In the Update 15 release notes, there's this:

If the XML path contains a forward slash or backslash, it will be blocked. The flag, coldfusion.xml.allowPathCharacters, must be set to true to allow the same.

What does that mean, exactly? Like,

XMLParse("a/path/to/an/xml/file.xml")

no longer works unless I set that flag? (in the JVM args? In the Application.cfc? the docs are a bit sparse here...)

I’ll be curious to know what you figure out with this, as our apps work extensively with XML processing.

@priyank_adobe do you have any insights here?

@Tim I’m seeing something similar on the first dev box I sacrificed to this update: we’re parsing XML files based on a full path to the file and I’ve not done any server config related to that noted flag.

I was assuming it was referring to the XPath in

xmlSearch

, but still not clear on what is disallowed since slashes are going to be extremely common for that.

yeah -- that was my second thought. but / is vital to how XPath works. And the same file that I have parsing XML files then runs a bunch of XmlSearch on them and all that was working too.

@saghosh can you speak to the language used and how it relates to the meaning re: XML?

I haven't exhaustively tested this, but I can trigger the error:

Expression Unable to process the XML string as it could probably contain file paths.

for an XSLT style sheet passed to XMLTransform() contains slashes or backslashes. But it also appears to trigger on

<\xsl:stylesheet>

, which I don't think is right

Sorry about delay in response but this change is for xmltransform()

@Brian Reilly shouldn't that be

</xsl:stylesheet>

? The backslash there seems wrong.

@priyank_adobe Sure - I can try. It's not directly impacting me, and I'm happy to take the conversation offline. I'm one of the folks who reported XMLTransform() issues. For security reasons, you may want to strip / and \ in some xsl elements, but there are lots of places where you will want or need them (or where they'll be innocuous) -- such as

</xsl:stylesheet>

and

<xsl:stylesheet version="1.0" xmlns:xsl="<http://www.w3.org/1999/XSL/Transform>">

@priyank_adobe adding to the list of places you'd want/need

/

in a transform... embedded XPath selectors. So really,

XmlTransform

is now useless, unless you enable that flag. because the xsl parameter of that function is not allowed to have / in it. But it takes an XML string which is required to have / in it...