http://coldfusion.com logo
Join Slack
Powered by
Ugh, another upgrade, another try/catch that doesn...
# lucee
s
Ugh, another upgrade, another try/catch that doesn't actually catch the error. With Lucee 6.1.0.243 there's a new breaking change. In Lucee 6.0.3.1, an error in the try would move on to the catch, as usual. In Lucee 6.1.0.243, the error is thrown from the line in the try, erroring out the page itself, and never hitting the catch. This appears to be a particular issue where java classes are involved, or in this case, Owasp jars.
Copy code
try {
			safeHTML = policy.sanitize( untrusted_string );
		} catch (any e) {
			if ( e.message is "The sanitize method was not found."
				or ( e.message == "No matching Method for sanitize(string) found for org.owasp.html.HtmlPolicyBuilder" )
				or ( left(e.message,31) is "No matching Method/Function for" and right(e.message,55) is "org.owasp.html.HtmlPolicyBuilder.sanitize(string) found" ) ) {
				safeHTML = getPolicy( policy ).sanitize( untrusted_string )
			} else {
				rethrow;
			}
		}
image.png
The line of the error is the line of the try block's safeHTML, not the catch.
So that just blocked upgrading to Lucee 6.1. There's no workaround for this.
Unsure how 6.1 reached "stable" status with that glaring regression.
I ran into this issue in 6.0 when session errors were thrown.... couldn't try/catch those either.
Like you can see in the code that this is an expected error, we trap for this specific condition and then try calling the method a different way. And that's worked fine. Until Lucee 6.1
I'm unable to reproduce it just by creating an error with a java class, so it's likely something to do with the https://docs.oracle.com/en/java/javase/11/docs/api///java.base/java/lang/NoSuchMethodException.html That particular error is erroring directly to the page and isn't being trapped by the try in Lucee 6.1
It may also be related to the Owasp library itself, but ultimately I'd still expect a try to catch an error 100% of the time.
Ha! I get it now!
It's a change to the error message. The code looks for right(e.message,55) for "org.owasp.html.HtmlPolicyBuilder.sanitize(string) found" But in 6.1 this is the error message: "... org.owasp.html.HtmlPolicyBuilder.sanitize(string) found. there are no methods with this name" The "there are no methods with this name" is new in the error message. But the better way to handle this is like this:
Copy code
var safeHTML = "";

try {
	safeHTML = policy.sanitize( untrusted_string );
} catch (java.lang.NoSuchMethodException e) {
	safeHTML = getPolicy( policy ).sanitize( untrusted_string )
} catch (any e) {
	rethrow;
}

return safeHTML;
So because of not hitting the proper catch condition, we were falling through the 
rethrow
, and the rethrow condition will throw the original error line inside the try block to the page. Nothing is broken, per se. Though still a minor regression. It was a gotcha that I encountered because of looking for a specific error message string. I'll just rewrite the code, and we're good. Thanks for being my rubber duck everyone.
rubber duck 2
Note that the Type also changed between Lucee 6.0 and Lucee 6.1. Lucee 6.1 passes through the actual java error, whereas in 6.0 it's "expression"
To properly fix this for both Lucee 6.0 and Lucee 6.1:
Copy code
try {
	safeHTML = policy.sanitize( untrusted_string );
} catch (java.lang.NoSuchMethodException e) {
	safeHTML = getPolicy( policy ).sanitize( untrusted_string );
} catch(expression e) {
	safeHTML = getPolicy( policy ).sanitize( untrusted_string );
} catch (any e) {
	rethrow;
}
🙏🏼 1
6 Views
Open in Slack
PreviousNext
Powered by