我有一个 ColdFusion 9 服务器,它在 URL 包含字符 .. 在 / 例如http://www.example.com/..cfm或http://www.example.com之后的任何 ColdFusion 页面上提供以下错误/..foo/bar.cfm:
String index out of range: -1
java.lang.StringIndexOutOfBoundsException: String index out of range: -1
at java.lang.AbstractStringBuilder.delete(AbstractStringBuilder.java:698)
at java.lang.StringBuffer.delete(StringBuffer.java:373)
at coldfusion.util.Utils.collapseDotDots(Utils.java:604)
at coldfusion.util.Utils.canonicalizeURI(Utils.java:558)
at coldfusion.filter.PathFilter.invoke(PathFilter.java:39)
at coldfusion.filter.ExceptionFilter.invoke(ExceptionFilter.java:70)
at coldfusion.filter.ClientScopePersistenceFilter.invoke(ClientScopePersistenceFilter.java:28)
at coldfusion.filter.BrowserFilter.invoke(BrowserFilter.java:38)
at coldfusion.filter.NoCacheFilter.invoke(NoCacheFilter.java:46)
at coldfusion.filter.GlobalsFilter.invoke(GlobalsFilter.java:38)
at coldfusion.filter.DatasourceFilter.invoke(DatasourceFilter.java:22)
at coldfusion.CfmServlet.service(CfmServlet.java:175)
at coldfusion.bootstrap.BootstrapServlet.service(BootstrapServlet.java:89)
at jrun.servlet.FilterChain.doFilter(FilterChain.java:86)
at coldfusion.monitor.event.MonitoringServletFilter.doFilter(MonitoringServletFilter.java:42)
at coldfusion.bootstrap.BootstrapFilter.doFilter(BootstrapFilter.java:46)
at jrun.servlet.FilterChain.doFilter(FilterChain.java:94)
at com.seefusion.Filter.doFilter(Filter.java:49)
at com.seefusion.SeeFusion.doFilter(SeeFusion.java:1500)
at jrun.servlet.FilterChain.doFilter(FilterChain.java:94)
at jrun.servlet.FilterChain.service(FilterChain.java:101)
at jrun.servlet.ServletInvoker.invoke(ServletInvoker.java:106)
at jrun.servlet.JRunInvokerChain.invokeNext(JRunInvokerChain.java:42)
at jrun.servlet.JRunRequestDispatcher.invoke(JRunRequestDispatcher.java:286)
at jrun.servlet.ServletEngineService.dispatch(ServletEngineService.java:543)
at jrun.servlet.jrpp.JRunProxyService.invokeRunnable(JRunProxyService.java:203)
at jrunx.scheduler.ThreadPool$DownstreamMetrics.invokeRunnable(ThreadPool.java:320)
at jrunx.scheduler.ThreadPool$ThreadThrottle.invokeRunnable(ThreadPool.java:428)
at jrunx.scheduler.ThreadPool$UpstreamMetrics.invokeRunnable(ThreadPool.java:266)
at jrunx.scheduler.WorkerThread.run(WorkerThread.java:66)
我无法在我测试过的每台服务器上重现这一点,但它似乎发生在大多数服务器上。查看错误,它看起来与 ColdFusion 的一部分有关,而不是与这些站点上运行的任何 ColdFusion 代码有关。任何人都可以对此进行更多说明,例如如何捕捉错误?