Is there any reason why we could not remove the .j...
# adobem
Mike Greider
04/10/2025, 3:19 PMIs there any reason why we could not remove the .java files in the CF23 example directories? For example, cfusion \ gateway \ src \ examples \ watcher. But there are scattered examples of .java in various example folders and the DoD STIG scanner is complaining about them.
p
Patrick
04/10/2025, 3:22 PMWhats the issue given when attempting to delete? And which stig scanner? I assume internal gov stig policy?
m
Mike Greider
04/10/2025, 3:35 PMYes, the internal DoD scans are flagging and .java files on the server. Not 100% sure what tool they are using for that specific scan. In our case, the only .java instances are in the examples folder nested in cfusion. Just curious if there was any reason why ACF would need those to be on production servers?
p
Patrick
04/10/2025, 3:37 PMWhat is preventing you from removing those directories specifically the examples directory?
m
Mike Greider
04/10/2025, 4:34 PMNothing. My question is if there is anything reason why we shouldn't remove those? Any dependencies within ACF that might need them or cause an issue I'm not aware of.
b
bdw429s
04/10/2025, 4:50 PMYou can remove the gateway examples
bdw429s
04/10/2025, 4:50 PMthey are literally just that-- examples
bdw429s
04/10/2025, 4:51 PMIt's not really a security issue though-- the source (originally written by Sean Corfield) is there in case you want to compile the watchers yourself with changes.
bdw429s
04/10/2025, 4:51 PMIt's quite public code that's been around for well over a decade
bdw429s
04/10/2025, 4:52 PMIn theory, Adobe should remove them and just put them up for download somewhere on their site, but that's just the way it's been prolly since before Adobe even acquired ColdFusion! I'm pretty sure Sean wrote those back for Macromedia to use
💯 2
m
Mike Greider
04/10/2025, 5:05 PMIt's an eye rolling STIG finding. Thank you for adding your thoughts!
👍 1