XML external entities bug in CF

by kai on 17/05/2006

I've experienced a strange behaviour in CF when dealing with external XML entities. What I wanted to do was basically to break down an XML document into several smaller chunks of XML. Shouldn't be too difficult, hmmm?

I had two xml files, both located in the same folder:

a.xml:

<?xml version="1.0"?>

<!DOCTYPE myDT >

<juhu>
&config;
</juhu>

b.xml:

<b>
<name>abc</name>
</b>
</pre>

Following the rules of XML, loading and parsing a.xml should include b.xml without any issues. This works fine with the built-in XML parser of IE and it works fine with Java using the javax.xml.* classes as well.

But for whatever reason, ColdFusion just accepted it when I was using either a complete URL such as http://server/path/to/b.xml or a path such as c:\jrun4\blabla\b.xml to refer to b.xml.

This was (sadly) identified and verified as a bug by Adobe now, due to be fixed not before CF 8.0 alpha 1. It's bug #63260 - so if you have a chance to vote for it at some point/location - feel free of doing so :-)

← PreviousNext →Public ZeroOne Breeze community talks

1 comment

Erki Esken 17/05/2006

Ha, I found a workaround. Not pretty, not sure it works 100% everywhere, but works on my Windows JRun4 installation. sys = CreateObject("java", "java.lang.System"); oldUserDir = sys.getProperty("user.dir"); // Temporarily override the user.dir, since CF uses that to decide DTD SYSTEM paths sys.setProperty("user.dir", GetDirectoryFromPath(GetCurrentTemplatePath())); // Set it back to old value, just in case sys.setProperty("user.dir", oldUserDir);