml-tags-and.html)

Thanks @Brian Reilly - that's exactly what I was looking for.