XML external entities bug in CF

by kai on 17/05/2006



I’ve experienced a strange behaviour in CF when dealing with external XML entities. What I wanted to do was basically to break down an XML document into several smaller chunks of XML. Shouldn’t be too difficult, hmmm?

I had two xml files, both located in the same folder:

a.xml:

<?xml version=”1.0″?>

<!DOCTYPE myDT [
<!ENTITY config SYSTEM “b.xml”>
]>

<juhu>
&config;
</juhu>

b.xml:

<b>
<name>abc</name>
</b>
</pre>

Following the rules of XML, loading and parsing a.xml should include b.xml without any issues. This works fine with the built-in XML parser of IE and it works fine with Java using the javax.xml.* classes as well.

But for whatever reason, ColdFusion just accepted it when I was using either a complete URL such as http://server/path/to/b.xml or a path such as c:\jrun4\blabla\b.xml to refer to b.xml.

This was (sadly) identified and verified as a bug by Adobe now, due to be fixed not before CF 8.0 alpha 1. It’s bug #63260 – so if you have a chance to vote for it at some point/location – feel free of doing so 🙂

Erki Esken May 17, 2006 at 12:00 am

Ha, I found a workaround. Not pretty, not sure it works 100% everywhere, but works on my Windows JRun4 installation.


sys = CreateObject(“java”, “java.lang.System”);
oldUserDir = sys.getProperty(“user.dir”);
// Temporarily override the user.dir, since CF uses that to decide DTD SYSTEM paths
sys.setProperty(“user.dir”, GetDirectoryFromPath(GetCurrentTemplatePath()));



// Set it back to old value, just in case
sys.setProperty(“user.dir”, oldUserDir);

Comments on this entry are closed.

Previous post:

Next post: