http://coldfusion.com logo
Join Slack
Powered by
<@U070SQMD1> I can't find anything about these que...
# lucee
a
@zackster I can't find anything about these query listeners other than this: https://southofshasta.com/blog/cfcamp-notes-on-railo/#:~:text=CFquery%20listener%3D%22%23listener%23%22 https://www.google.com/search?q=lucee+%22query+listener%22 Should I take this to mean they are not documented? I searched for a few things. Both in Google and in yer docs.
z
Yeah that was my take away from my research yesterday after you asked me that question. Needs to be written up. One thing we recently experienced which needs to be included in the docs is that queries results aren't always queries, they can also be structs or arrays
I'm writing this up
Just added some documentation for query listeners https://dev.lucee.org/t/query-listeners/11051
a
Ah nice one man. Thanks for that.
f
Thanks for writing it up @zackster - very cool feature — what if you could do this to any tag 🤔 or function 🤔
sure it would be a footgun, but I can think of some nice uses for security
z
cflog for sure
f
cffile, and all the functions that access file system
z
you mean resource logging?
f
I would use it for sanity checking the paths
for example why is the developer trying to read /etc/passwd
or write to whereever…
and then you could block accesses to paths not on allow list… would be handy because most people are really bad at configuring the OS file system permissions properly
or they are running as root so it doesn’t matter
maybe something to think about for Lucee 7, I could be the only one that wants it though 🤷
aware of that setting, but the problem with that is to use 
local
it forces you to put all your files (think configuration) under the webroot
z
yeah, that we can easily improve i reckon
f
so you almost always want local + one folder 🙂
I don’t want to distract from Lucee 6 getting released so let’s talk about this idea again in the future
z
plz file a bug, I'd like to check that's still working with single mode too in 6.0
f
ok will do
hmm - It looks like local actually does support custom paths
z
this code? 
else throw new SecurityException("invalid access value [" + accessValue + "]", "valid access values are [all,local,no,none,yes,1,...,10]");
https://github.com/lucee/Lucee/blob/5.3.9/core/src/main/java/lucee/runtime/security/SecurityManagerImpl.java#L204
would just creating a mapping grant access?
Ahh long day today for me, sighs
f
are these file access settings exposed to Application.cfc? that would be cool I didn’t see it when I exported Application.cfc from admin, or in the Application.cfc docs so I’m assuming it is not supported there
Open in Slack
PreviousNext
Powered by