cferror not catching errors

[bryn]

I can't let you get away with that. There is definitely a problem with
<cferror> in CF MX as I see it. I have the same or similar problem that was
described balteo, and many others with similar issues in this forum. In my
Application.cfm I have both of these defined: <cferror type='EXCEPTION'
template='global_error.cfm' mailto='myemail@mydomain.com' exception='Any'>
<cferror type='REQUEST' template='system_error.cfm'
mailto='myemail@mydomain.com' exception='Any'> The difference between the two
pages being that system error.cfm has no cold fusion tags in it at all, but
global_error.cfm has a cfmail tag in it that sends me the contents of the
<error> object. Both deilver a nice looking 'system error please try again'
style of message, with graphics and coloring to match the overall application.
I find that If i deliberately but in the following error code immediately after
the above (or anywhere on any cfm page in the application). <cf_xx> then I get
the global error page as expected. but if I put the following: <cf_xx ('>' is
missing...) then I get the generic CF MX erro exception page with the following
starting line: Invalid token &amp;apos;C&amp;apos; found on line 23 at column
2. .... So that would seem to mean that the <cferror> tage is not trapping
some error exception conditions. Thats fine, but then I get the following
related issue that underlines the overall problem, but it s alittle different,
being that it involves the delivery of a '500 Internal Server error' based upon
data input by the user in the address bar of Internet Explorer (so it is not a
compiler issue, and definitely should be handled by <cferror>::: If I have a
page that is accessed using the following url:
[url]http://myserver/mycfpage.cfm?myvariable=somevalue[/url] and somevalue is any of: %,
%%, %....%, %s, %n, %x then I get a 'HTTP 500 - Internal server error
response page. I tried the following type of coding to try to trap this error:
<CFPARAM name='myvariable' type='any' default='2'> <CFIF
(isDefined('myvariable') and len(trim(myvariable)) eq 0) or
not(isnumeric(myvariable))> <CFSET myvariable=2> </CFIF> but to no avail. I
also tried wrapping the above code inside <cftry> block, also no go. The goal
is to trap the error and deliver either my custom error page, or reset the
value of the myvariable parameter to something reasonable and thus deliver the
desired application page as thought the user had not tried to crack the system.
The overall goal is to present stable applications with consistent error
handling and no ugly error screens as are delivered by default in CF. There
should be no suspicion that a DOS type of attack using this method might
ultimately succeed through successive triggering of system errors. I also
tried putting in the '%' variations on the URL of a server that runs CF 5.0 and
found that it swallowed the error condition and did not give up the 'HTTP 500 -
Internal server error'. So I think I have it pinned: there are implementation
issues in CF MX 6.1 with cferror that were not present in earlier versions of
CF, and I think Macromedia need to address those issues. There are enough
complaints on this section of the forums to make that very clear, and I am
satisfied with my own evidence. There is also some sensitivity to variations
of '%' found on URL variable values. How about doing something about these
two problems ? Can someone assure me these issues have already been addressed
in CF MX 7 ? Thanks, Bryn Parrott

[mix-tape developer]

I use <cferror> too and I have no problem with that! I put all definitions in a
file called Error_handling.cfm {
<cferror type="Exception" template="..." exception="database">\
<cferror type="Exception" template="..." exception="expression">
... }
and I just put in index.cfm of the application the custon tag :
<cf_error_handling language="en" admin="admin@..."...>
Of course the application is done in fusebox methodology!
I use Coldfusion MX 6.1 !
Now I've a question : Somebody here knows how can I send error messages from
my error_handling to the index.cfm in order to be dispayed in the home page of
the application with other information?
Thank you

S@id+

[bryn]

I can report that the '%' issue found on CF 6.1 on iiS 5 and iiS 6 is solved by
moving to CF 7 and Apache (IBM HTTP Server). On the other hand putting in
<cf_xx in application.cfm AFTER the <cferror type=... lines still results in
Cold Fusion helpfully exposing the default error handler suggesting that I
enable robust exception handling, and not my custom error page. So, <cferror>
is still a problem in CF 7 - will macromedia understand WHY this is a
significant Security issue and fix this problem properly ?

[bryn]

And lastly, this issue was finally solved by using the Site Wide Error handler
(in CF Administrator). Note that the httpd.conf file has a setting for
JRunConfig Errorurl . It is not clear when this one is used instead of the site
wide error handler in CF Admin. Cheers,

[Unregistered]

In my local cferror tag is working fine ,but on my live server it is not working.So there is some issue with cferror tag with type="exception".If anybody find solution then let me know