http://coldfusion.com logo
Join Slack
Powered by
I'm seeing a behavior on 2021.0.20 where, on start...
# adobe
b
I'm seeing a behavior on 2021.0.20 where, on startup, my clients scheduled tasks which write to a log file all log something along the lines of this in the 
scheduler.log
file:
Copy code
Security violation: Scheduled task 'JOB NAME HERE' attempted to execute unauthorized path: c:\websites\temp\my-job-log.html. To allow it, whitelist the path in cf-root/lib/pathfilter.json against key schedulerexecutionpaths.
And then all of the scheduled tasks are DELETED right out of the 
neo-cron.xml
! 😳 Is this a new behavior? Does anyone have a link handy to where it's documented? Do all output logs have to be whitelisted, or are some allowed by default? More in 🧵
My default 
pathfilter.json
file is
Copy code
{
  "comments": "paths should be semi-colon seperated. To Allow a file: {path-of-file}; To Allow a directory & files in it: {path-to-directory}/*; To Allow a directory & sub-directories: {path-to-directory}/**; To Block a file: !{path-of-file}; To Block a directory & sub-directories: !{path-to-directory}/**; Precedence decreases from left to right. Suppose directory A has directory B & C inside <http://it.To|it.To> Allow B & Block C: !A/C/*;A/**;",
  "bytecodeexecutionpaths": "",
  "schedulerexecutionpaths": ""
}
I'm confused what it means by "scheduler execution paths" since the scheduled tasks aren't "executing" anything, they're just writing their output to a log file.
But does the empty string mean that no scheduled tasks are allowed to write any logs unless I whitelist the log folders?
And why is CF deleting my client's schedule tasks?? Why can't you just pause them? It's a real inconvenience and luckily, they are using CFConfig, or they would have lost their 200 some-odd tasks after updating.
m
I know we added whitelisting for some things, I didn't think this was one. @priyank_adobe any thoughts? Is the whitelister catching something in the path it shouldn't be?
b
They're basically just using this feature here
j
Someone just posted a similar issue in the last several days or last week. A quick search here might help.
👍 1
b
Thanks for the heads up. I do see @Dave Merrill mentioned this in a thread I hadn't seen
j
Ya, there was more to it. I’m unable to find it. Sorry, if I come across it - I’ll share.
b
Note: If scheduled tasks have the Publish > Save output to a file option enabled in ColdFusion Administrator with a specified file path, the task will no longer function unless that path is explicitly allowed in the schedulerexecutionpaths section of pathfilter.json file located in <cf_home>/lib.
Except, that's not quite right. The task does more than "no longer function". It's deleted from the 
neo-cron.xml
file entirely!
I still also don't understand why the setting is called "schedulerExecutionPaths" since it's related to log files, not execution, but I can understand the obvious attack vector they're trying to block.
😲 2
The engineers can't normally comment on any changes made due to security so I doubt we'll get much more explanation
I would still suggest they simply deactivate tasks and add a warning to the admin UI instead of deleting them. heck, or go the extra mile and • provide a button while editing the task to white list that folder • or default the JSON whitelist to the current folders you've already been writing to and assume you are at least in favor of your current config working 🙂
☝🏻 2
☝️ 5
m
+1 on doing anything other than just deleting the scheduled task. That got us as well.
2 Views
Open in Slack
PreviousNext
Powered by